eliottreich/taskbounty-check

**A local check for GitHub Actions and CI maintenance hygiene** (third-party action pinning,
workflow token permissions, and update automation), built for apps shipped with Lovable, Bolt,
Replit, Cursor, or v0.
**Local by default. No uploads. No telemetry.** It reads only your workflow files, on your machine.
The default code path makes no outbound network requests, writes its report locally, and sends
nothing anywhere. There is no analytics or phone-home of any kind. Only the opt-in --gh-org mode
uses the network (through your own gh session).
**Works with Cursor, Claude Code, and Codex** (local MCP server, below).
Three ways to use it
**1. GitHub Action** — add a maintenance check to CI that writes a summary to the run (no PR
comments, no source upload):
Want a human to interpret or fix what the Action surfaces? Request a free launch-safety review. TaskBounty gets no access to your repo, source, or workflows unless you submit that form.
**2. Agent / MCP** — a local stdio server for Cursor, Claude Code, and Codex:
**3. One-off CLI** — scan the current repo locally and write a report:
> Pin a version (@0.1.6) in committed config and CI for reproducibility. @latest is convenient
> for a quick one-off, but a pinned version is the reproducible choice.
The GitHub job summary
The Action writes a counts-only maintenance summary to the workflow run (categories and next steps,
no filenames, line numbers, or repo source). Below is that exact summary, rendered from this repo's
own CI output:
See it produced live by the **self-check** job in this repository's Actions runs.
Prefer a guided walkthrough? Follow the
five-minute real-repository quickstart.
Learn more
- Methodology — exactly what it reviews and how findings are labeled.
- Privacy and scope — local-by-default data handling.
- Limitations — what it does NOT check (below).
Supported checks (and honest limitations)
**Checks (GitHub Actions + CI maintenance hygiene):**
- Third-party actions pinned to a movable tag/branch instead of a commit SHA
- Broad (write-all) workflow token permissions
- Missing explicit permissions: block
- Update automation (Dependabot/Renovate) presence
- Context-dependent workflow patterns flagged for private review (e.g. pull_request_target, script injection)
**Does NOT check** (these need a manual review): exposed secrets, auth/authorization, payments,
webhooks, runtime behavior. It is a maintenance/hygiene check, **not** a full security audit or a
penetration test.
What it does
- Reads only your GitHub Actions workflow files and update-automation config, scans them
in-process with a deterministic ruleset (the same rules as the public checker), and writes a
local HTML + JSON report. It does **not** execute workflows, install dependencies, or run any
repository code.
Modes
| Mode | Command | Network |
|------|---------|---------|
| Single repo | npx taskbounty-check . | none |
| Directory of repos | npx taskbounty-check ./all-repos | none |
| Explicit paths | npx taskbounty-check --manifest repos.json | none |
| GitHub org (your gh session) | npx taskbounty-check --gh-org | **yes, opt-in** |
--gh-org uses your existing gh CLI session to fetch each repo's workflow files **to this
machine** (read-only). Your GitHub token is never read by this tool and never sent to TaskBounty.