Audit Your GitHub Actions Workflows for Security and Performance Issues

Audit Your GitHub Actions Workflows for Security and Performance Issues Most GitHub Actions workflows accumulate problems quietly. A missing cache: 'npm' in your setup-node step adds 60 seconds to every CI run. Multiply that by 50 developers pushing code 5 times a day — that's 25,000 seconds of wasted CI time per week. Across a year, it's real money in compute costs and real friction in developer experience. Worse: a pull_request_target misconfiguration can let a malicious contributor exfiltrate your repository secrets. GitHub's own security team published an advisory about this class of vulnerability. It affects popular open source projects and well-funded startups alike. These issues are detectable. They follow predictable patterns. They should be caught before they ship. That's what ci-check does. What ci-check Does ci-check is a zero-dependency Node.js CLI that scans your .github/workflows/ directory and reports: Security vulnerabilities (critical and high severity) Performance ine