Pipelineweft: CI Audit

About Pipelineweft: CI Audit

Pipelineweft audits GitHub Actions workflow YAML for supply-chain risk — a scored security review of your CI pipeline that runs entirely on your device.

The workbench puts your workflow source and its audit report on one screen: side by side on iPad and other wide displays, one flip apart on iPhone. Edit the YAML in a monospaced editor, tap Run Audit, and the supply-chain posture report updates with a 0–100 score, a findings-by-severity chart, and every finding pinned to its line number with a concrete remediation.

WHAT IT CHECKS
• Actions pinned to tags instead of reviewed 40-character commit SHAs
• Secrets interpolated directly into run: shell text
• Privileged pull_request_target triggers
• write-all token permissions
• Self-hosted runners receiving workflow code
• Missing explicit permissions block (implicit token scope)

FEATURES
• Monospaced YAML editor with autocorrection disabled
• Severity-weighted score — criticals cost more than warnings
• Findings sorted critical-first, each with line number and fix
• Findings-by-severity bar chart
• Executable step count (uses: and run:) at a glance
• Sample workflow included so you can explore every check immediately

PREMIUM BY DESIGN
One-time paid download. No account, no ads, no analytics, no tracking, and no network access at all — your workflow YAML never leaves the device. Works completely offline.