actions-warden 0.1.1 → 0.2.0

package/README.md

@@ -1,13 +1,28 @@
 # actions-warden
 
+[![npm](https://img.shields.io/npm/v/actions-warden?color=cb3837&logo=npm)](https://www.npmjs.com/package/actions-warden)
+[![provenance](https://img.shields.io/badge/npm-provenance-5b21b6?logo=npm)](https://www.npmjs.com/package/actions-warden?activeTab=code)
+[![ci](https://github.com/chiz0me/actions-warden/actions/workflows/ci.yml/badge.svg)](https://github.com/chiz0me/actions-warden/actions/workflows/ci.yml)
+[![CodeQL](https://img.shields.io/badge/CodeQL-active-2188ff?logo=github)](https://github.com/chiz0me/actions-warden/security/code-scanning)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/chiz0me/actions-warden/badge)](https://securityscorecards.dev/viewer/?uri=github.com/chiz0me/actions-warden)
+[![node](https://img.shields.io/node/v/actions-warden)](https://www.npmjs.com/package/actions-warden)
+[![license: MIT](https://img.shields.io/badge/license-MIT-green)](./LICENSE)
+
 Audit, pin, and upgrade GitHub Actions workflows. Designed for safe, hands-off
 invocation by humans **or** LLMs.
 
-- **Audit** - scan workflows for supply-chain and injection vulnerabilities
+- **Audit** - scan workflows for supply-chain/injection risks and composite actions for mutable dependencies
 - **Pin** - rewrite tag refs (`@v3`) to immutable commit SHAs
 - **Upgrade** - bump pinned actions to the newest permitted version
 - **Report** - combined audit + dry-run plan, ideal for LLM context
 
+Inspired by [`actions-up`](https://github.com/azat-io/actions-up). The
+update/pin core borrows its overall shape - YAML parsing plus regex-based
+source rewrites that preserve formatting - and adds an audit layer, an
+LLM-friendly TOON output format, inline ignore directives, an upgrade
+cooldown, a Claude Code plugin, and a composite GitHub Action so the same
+engine runs locally, in CI, and from inside Claude.
+
 ## Why
 
 Tag references in `uses:` are mutable - anyone with write access to the action
@@ -29,7 +44,7 @@ Requires Node.js 20 or newer.
 ## Quick start
 
 ```sh
-# Audit every workflow under .github/workflows
+# Audit workflows, reusable workflow calls, and composite actions
 actions-warden audit
 
 # Audit a specific file with remediation hints
@@ -80,7 +95,7 @@ Scan workflows for security findings.
 
 | flag | default | description |
 |---|---|---|
-| `-w, --workflow <pattern>` | discover under `.github/workflows/` | repeatable path or glob |
+| `-w, --workflow <pattern>` | discover workflows and `**/action.yml|yaml` | repeatable path or glob |
 | `--severity <level>` | `low` (i.e. include all) | minimum severity to report |
 | `--explain` | `false` | include plain-English remediation hint per finding |
 | `--format <fmt>` | `toon` | `toon`, `json`, or `text` |
@@ -233,14 +248,15 @@ for (const finding of result.findings) {
 ```
 
 Available functions: `audit`, `pin`, `upgrade`, `report`, `listRules`,
-`parseWorkflowFile`, `renderAudit`, `renderPin`, `renderUpgrade`,
-`renderReport`, `format`, `redact`.
+`discoverWorkflows`, `parseWorkflowFile`, `parseWorkflowSource`, `collectUses`,
+`parseActionRef`, `renderAudit`, `renderPin`, `renderUpgrade`, `renderReport`,
+`format`, `redact`.
 
 ## Audit rules
 
 | id | severity | catches |
 |---|---|---|
-| `unpinned-action` | high | `uses:` refs that aren't 40-char SHAs |
+| `unpinned-action` | high | workflow steps, job-level reusable workflows, and composite-action `uses:` refs that aren't 40-char SHAs |
 | `excessive-permissions` | medium | `write-all` and broad write scopes |
 | `secrets-in-env` | critical | secrets at workflow/job env (leaks to every step) |
 | `script-injection` | critical | `github.event.*` interpolated into `run:` |
@@ -286,123 +302,15 @@ TTL defaults to 1 hour. Delete the directory to force a refresh.
 | `1` | findings reported, or errors during pin/upgrade |
 | `2` | invalid arguments |
 
-## Releasing
-
-To cut a release:
-
-1. Bump `version` in `package.json` (e.g. `0.1.0` → `0.2.0`).
-2. Commit and push to `main`.
-3. Create and push the tag:
-
-   ```sh
-   git tag v0.2.0
-   git push origin v0.2.0
-   ```
-
-The `.github/workflows/release.yml` workflow then:
-
-- verifies `package.json` version matches the tag and runs the test suite,
-- creates a GitHub Release with auto-generated notes,
-- force-updates the floating major tag (e.g. `v0`) to point at the new commit.
-
-Consumers can pin precisely (`@v0.2.0`), float on the major (`@v0`), or
-pin to a commit SHA (recommended - and what `actions-warden pin` will
-produce when run against their workflow).
-
-### Publishing to the GitHub Marketplace
-
-The repo's `action.yml` already declares `branding`, so it is Marketplace-eligible.
-After the first release tag is pushed, open the release on github.com and tick
-"Publish this Action to the GitHub Marketplace" to list it. No automation
-required - the release workflow above handles everything except that opt-in.
-
-### Marketplace sync
-
-When a `vX.Y.Z` tag is pushed, the `sync-marketplace` job in `release.yml`
-updates the `actions-warden` plugin entry in
-[chiz0me/claude-plugins/.claude-plugin/marketplace.json](https://github.com/chiz0me/claude-plugins/blob/main/.claude-plugin/marketplace.json)
-to match. No-op when the marketplace is already on the target version.
-
-**One-time setup (cross-repo write requires a token the default
-`GITHUB_TOKEN` cannot provide):**
-
-1. Create a **fine-grained personal access token** at
-   https://github.com/settings/personal-access-tokens/new with:
-   - Repository access: **Only select repositories → `chiz0me/claude-plugins`**
-   - Permissions: **Contents: Read and write**
-2. In `chiz0me/actions-warden` repo settings, add it as an Actions secret
-   named **`MARKETPLACE_SYNC_TOKEN`**.
-
-After that, every release tag also writes a `sync: bump actions-warden to vX.Y.Z`
-commit to the marketplace repo.
-
-### Publishing to npm
-
-The release workflow includes a `publish-npm` job that publishes to npm with
-provenance via OIDC trusted publishing - no long-lived `NPM_TOKEN` lives in
-GitHub secrets.
-
-**npm does not support pre-publish trusted-publisher configuration** — the
-Trusted Publisher panel only appears on packages that already exist on the
-registry. So the very first publish has to be done with a one-time automation
-token; after that, OIDC takes over.
-
-#### Step 1 — bootstrap publish (one time, locally)
-
-```sh
-npm login                              # browser auth
-npm publish --access public            # no --provenance on the first publish;
-                                       # local publishes can't sign provenance
-```
-
-#### Step 2 — configure the trusted publisher on npmjs.com
-
-Once the package exists, go to:
-
-**npmjs.com → Packages → actions-warden → Settings → Trusted publishing**
-
-Add a new GitHub Actions publisher with:
-
-- Organization or user: `chiz0me`
-- Repository: `actions-warden`
-- Workflow filename: `release.yml`
-- Environment: *(leave blank)*
-
-Save. From this point on, no token is needed.
-
-#### Step 3 — release future versions
-
-Bump `version` in `package.json`, push, then:
-
-```sh
-git tag v0.2.0
-git push origin v0.2.0
-```
-
-The release workflow then:
-
-- runs the full test suite and dependency-pin verification,
-- publishes to npm with `--provenance --access public` (the published package
-  carries a verifiable link back to this exact commit and workflow run),
-- creates the GitHub Release with auto-generated notes,
-- force-moves the floating major tag (`v0`).
-
-The package is published as **`actions-warden`** (unscoped, public). Consumers
-install it with:
-
-```sh
-npm install -g actions-warden
-# or
-npx actions-warden audit
-```
-
-> **Requirements:** trusted publishing needs npm ≥ 11.5.1 and Node ≥ 24, so the
-> `publish-npm` job uses Node 24 and upgrades npm to latest before publishing.
-
 ## Security
 
 See [SECURITY.md](./SECURITY.md) for the disclosure policy.
 
+## Maintainers
+
+Release process, npm/marketplace setup, and verification commands live in
+[RELEASING.md](./RELEASING.md).
+
 ## License
 
 MIT

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "actions-warden",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Audit, pin, and upgrade GitHub Actions workflows. LLM-friendly TOON output, safe-by-default.",
   "author": "Naveen Yagati",
   "homepage": "https://github.com/chiz0me/actions-warden#readme",
@@ -25,6 +25,7 @@
   },
   "files": [
     "src",
+    "skills",
     "README.md",
     "SECURITY.md",
     "LICENSE"
@@ -42,7 +43,8 @@
     "lint": "eslint src test",
     "verify-deps": "node scripts/verify-deps.js",
     "audit": "npm audit --audit-level=high",
-    "prepublishOnly": "node scripts/verify-deps.js && npm test"
+    "release:verify": "npm run verify-deps && npm run lint && npm test && npm audit --audit-level=high && npm pack --dry-run",
+    "prepublishOnly": "npm run release:verify"
   },
   "dependencies": {
     "commander": "14.0.3",
@@ -51,6 +53,7 @@
     "yaml": "2.9.0"
   },
   "devDependencies": {
+    "eslint": "10.8.0",
     "vitest": "4.1.6"
   },
   "keywords": [

package/skills/actions-warden/SKILL.md

@@ -0,0 +1,139 @@
+---
+name: actions-warden
+description: Audit, pin, and upgrade GitHub Actions workflows and composite actions. Use when the user asks to scan GitHub Actions for supply-chain or injection vulnerabilities, inspect reusable-workflow calls or composite-action dependencies, replace mutable tag or branch refs with commit SHAs, bump pinned action versions, or generate a CI security report. Triggers include "audit my workflows", "pin my actions", "upgrade actions", "check workflow security", "are my GitHub Actions safe", pull_request_target, unpinned actions, reusable workflows, composite actions, or script injection in CI.
+---
+
+# actions-warden
+
+`actions-warden` is a Node.js CLI on npm that audits, pins, and upgrades GitHub
+Actions workflows. It is safe-by-default (every mutating command dry-runs unless
+`--write` is passed) and emits TOON output — one labeled `KEY: k=v` record per
+line, ending with `STATUS: OK` or `STATUS: FAIL` — which is parseable without
+a schema.
+
+## When to use this skill
+
+Invoke `actions-warden` when the user:
+
+- asks to **audit, scan, check, or review GitHub Actions workflows** for security
+  issues (unpinned actions, broad `permissions`, secrets exposed in env,
+  script injection, pull_request_target pwn-request);
+- asks to **pin actions to commit SHAs** or replace tag refs (`@v3`) with
+  immutable hashes;
+- asks to **upgrade or bump** workflow action versions (with optional cooldown);
+- wants a **combined security report** on `.github/workflows`;
+- references the `pull_request_target` event, `${{ github.event.* }}` interpolation
+  in run scripts, or supply-chain risk in CI.
+
+## How to invoke
+
+The package is on npm as `actions-warden`. Run it via `npx`:
+
+```sh
+npx actions-warden audit                           # default: scan .github/workflows
+npx actions-warden audit --severity=high --explain # high+, with remediation hints
+npx actions-warden audit --format=json             # JSON output
+npx actions-warden pin                             # plan SHA pins (dry-run)
+npx actions-warden pin --write                     # apply pins
+npx actions-warden upgrade --mode=minor            # bump within current major
+npx actions-warden upgrade --min-age=14 --write    # only accept tags >=14 days old, apply
+npx actions-warden report --offline                # audit + dry-run plan, no network
+npx actions-warden rules                           # list rule catalog
+```
+
+Useful global flags: `--workflow <path-or-glob>` (repeatable), `--cwd <dir>`,
+`--format toon|json|text`, `--output stdout|file`, `--output-path <path>`,
+`--token <gh-token>` (also reads `GITHUB_TOKEN` / `GH_TOKEN`).
+
+Exit codes: `0` on success/no findings, `1` on findings or errors, `2` on
+usage error.
+
+## What to do when invoked
+
+1. **Identify the Actions scope.** If the user named a file or directory,
+   pass it via `--workflow`. Otherwise let discovery scan `.github/workflows/`
+   plus repository `action.yml` and `action.yaml` files. Default discovery
+   excludes `.git` and `node_modules`.
+
+2. **Pick the right command.**
+   - "audit / scan / check security / find issues" → `audit`
+   - "pin to SHAs / lock down / replace tags" → `pin`
+   - "upgrade / update / bump versions" → `upgrade`
+   - "give me a full report / what would change" → `report`
+
+3. **Default to dry-run.** Never pass `--write` unless the user has explicitly
+   said apply / write / commit / mutate. The CLI exits `0` whether or not it
+   would have written anything — examine the output to plan next steps.
+
+4. **Read the output.** Every TOON line is a record:
+   - `FINDING: id=<10-char-hex> type=<rule> sev=<critical|high|medium|low> file=<path> line=<n> ...`
+   - `PIN: id=<id> file=<path> action=<owner/repo> from=<tag> to=<sha> applied=<bool>`
+   - `UPGRADE: id=<id> action=<owner/repo> from=<tag> to=<newer-tag> level=<major|minor|patch>`
+   - `SKIP: action=<...> tag=<...> reason=cooldown age_days=<n>`
+   - `SUMMARY: files=<n> findings=<n> critical=<n> high=<n> medium=<n> low=<n>`
+   - `STATUS: OK` or `STATUS: FAIL` on the last line.
+
+   Every `id` is stable — to apply just one specific change, pass `--fix=<id>`
+   (works on `pin` and `upgrade`).
+
+5. **Explain findings clearly.** Reference each finding by file and line. If
+   the user wants remediation guidance, re-run with `--explain` to get a
+   one-line hint embedded in each `FINDING:` record.
+
+## Audit rules
+
+| id | severity | catches |
+|---|---|---|
+| `unpinned-action` | high | workflow-step, reusable-workflow job, and composite-action `uses:` refs that aren't 40-char SHAs |
+| `excessive-permissions` | medium | `write-all` or broad write scopes |
+| `secrets-in-env` | critical | secrets at workflow- or job-level env (leaks to every step) |
+| `script-injection` | critical | `${{ github.event.* }}` interpolated into `run:` |
+| `pull-request-target-checkout` | critical | "pwn-request" — pull_request_target + PR head checkout |
+
+## Inline ignore directives
+
+If the user has reviewed a finding and wants to silence it without changing
+the action ref, they can add a comment:
+
+```yaml
+- uses: actions/checkout@v3  # actions-warden-ignore: unpinned-action
+```
+
+Other forms: `# actions-warden-ignore-file`, `# actions-warden-ignore-start`/`-end`,
+`# actions-warden-ignore-next-line`. Bare directive silences all rules;
+`# actions-warden-ignore: a,b,c` silences only the listed rule ids.
+
+## Programmatic API (no subprocess)
+
+When you want to consume results in JS without spawning the CLI:
+
+```js
+import { audit, pin, upgrade, report } from 'actions-warden';
+
+const result = await audit({ cwd: '/repo', explain: true });
+// result.findings: [{ id, ruleId, severity, file, line, fields, explain }]
+// result.summary:  { files, findings, critical, high, medium, low }
+// result.status:   'OK' | 'FAIL'
+```
+
+Other exports: `listRules`, `discoverWorkflows`, `parseWorkflowFile`,
+`parseWorkflowSource`, `collectUses`, `parseActionRef`, `renderAudit`,
+`renderPin`, `renderUpgrade`, `renderReport`, `format`, `redact`,
+`parseIgnoreDirectives`.
+
+## Notes
+
+- The CLI never prompts interactively — all decisions are flag-driven, so it
+  is safe to invoke without a TTY.
+- Output is deterministic: running twice on an unchanged repo produces
+  identical bytes.
+- For GitHub API calls (pin, upgrade), unauthenticated quota is 60 requests/hour.
+  Set `GITHUB_TOKEN` to raise it to 5,000/hour.
+- Cache lives at `.actions-warden-cache/` (1-hour TTL). Delete the dir to
+  force a refresh.
+
+## Source
+
+- npm: https://www.npmjs.com/package/actions-warden
+- repo: https://github.com/chiz0me/actions-warden
+- GitHub Action: `uses: chiz0me/actions-warden@v0`

package/skills/actions-warden/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Actions Warden"
+  short_description: "Harden GitHub Actions supply-chain security"
+  default_prompt: "Use $actions-warden to audit this repository and explain every GitHub Actions security finding."

package/src/lib/parser.js

@@ -37,6 +37,7 @@ import { parseDocument, isMap, isSeq, isPair, isScalar } from 'yaml';
  * @property {object|null} permissions
  * @property {string|null} runsOn
  * @property {object|null} env
+ * @property {ActionRef|null} uses       reusable workflow called at job level
  * @property {StepNode[]} steps
  * @property {number} line
  */
@@ -45,11 +46,13 @@ import { parseDocument, isMap, isSeq, isPair, isScalar } from 'yaml';
  * @typedef {object} WorkflowDoc
  * @property {string} path
  * @property {string} source
+ * @property {'workflow'|'composite-action'|'unknown'} kind
  * @property {string|null} name
  * @property {unknown} on
  * @property {object|null} permissions
  * @property {object|null} env
  * @property {JobNode[]} jobs
+ * @property {StepNode[]} actionSteps    steps from a composite action's `runs` block
  * @property {object} raw         - the parsed plain object (for rules to query)
  */
 
@@ -89,17 +92,6 @@ export function parseActionRef(raw, line) {
   return { ...base, owner, repo, subpath: rest || null, ref, kind };
 }
 
-/**
- * @param {unknown} node
- * @returns {number}
- */
-function lineOf(node) {
-  if (node && typeof node === 'object' && 'range' in node && Array.isArray(node.range)) {
-    // We won't use this path; line is computed externally from the document.
-  }
-  return 0;
-}
-
 /**
  * Find the 1-based line of a Pair/Scalar node within the YAML document.
  *
@@ -146,6 +138,48 @@ function findPair(map, key) {
   return null;
 }
 
+/**
+ * Extract a `steps` sequence from a workflow job or composite action `runs`
+ * mapping. Both locations use the same step-level `uses` syntax.
+ *
+ * @param {string} source
+ * @param {object} parentNode
+ * @returns {StepNode[]}
+ */
+function extractSteps(source, parentNode) {
+  const steps = [];
+  const stepsPair = findPair(parentNode, 'steps');
+  if (!stepsPair || !isSeq(stepsPair.value)) return steps;
+
+  for (const stepNode of stepsPair.value.items) {
+    if (!isMap(stepNode)) continue;
+    const usesPair = findPair(stepNode, 'uses');
+    const runPair = findPair(stepNode, 'run');
+    const namePair = findPair(stepNode, 'name');
+    const idPair = findPair(stepNode, 'id');
+    const envPair = findPair(stepNode, 'env');
+    const withPair = findPair(stepNode, 'with');
+
+    const step = {
+      name: namePair && isScalar(namePair.value) ? String(namePair.value.value) : null,
+      id: idPair && isScalar(idPair.value) ? String(idPair.value.value) : null,
+      uses: null,
+      run: runPair && isScalar(runPair.value) ? String(runPair.value.value) : null,
+      env: envPair ? toJs(envPair.value) : null,
+      with_: withPair ? toJs(withPair.value) : null,
+      line: lineFromRange(source, stepNode),
+    };
+    if (usesPair && isScalar(usesPair.value)) {
+      step.uses = parseActionRef(
+        String(usesPair.value.value),
+        lineFromRange(source, usesPair.value),
+      );
+    }
+    steps.push(step);
+  }
+  return steps;
+}
+
 /**
  * @param {string} source
  * @param {object} doc - yaml Document
@@ -169,6 +203,7 @@ function extractJobs(source, doc) {
       permissions: null,
       runsOn: null,
       env: null,
+      uses: null,
       steps: [],
       line: jobLine,
     };
@@ -180,36 +215,14 @@ function extractJobs(source, doc) {
       if (runsOn) job.runsOn = toJs(runsOn.value);
       const env = findPair(jobNode, 'env');
       if (env) job.env = toJs(env.value);
-
-      const stepsPair = findPair(jobNode, 'steps');
-      if (stepsPair && isSeq(stepsPair.value)) {
-        for (const stepNode of stepsPair.value.items) {
-          if (!isMap(stepNode)) continue;
-          const usesPair = findPair(stepNode, 'uses');
-          const runPair = findPair(stepNode, 'run');
-          const namePair = findPair(stepNode, 'name');
-          const idPair = findPair(stepNode, 'id');
-          const envPair = findPair(stepNode, 'env');
-          const withPair = findPair(stepNode, 'with');
-
-          const stepLine = lineFromRange(source, stepNode);
-          /** @type {StepNode} */
-          const step = {
-            name: namePair && isScalar(namePair.value) ? String(namePair.value.value) : null,
-            id: idPair && isScalar(idPair.value) ? String(idPair.value.value) : null,
-            uses: null,
-            run: runPair && isScalar(runPair.value) ? String(runPair.value.value) : null,
-            env: envPair ? toJs(envPair.value) : null,
-            with_: withPair ? toJs(withPair.value) : null,
-            line: stepLine,
-          };
-          if (usesPair && isScalar(usesPair.value)) {
-            const usesLine = lineFromRange(source, usesPair.value);
-            step.uses = parseActionRef(String(usesPair.value.value), usesLine);
-          }
-          job.steps.push(step);
-        }
+      const uses = findPair(jobNode, 'uses');
+      if (uses && isScalar(uses.value)) {
+        job.uses = parseActionRef(
+          String(uses.value.value),
+          lineFromRange(source, uses.value),
+        );
       }
+      job.steps = extractSteps(source, jobNode);
     }
     jobs.push(job);
   }
@@ -233,11 +246,13 @@ export function parseWorkflowSource(source, path) {
   const result = {
     path,
     source,
+    kind: 'unknown',
     name: null,
     on: null,
     permissions: null,
     env: null,
     jobs: [],
+    actionSteps: [],
     raw: doc.toJS() ?? {},
   };
   if (!doc.contents || !isMap(doc.contents)) return result;
@@ -249,7 +264,14 @@ export function parseWorkflowSource(source, path) {
   if (permPair) result.permissions = toJs(permPair.value);
   const envPair = findPair(doc.contents, 'env');
   if (envPair) result.env = toJs(envPair.value);
+  const jobsPair = findPair(doc.contents, 'jobs');
+  if (jobsPair) result.kind = 'workflow';
   result.jobs = extractJobs(source, doc);
+  const runsPair = findPair(doc.contents, 'runs');
+  if (runsPair && isMap(runsPair.value)) {
+    if (!jobsPair) result.kind = 'composite-action';
+    result.actionSteps = extractSteps(source, runsPair.value);
+  }
   return result;
 }
 
@@ -266,14 +288,20 @@ export async function parseWorkflowFile(path) {
  * Iterate every action reference in a workflow.
  *
  * @param {WorkflowDoc} workflow
- * @returns {Array<{ref: ActionRef, jobName: string, stepIndex: number}>}
+ * @returns {Array<{ref: ActionRef, jobName: string|null, stepIndex: number, location: 'job'|'step'|'action-step'}>}
  */
 export function collectUses(workflow) {
   const out = [];
-  for (const job of workflow.jobs) {
-    job.steps.forEach((step, i) => {
-      if (step.uses) out.push({ ref: step.uses, jobName: job.name, stepIndex: i });
+  for (const job of workflow.jobs ?? []) {
+    if (job.uses) {
+      out.push({ ref: job.uses, jobName: job.name, stepIndex: -1, location: 'job' });
+    }
+    (job.steps ?? []).forEach((step, i) => {
+      if (step.uses) out.push({ ref: step.uses, jobName: job.name, stepIndex: i, location: 'step' });
     });
   }
+  (workflow.actionSteps ?? []).forEach((step, i) => {
+    if (step.uses) out.push({ ref: step.uses, jobName: null, stepIndex: i, location: 'action-step' });
+  });
   return out;
 }

package/src/lib/paths.js

@@ -7,11 +7,15 @@ import { resolve, join, relative } from 'node:path';
 import picomatch from 'picomatch';
 
 /**
- * Default workflow directory globs.
+ * Default workflow and composite-action globs.
  */
 export const DEFAULT_WORKFLOW_PATTERNS = [
   '.github/workflows/*.yml',
   '.github/workflows/*.yaml',
+  'action.yml',
+  'action.yaml',
+  '**/action.yml',
+  '**/action.yaml',
 ];
 
 /**

package/src/rules/excessive-permissions.js

@@ -44,6 +44,9 @@ function inspect(permissions) {
  * @param {import('../lib/parser.js').WorkflowDoc} workflow
  */
 export function check(workflow) {
+  // Composite actions inherit the calling workflow's token permissions and do
+  // not support a top-level permissions block of their own.
+  if (workflow.kind === 'composite-action') return [];
   const findings = [];
   const topScope = inspect(workflow.permissions);
   if (topScope === 'unset-default') {