pipewatch-cli 0.2.0__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. pipewatch_cli-0.2.0/LICENSE +121 -0
  2. pipewatch_cli-0.2.0/PKG-INFO +288 -0
  3. pipewatch_cli-0.2.0/README.md +277 -0
  4. pipewatch_cli-0.2.0/pipewatch.py +1147 -0
  5. pipewatch_cli-0.2.0/pipewatch_cli.egg-info/PKG-INFO +288 -0
  6. pipewatch_cli-0.2.0/pipewatch_cli.egg-info/SOURCES.txt +10 -0
  7. pipewatch_cli-0.2.0/pipewatch_cli.egg-info/dependency_links.txt +1 -0
  8. pipewatch_cli-0.2.0/pipewatch_cli.egg-info/entry_points.txt +2 -0
  9. pipewatch_cli-0.2.0/pipewatch_cli.egg-info/requires.txt +1 -0
  10. pipewatch_cli-0.2.0/pipewatch_cli.egg-info/top_level.txt +1 -0
  11. pipewatch_cli-0.2.0/pyproject.toml +18 -0
  12. pipewatch_cli-0.2.0/setup.cfg +4 -0
pipewatch_cli-0.2.0/LICENSE ADDED
@@ -0,0 +1,121 @@
1
+ Creative Commons Legal Code
2
+
3
+ CC0 1.0 Universal
4
+
5
+ CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
6
+ LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
7
+ ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
8
+ INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
9
+ REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
10
+ PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
11
+ THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
12
+ HEREUNDER.
13
+
14
+ Statement of Purpose
15
+
16
+ The laws of most jurisdictions throughout the world automatically confer
17
+ exclusive Copyright and Related Rights (defined below) upon the creator
18
+ and subsequent owner(s) (each and all, an "owner") of an original work of
19
+ authorship and/or a database (each, a "Work").
20
+
21
+ Certain owners wish to permanently relinquish those rights to a Work for
22
+ the purpose of contributing to a commons of creative, cultural and
23
+ scientific works ("Commons") that the public can reliably and without fear
24
+ of later claims of infringement build upon, modify, incorporate in other
25
+ works, reuse and redistribute as freely as possible in any form whatsoever
26
+ and for any purposes, including without limitation commercial purposes.
27
+ These owners may contribute to the Commons to promote the ideal of a free
28
+ culture and the further production of creative, cultural and scientific
29
+ works, or to gain reputation or greater distribution for their Work in
30
+ part through the use and efforts of others.
31
+
32
+ For these and/or other purposes and motivations, and without any
33
+ expectation of additional consideration or compensation, the person
34
+ associating CC0 with a Work (the "Affirmer"), to the extent that he or she
35
+ is an owner of Copyright and Related Rights in the Work, voluntarily
36
+ elects to apply CC0 to the Work and publicly distribute the Work under its
37
+ terms, with knowledge of his or her Copyright and Related Rights in the
38
+ Work and the meaning and intended legal effect of CC0 on those rights.
39
+
40
+ 1. Copyright and Related Rights. A Work made available under CC0 may be
41
+ protected by copyright and related or neighboring rights ("Copyright and
42
+ Related Rights"). Copyright and Related Rights include, but are not
43
+ limited to, the following:
44
+
45
+ i. the right to reproduce, adapt, distribute, perform, display,
46
+ communicate, and translate a Work;
47
+ ii. moral rights retained by the original author(s) and/or performer(s);
48
+ iii. publicity and privacy rights pertaining to a person's image or
49
+ likeness depicted in a Work;
50
+ iv. rights protecting against unfair competition in regards to a Work,
51
+ subject to the limitations in paragraph 4(a), below;
52
+ v. rights protecting the extraction, dissemination, use and reuse of data
53
+ in a Work;
54
+ vi. database rights (such as those arising under Directive 96/9/EC of the
55
+ European Parliament and of the Council of 11 March 1996 on the legal
56
+ protection of databases, and under any national implementation
57
+ thereof, including any amended or successor version of such
58
+ directive); and
59
+ vii. other similar, equivalent or corresponding rights throughout the
60
+ world based on applicable law or treaty, and any national
61
+ implementations thereof.
62
+
63
+ 2. Waiver. To the greatest extent permitted by, but not in contravention
64
+ of, applicable law, Affirmer hereby overtly, fully, permanently,
65
+ irrevocably and unconditionally waives, abandons, and surrenders all of
66
+ Affirmer's Copyright and Related Rights and associated claims and causes
67
+ of action, whether now known or unknown (including existing as well as
68
+ future claims and causes of action), in the Work (i) in all territories
69
+ worldwide, (ii) for the maximum duration provided by applicable law or
70
+ treaty (including future time extensions), (iii) in any current or future
71
+ medium and for any number of copies, and (iv) for any purpose whatsoever,
72
+ including without limitation commercial, advertising or promotional
73
+ purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
74
+ member of the public at large and to the detriment of Affirmer's heirs and
75
+ successors, fully intending that such Waiver shall not be subject to
76
+ revocation, rescission, cancellation, termination, or any other legal or
77
+ equitable action to disrupt the quiet enjoyment of the Work by the public
78
+ as contemplated by Affirmer's express Statement of Purpose.
79
+
80
+ 3. Public License Fallback. Should any part of the Waiver for any reason
81
+ be judged legally invalid or ineffective under applicable law, then the
82
+ Waiver shall be preserved to the maximum extent permitted taking into
83
+ account Affirmer's express Statement of Purpose. In addition, to the
84
+ extent the Waiver is so judged Affirmer hereby grants to each affected
85
+ person a royalty-free, non transferable, non sublicensable, non exclusive,
86
+ irrevocable and unconditional license to exercise Affirmer's Copyright and
87
+ Related Rights in the Work (i) in all territories worldwide, (ii) for the
88
+ maximum duration provided by applicable law or treaty (including future
89
+ time extensions), (iii) in any current or future medium and for any number
90
+ of copies, and (iv) for any purpose whatsoever, including without
91
+ limitation commercial, advertising or promotional purposes (the
92
+ "License"). The License shall be deemed effective as of the date CC0 was
93
+ applied by Affirmer to the Work. Should any part of the License for any
94
+ reason be judged legally invalid or ineffective under applicable law, such
95
+ partial invalidity or ineffectiveness shall not invalidate the remainder
96
+ of the License, and in such case Affirmer hereby affirms that he or she
97
+ will not (i) exercise any of his or her remaining Copyright and Related
98
+ Rights in the Work or (ii) assert any associated claims and causes of
99
+ action with respect to the Work, in either case contrary to Affirmer's
100
+ express Statement of Purpose.
101
+
102
+ 4. Limitations and Disclaimers.
103
+
104
+ a. No trademark or patent rights held by Affirmer are waived, abandoned,
105
+ surrendered, licensed or otherwise affected by this document.
106
+ b. Affirmer offers the Work as-is and makes no representations or
107
+ warranties of any kind concerning the Work, express, implied,
108
+ statutory or otherwise, including without limitation warranties of
109
+ title, merchantability, fitness for a particular purpose, non
110
+ infringement, or the absence of latent or other defects, accuracy, or
111
+ the present or absence of errors, whether or not discoverable, all to
112
+ the greatest extent permissible under applicable law.
113
+ c. Affirmer disclaims responsibility for clearing rights of other persons
114
+ that may apply to the Work or any use thereof, including without
115
+ limitation any person's Copyright and Related Rights in the Work.
116
+ Further, Affirmer disclaims responsibility for obtaining any necessary
117
+ consents, permissions or other rights required for any use of the
118
+ Work.
119
+ d. Affirmer understands and acknowledges that Creative Commons is not a
120
+ party to this document and has no duty or obligation with respect to
121
+ this CC0 or use of the Work.
pipewatch_cli-0.2.0/PKG-INFO ADDED
@@ -0,0 +1,288 @@
1
+ Metadata-Version: 2.4
2
+ Name: pipewatch-cli
3
+ Version: 0.2.0
4
+ Summary: Integrity monitoring and static analysis for CI/CD pipelines
5
+ License-Expression: GPL-2.0-only
6
+ Requires-Python: >=3.12
7
+ Description-Content-Type: text/markdown
8
+ License-File: LICENSE
9
+ Requires-Dist: pyyaml>=6.0
10
+ Dynamic: license-file
11
+
12
+ # pipewatch
13
+
14
+ **Integrity monitoring and static analysis for software supply chains.**
15
+
16
+ CI/CD pipelines are high-value targets: they run with elevated permissions, pull from external registries, and execute arbitrary code on every commit. A single injected step, mutable action pin, or misconfigured trigger is enough to exfiltrate secrets, backdoor build artifacts, or pivot into production infrastructure — and the attack surface is almost always left unmonitored.
17
+
18
+ `pipewatch` audits GitHub Actions workflows, GitLab CI, and Jenkinsfiles for exactly these risks. It combines commit-anchored baseline diffing, per-step SHA-256 fingerprinting, static misconfiguration analysis, and runner environment tracking into a single CLI tool. All commands exit non-zero on findings and emit structured JSON — suitable as a pipeline gate, a pre-merge check, or a periodic audit job.
19
+
20
+ ---
21
+
22
+ ## What It Detects
23
+
24
+ | Check | What it catches |
25
+ |---|---|
26
+ | **Baseline diff** | Pipeline files modified, added, or deleted since a known-good commit |
27
+ | **Step fingerprinting** | Individual steps injected, removed, or silently modified between commits |
28
+ | **`pull_request_target` misuse** | Workflows that check out and execute PR head code with base-branch write permissions — the pattern behind numerous CI poisoning attacks |
29
+ | **Script injection** | `run:` blocks and `env:` blocks that route user-controlled context values (`github.event.pull_request.title`, `github.event.comment.body`, etc.) into shell commands — both direct interpolation and the indirect `env: VAR: ${{ ctx }}` → `$VAR` pattern are detected |
30
+ | **Permission misconfiguration** | Missing `permissions:` blocks, `write-all` scopes, `secrets: inherit` |
31
+ | **Mutable action pins** | `uses:` references not locked to a full commit SHA — tags like `v3` can be silently overwritten by a supply-chain attacker |
32
+ | **Invalid pinned SHAs** | Pinned SHAs that do not exist in the upstream action repo (typos, deleted commits, fork SHAs) |
33
+ | **Unsafe `workflow_run` chains** | Write-permissioned workflows triggered indirectly by external pull requests or issues, creating a privilege escalation path |
34
+ | **Self-hosted runners** | Non-ephemeral runners that persist state between runs and are not managed by GitHub |
35
+ | **Runner environment drift** | Env var and tool version changes between CI runs that could indicate a compromised or modified runner |
36
+
37
+ Findings are severity-ranked (CRITICAL → HIGH → MEDIUM → LOW → INFO) and always include a location, description, and evidence field.
38
+
39
+ ---
40
+
41
+ ## Installation
42
+
43
+ Requires Python 3.12+. `pyyaml` is the only external dependency.
44
+
45
+ **Via pip (recommended):**
46
+ ```bash
47
+ pip install pipewatch
48
+ ```
49
+
50
+ **Directly from GitHub (no clone required):**
51
+ ```bash
52
+ pip install git+https://github.com/TheVoidThatConsumes/pipewatch.git
53
+ ```
54
+
55
+ **Copy into your project** — if you prefer to keep pipewatch self-contained inside a repo you're monitoring, download `pipewatch.py` and drop it anywhere in that repo. Install `pyyaml` manually:
56
+ ```bash
57
+ pip install pyyaml
58
+ ```
59
+ Then run it as `py pipewatch.py <command>` instead of `pipewatch <command>`.
60
+
61
+ ---
62
+
63
+ ## Quick Start
64
+
65
+ ```bash
66
+ # Record the current HEAD as known-good
67
+ pipewatch baseline
68
+
69
+ # Scan for changes and misconfigurations
70
+ pipewatch scan
71
+
72
+ # Full audit in one pass (scan + pin-audit + static)
73
+ pipewatch audit --verify-shas
74
+ ```
75
+
76
+ ---
77
+
78
+ ## Commands
79
+
80
+ ### `baseline`
81
+ Records the current (or a specified) commit as the integrity reference point. Set `PIPEWATCH_HMAC_KEY` to store a signed baseline — if the file is modified to suppress future findings, the HMAC check will fail and the tool will refuse to proceed.
82
+
83
+ ```bash
84
+ pipewatch baseline [--repo PATH] [--commit SHA]
85
+ ```
86
+
87
+ ---
88
+
89
+ ### `scan`
90
+ Diffs pipeline files and per-step fingerprints against the baseline commit. Detects both file-level changes (unified diff) and step-level tampering — a step whose `uses`, `run`, `with`, `env`, or `shell` fields change gets flagged even if the surrounding file diff looks innocuous.
91
+
92
+ ```bash
93
+ pipewatch scan [--repo PATH] [--baseline SHA] [--verbose] [--json]
94
+ ```
95
+
96
+ Covers GitHub Actions, GitLab CI, and Jenkinsfile stages.
97
+
98
+ ---
99
+
100
+ ### `static`
101
+ Static analysis with no baseline required. Audits all GitHub Actions workflow files in `.github/workflows/` for structural misconfigurations.
102
+
103
+ ```bash
104
+ pipewatch static [--repo PATH] [--verbose] [--json]
105
+ ```
106
+
107
+ Checks: `pull_request_target` misuse · script injection · missing/overpermissioned `permissions:` blocks · `secrets: inherit` · self-hosted runners · unsafe `workflow_run` trigger chains.
108
+
109
+ ---
110
+
111
+ ### `pin-audit`
112
+ Flags `uses:` references not pinned to a full 40- or 64-character commit SHA. With `--verify-shas`, makes live GitHub API calls to confirm each pinned SHA actually exists in its upstream repository.
113
+
114
+ ```bash
115
+ pipewatch pin-audit [--repo PATH] [--verify-shas] [--token TOKEN] [--verbose] [--json]
116
+ ```
117
+
118
+ Rate limit: 60 requests/hr unauthenticated, 5 000/hr with `--token` or `GITHUB_TOKEN`. API calls are deduplicated — the same `owner/repo@sha` is only verified once regardless of how many steps reference it. Findings are **not** deduplicated: if the same invalid SHA appears across multiple workflow files or jobs, each affected step produces its own finding so the full scope of a compromised action is visible in the report.
119
+
120
+ ---
121
+
122
+ ### `snapshot`
123
+ Captures the runner environment — environment variables and tool versions — to a JSON file for later comparison.
124
+
125
+ ```bash
126
+ pipewatch snapshot [--output FILE]
127
+ ```
128
+
129
+ Tracked tools: `python3`, `python`, `node`, `npm`, `pip`, `pip3`, `git`, `curl`, `wget`, `docker`, `kubectl`, `terraform`, `aws`, `gcloud`, `az`. Volatile per-run variables (`GITHUB_RUN_ID`, `RUNNER_TEMP`, etc.) are excluded to prevent noise on every comparison.
130
+
131
+ **Credential exclusion** — environment variables whose names contain `token`, `secret`, `key`, `password`, `passwd`, `pwd`, `auth`, `credential`, `private`, or `api_key` (case-insensitive) are never written to the snapshot file. This prevents secrets such as `GITHUB_TOKEN` or `PIPEWATCH_HMAC_KEY` from being persisted to disk or uploaded to the Actions cache. Note that a legitimately non-sensitive variable with one of these terms in its name will also be excluded; rename it if you need `env-diff` to track it.
132
+
133
+ Add the snapshot file to `.gitignore` to prevent it from being accidentally committed:
134
+
135
+ ```
136
+ .pipewatch_env_snapshot.json
137
+ ```
138
+
139
+ ---
140
+
141
+ ### `env-diff`
142
+ Diffs two runner environment snapshots. Detects new, removed, or changed environment variables and tool versions — useful for identifying runner poisoning or unexpected environment mutations between runs. If `--current-snapshot` is omitted, captures the live environment.
143
+
144
+ ```bash
145
+ pipewatch env-diff BASELINE_SNAPSHOT [--current-snapshot FILE] [--repo PATH] [--verbose] [--json]
146
+ ```
147
+
148
+ ---
149
+
150
+ ### `audit`
151
+ Full audit in one pass: `scan` + `pin-audit` + `static`. Exits non-zero if any findings exist.
152
+
153
+ ```bash
154
+ pipewatch audit [--repo PATH] [--baseline SHA] [--verify-shas] [--token TOKEN] [--verbose] [--json]
155
+ ```
156
+
157
+ ---
158
+
159
+ ### `init-runner`
160
+ Prints a ready-to-paste GitHub Actions step block that adds runner environment monitoring to any existing job.
161
+
162
+ ```bash
163
+ pipewatch init-runner [--snapshot-path PATH]
164
+ ```
165
+
166
+ ---
167
+
168
+ ## Finding IDs
169
+
170
+ | Prefix | Category | Default Severity |
171
+ |---|---|---|
172
+ | `PW-DIFF-NNN` | Pipeline file added / modified / deleted | HIGH / MEDIUM |
173
+ | `PW-STEP-NNN` | Step fingerprint changed / injected / removed | HIGH / MEDIUM |
174
+ | `PW-PRT-NNN` | `pull_request_target` misuse | HIGH |
175
+ | `PW-INJ-NNN` | Script injection risk | HIGH |
176
+ | `PW-PERM-NNN` | Permission misconfiguration | HIGH / MEDIUM |
177
+ | `PW-CHAIN-NNN` | Unsafe `workflow_run` chain | HIGH |
178
+ | `PW-PIN-NNN` | Unpinned action reference | MEDIUM |
179
+ | `PW-SHA-NNN` | Pinned SHA not found in upstream repo | HIGH |
180
+ | `PW-RUNNER-NNN` | Self-hosted runner | INFO |
181
+ | `PW-ENV-NNN` | Runner environment drift | MEDIUM / LOW |
182
+
183
+ ---
184
+
185
+ ## JSON Output
186
+
187
+ All commands accept `--json`:
188
+
189
+ ```json
190
+ {
191
+ "tool": "pipewatch",
192
+ "version": "0.2.0",
193
+ "timestamp": "2025-01-01T00:00:00+00:00",
194
+ "repo": "/path/to/repo",
195
+ "baseline_commit": "abc123...",
196
+ "findings": [
197
+ {
198
+ "id": "PW-INJ-001",
199
+ "severity": "HIGH",
200
+ "category": "script_injection",
201
+ "title": "Script injection risk: .github/workflows/ci.yml::build::step[2]",
202
+ "description": "A run: block interpolates a user-controlled context value...",
203
+ "location": ".github/workflows/ci.yml::build::step[2]",
204
+ "evidence": "dangerous expressions found: ['github.event.pull_request.title']"
205
+ }
206
+ ],
207
+ "summary": { "total": 1, "CRITICAL": 0, "HIGH": 1, "MEDIUM": 0, "LOW": 0, "INFO": 0 }
208
+ }
209
+ ```
210
+
211
+ Gate on exit code, or filter with `jq`:
212
+
213
+ ```bash
214
+ # fail the build on any HIGH or CRITICAL finding
215
+ pipewatch audit --json | jq -e '.summary.HIGH == 0 and .summary.CRITICAL == 0'
216
+
217
+ # list all finding titles
218
+ pipewatch audit --json | jq -r '.findings[].title'
219
+ ```
220
+
221
+ ---
222
+
223
+ ## Tamper-Evident Baselines
224
+
225
+ Set `PIPEWATCH_HMAC_KEY` before running `baseline`. The baseline is stored as a signed JSON object:
226
+
227
+ ```json
228
+ {
229
+ "commit": "abc123...",
230
+ "timestamp": "2025-01-01T00:00:00+00:00",
231
+ "hmac": "<sha256-hmac-of-commit-and-timestamp>"
232
+ }
233
+ ```
234
+
235
+ The HMAC is computed over both the commit SHA **and** the timestamp, bound together. This protects against two distinct attacks:
236
+
237
+ - **Tampering** — an attacker who modifies the `commit` field to point to an older known-good commit cannot produce a valid HMAC without the key.
238
+ - **Replay** — an attacker who reverts the baseline file to a previously-valid signed snapshot (to suppress findings introduced after that point) is also blocked, because the timestamp is part of the signed payload and the stored timestamp would no longer match the signature of any rewritten content.
239
+
240
+ On `scan` or `audit`, the HMAC is verified before the baseline commit is trusted. Any verification failure causes an immediate exit with an error.
241
+
242
+ **Format-downgrade protection** — if `PIPEWATCH_HMAC_KEY` is set and the baseline file is in plain-text format (a raw commit SHA rather than signed JSON), the tool refuses to proceed. An attacker cannot bypass signing by overwriting the file with an unsigned commit SHA. If you set `PIPEWATCH_HMAC_KEY` for the first time on a repo that already has an unsigned baseline, re-run `pipewatch baseline` to generate a signed one before your next scan.
243
+
244
+ Store the key in a CI secret (`PIPEWATCH_HMAC_KEY: ${{ secrets.PIPEWATCH_HMAC_KEY }}`).
245
+
246
+ ---
247
+
248
+ ## Pipeline Integration
249
+
250
+ ```yaml
251
+ - name: pipewatch audit
252
+ env:
253
+ GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
254
+ PIPEWATCH_HMAC_KEY: ${{ secrets.PIPEWATCH_HMAC_KEY }}
255
+ run: |
256
+ pipewatch audit --verify-shas --json | tee pw-report.json
257
+ jq -e '.summary.HIGH == 0 and .summary.CRITICAL == 0' pw-report.json
258
+ ```
259
+
260
+ Use `init-runner` to add runner environment monitoring alongside the audit step.
261
+
262
+ ---
263
+
264
+ ## Design Decisions
265
+
266
+ **HMAC-signed baselines** — tamper-evident storage for the known-good commit reference. The HMAC covers both the commit SHA and the timestamp, so an attacker who can write to the repo but wants to suppress findings would need to forge the HMAC — not just overwrite the file or revert it to an older signed state. Attempting to downgrade a signed baseline to unsigned plain text is also refused when `PIPEWATCH_HMAC_KEY` is set.
267
+
268
+ **Volatile variable exclusion** — `snapshot` strips run-specific GitHub variables so that `env-diff` doesn't generate noise on every comparison. Only structurally stable variables that could indicate environment manipulation are tracked. Variables whose names suggest credentials (containing `token`, `secret`, `key`, `password`, etc.) are also excluded so secrets are never written to the snapshot file or the Actions cache.
269
+
270
+ **Conservative SHA verification** — `--verify-shas` treats network failures as non-findings. A flaky connection or GitHub API outage should not produce spurious HIGH alerts.
271
+
272
+ **Stdlib-first** — `pyyaml` is the only dependency. The tool audits supply-chain risk; its own footprint is minimal by design.
273
+
274
+ ---
275
+
276
+ ## Platform Support
277
+
278
+ | Platform | Coverage |
279
+ |---|---|
280
+ | GitHub Actions (`.github/workflows/*.yml`) | Full — file diff, step fingerprinting, static analysis, pin audit |
281
+ | GitLab CI (`.gitlab-ci.yml`) | File diff + `before_script` / `script` / `after_script` fingerprinting |
282
+ | Jenkins (`Jenkinsfile`) | File diff + best-effort stage / `sh` / `bat` fingerprinting (regex-based — not a Groovy parser) |
283
+
284
+ ---
285
+
286
+ ## License
287
+
288
+ GPLv2. See [LICENSE](LICENSE).
pipewatch_cli-0.2.0/README.md ADDED
@@ -0,0 +1,277 @@
1
+ # pipewatch
2
+
3
+ **Integrity monitoring and static analysis for software supply chains.**
4
+
5
+ CI/CD pipelines are high-value targets: they run with elevated permissions, pull from external registries, and execute arbitrary code on every commit. A single injected step, mutable action pin, or misconfigured trigger is enough to exfiltrate secrets, backdoor build artifacts, or pivot into production infrastructure — and the attack surface is almost always left unmonitored.
6
+
7
+ `pipewatch` audits GitHub Actions workflows, GitLab CI, and Jenkinsfiles for exactly these risks. It combines commit-anchored baseline diffing, per-step SHA-256 fingerprinting, static misconfiguration analysis, and runner environment tracking into a single CLI tool. All commands exit non-zero on findings and emit structured JSON — suitable as a pipeline gate, a pre-merge check, or a periodic audit job.
8
+
9
+ ---
10
+
11
+ ## What It Detects
12
+
13
+ | Check | What it catches |
14
+ |---|---|
15
+ | **Baseline diff** | Pipeline files modified, added, or deleted since a known-good commit |
16
+ | **Step fingerprinting** | Individual steps injected, removed, or silently modified between commits |
17
+ | **`pull_request_target` misuse** | Workflows that check out and execute PR head code with base-branch write permissions — the pattern behind numerous CI poisoning attacks |
18
+ | **Script injection** | `run:` blocks and `env:` blocks that route user-controlled context values (`github.event.pull_request.title`, `github.event.comment.body`, etc.) into shell commands — both direct interpolation and the indirect `env: VAR: ${{ ctx }}` → `$VAR` pattern are detected |
19
+ | **Permission misconfiguration** | Missing `permissions:` blocks, `write-all` scopes, `secrets: inherit` |
20
+ | **Mutable action pins** | `uses:` references not locked to a full commit SHA — tags like `v3` can be silently overwritten by a supply-chain attacker |
21
+ | **Invalid pinned SHAs** | Pinned SHAs that do not exist in the upstream action repo (typos, deleted commits, fork SHAs) |
22
+ | **Unsafe `workflow_run` chains** | Write-permissioned workflows triggered indirectly by external pull requests or issues, creating a privilege escalation path |
23
+ | **Self-hosted runners** | Non-ephemeral runners that persist state between runs and are not managed by GitHub |
24
+ | **Runner environment drift** | Env var and tool version changes between CI runs that could indicate a compromised or modified runner |
25
+
26
+ Findings are severity-ranked (CRITICAL → HIGH → MEDIUM → LOW → INFO) and always include a location, description, and evidence field.
27
+
28
+ ---
29
+
30
+ ## Installation
31
+
32
+ Requires Python 3.12+. `pyyaml` is the only external dependency.
33
+
34
+ **Via pip (recommended):**
35
+ ```bash
36
+ pip install pipewatch
37
+ ```
38
+
39
+ **Directly from GitHub (no clone required):**
40
+ ```bash
41
+ pip install git+https://github.com/TheVoidThatConsumes/pipewatch.git
42
+ ```
43
+
44
+ **Copy into your project** — if you prefer to keep pipewatch self-contained inside a repo you're monitoring, download `pipewatch.py` and drop it anywhere in that repo. Install `pyyaml` manually:
45
+ ```bash
46
+ pip install pyyaml
47
+ ```
48
+ Then run it as `py pipewatch.py <command>` instead of `pipewatch <command>`.
49
+
50
+ ---
51
+
52
+ ## Quick Start
53
+
54
+ ```bash
55
+ # Record the current HEAD as known-good
56
+ pipewatch baseline
57
+
58
+ # Scan for changes and misconfigurations
59
+ pipewatch scan
60
+
61
+ # Full audit in one pass (scan + pin-audit + static)
62
+ pipewatch audit --verify-shas
63
+ ```
64
+
65
+ ---
66
+
67
+ ## Commands
68
+
69
+ ### `baseline`
70
+ Records the current (or a specified) commit as the integrity reference point. Set `PIPEWATCH_HMAC_KEY` to store a signed baseline — if the file is modified to suppress future findings, the HMAC check will fail and the tool will refuse to proceed.
71
+
72
+ ```bash
73
+ pipewatch baseline [--repo PATH] [--commit SHA]
74
+ ```
75
+
76
+ ---
77
+
78
+ ### `scan`
79
+ Diffs pipeline files and per-step fingerprints against the baseline commit. Detects both file-level changes (unified diff) and step-level tampering — a step whose `uses`, `run`, `with`, `env`, or `shell` fields change gets flagged even if the surrounding file diff looks innocuous.
80
+
81
+ ```bash
82
+ pipewatch scan [--repo PATH] [--baseline SHA] [--verbose] [--json]
83
+ ```
84
+
85
+ Covers GitHub Actions, GitLab CI, and Jenkinsfile stages.
86
+
87
+ ---
88
+
89
+ ### `static`
90
+ Static analysis with no baseline required. Audits all GitHub Actions workflow files in `.github/workflows/` for structural misconfigurations.
91
+
92
+ ```bash
93
+ pipewatch static [--repo PATH] [--verbose] [--json]
94
+ ```
95
+
96
+ Checks: `pull_request_target` misuse · script injection · missing/overpermissioned `permissions:` blocks · `secrets: inherit` · self-hosted runners · unsafe `workflow_run` trigger chains.
97
+
98
+ ---
99
+
100
+ ### `pin-audit`
101
+ Flags `uses:` references not pinned to a full 40- or 64-character commit SHA. With `--verify-shas`, makes live GitHub API calls to confirm each pinned SHA actually exists in its upstream repository.
102
+
103
+ ```bash
104
+ pipewatch pin-audit [--repo PATH] [--verify-shas] [--token TOKEN] [--verbose] [--json]
105
+ ```
106
+
107
+ Rate limit: 60 requests/hr unauthenticated, 5 000/hr with `--token` or `GITHUB_TOKEN`. API calls are deduplicated — the same `owner/repo@sha` is only verified once regardless of how many steps reference it. Findings are **not** deduplicated: if the same invalid SHA appears across multiple workflow files or jobs, each affected step produces its own finding so the full scope of a compromised action is visible in the report.
108
+
109
+ ---
110
+
111
+ ### `snapshot`
112
+ Captures the runner environment — environment variables and tool versions — to a JSON file for later comparison.
113
+
114
+ ```bash
115
+ pipewatch snapshot [--output FILE]
116
+ ```
117
+
118
+ Tracked tools: `python3`, `python`, `node`, `npm`, `pip`, `pip3`, `git`, `curl`, `wget`, `docker`, `kubectl`, `terraform`, `aws`, `gcloud`, `az`. Volatile per-run variables (`GITHUB_RUN_ID`, `RUNNER_TEMP`, etc.) are excluded to prevent noise on every comparison.
119
+
120
+ **Credential exclusion** — environment variables whose names contain `token`, `secret`, `key`, `password`, `passwd`, `pwd`, `auth`, `credential`, `private`, or `api_key` (case-insensitive) are never written to the snapshot file. This prevents secrets such as `GITHUB_TOKEN` or `PIPEWATCH_HMAC_KEY` from being persisted to disk or uploaded to the Actions cache. Note that a legitimately non-sensitive variable with one of these terms in its name will also be excluded; rename it if you need `env-diff` to track it.
121
+
122
+ Add the snapshot file to `.gitignore` to prevent it from being accidentally committed:
123
+
124
+ ```
125
+ .pipewatch_env_snapshot.json
126
+ ```
127
+
128
+ ---
129
+
130
+ ### `env-diff`
131
+ Diffs two runner environment snapshots. Detects new, removed, or changed environment variables and tool versions — useful for identifying runner poisoning or unexpected environment mutations between runs. If `--current-snapshot` is omitted, captures the live environment.
132
+
133
+ ```bash
134
+ pipewatch env-diff BASELINE_SNAPSHOT [--current-snapshot FILE] [--repo PATH] [--verbose] [--json]
135
+ ```
136
+
137
+ ---
138
+
139
+ ### `audit`
140
+ Full audit in one pass: `scan` + `pin-audit` + `static`. Exits non-zero if any findings exist.
141
+
142
+ ```bash
143
+ pipewatch audit [--repo PATH] [--baseline SHA] [--verify-shas] [--token TOKEN] [--verbose] [--json]
144
+ ```
145
+
146
+ ---
147
+
148
+ ### `init-runner`
149
+ Prints a ready-to-paste GitHub Actions step block that adds runner environment monitoring to any existing job.
150
+
151
+ ```bash
152
+ pipewatch init-runner [--snapshot-path PATH]
153
+ ```
154
+
155
+ ---
156
+
157
+ ## Finding IDs
158
+
159
+ | Prefix | Category | Default Severity |
160
+ |---|---|---|
161
+ | `PW-DIFF-NNN` | Pipeline file added / modified / deleted | HIGH / MEDIUM |
162
+ | `PW-STEP-NNN` | Step fingerprint changed / injected / removed | HIGH / MEDIUM |
163
+ | `PW-PRT-NNN` | `pull_request_target` misuse | HIGH |
164
+ | `PW-INJ-NNN` | Script injection risk | HIGH |
165
+ | `PW-PERM-NNN` | Permission misconfiguration | HIGH / MEDIUM |
166
+ | `PW-CHAIN-NNN` | Unsafe `workflow_run` chain | HIGH |
167
+ | `PW-PIN-NNN` | Unpinned action reference | MEDIUM |
168
+ | `PW-SHA-NNN` | Pinned SHA not found in upstream repo | HIGH |
169
+ | `PW-RUNNER-NNN` | Self-hosted runner | INFO |
170
+ | `PW-ENV-NNN` | Runner environment drift | MEDIUM / LOW |
171
+
172
+ ---
173
+
174
+ ## JSON Output
175
+
176
+ All commands accept `--json`:
177
+
178
+ ```json
179
+ {
180
+ "tool": "pipewatch",
181
+ "version": "0.2.0",
182
+ "timestamp": "2025-01-01T00:00:00+00:00",
183
+ "repo": "/path/to/repo",
184
+ "baseline_commit": "abc123...",
185
+ "findings": [
186
+ {
187
+ "id": "PW-INJ-001",
188
+ "severity": "HIGH",
189
+ "category": "script_injection",
190
+ "title": "Script injection risk: .github/workflows/ci.yml::build::step[2]",
191
+ "description": "A run: block interpolates a user-controlled context value...",
192
+ "location": ".github/workflows/ci.yml::build::step[2]",
193
+ "evidence": "dangerous expressions found: ['github.event.pull_request.title']"
194
+ }
195
+ ],
196
+ "summary": { "total": 1, "CRITICAL": 0, "HIGH": 1, "MEDIUM": 0, "LOW": 0, "INFO": 0 }
197
+ }
198
+ ```
199
+
200
+ Gate on exit code, or filter with `jq`:
201
+
202
+ ```bash
203
+ # fail the build on any HIGH or CRITICAL finding
204
+ pipewatch audit --json | jq -e '.summary.HIGH == 0 and .summary.CRITICAL == 0'
205
+
206
+ # list all finding titles
207
+ pipewatch audit --json | jq -r '.findings[].title'
208
+ ```
209
+
210
+ ---
211
+
212
+ ## Tamper-Evident Baselines
213
+
214
+ Set `PIPEWATCH_HMAC_KEY` before running `baseline`. The baseline is stored as a signed JSON object:
215
+
216
+ ```json
217
+ {
218
+ "commit": "abc123...",
219
+ "timestamp": "2025-01-01T00:00:00+00:00",
220
+ "hmac": "<sha256-hmac-of-commit-and-timestamp>"
221
+ }
222
+ ```
223
+
224
+ The HMAC is computed over both the commit SHA **and** the timestamp, bound together. This protects against two distinct attacks:
225
+
226
+ - **Tampering** — an attacker who modifies the `commit` field to point to an older known-good commit cannot produce a valid HMAC without the key.
227
+ - **Replay** — an attacker who reverts the baseline file to a previously-valid signed snapshot (to suppress findings introduced after that point) is also blocked, because the timestamp is part of the signed payload and the stored timestamp would no longer match the signature of any rewritten content.
228
+
229
+ On `scan` or `audit`, the HMAC is verified before the baseline commit is trusted. Any verification failure causes an immediate exit with an error.
230
+
231
+ **Format-downgrade protection** — if `PIPEWATCH_HMAC_KEY` is set and the baseline file is in plain-text format (a raw commit SHA rather than signed JSON), the tool refuses to proceed. An attacker cannot bypass signing by overwriting the file with an unsigned commit SHA. If you set `PIPEWATCH_HMAC_KEY` for the first time on a repo that already has an unsigned baseline, re-run `pipewatch baseline` to generate a signed one before your next scan.
232
+
233
+ Store the key in a CI secret (`PIPEWATCH_HMAC_KEY: ${{ secrets.PIPEWATCH_HMAC_KEY }}`).
234
+
235
+ ---
236
+
237
+ ## Pipeline Integration
238
+
239
+ ```yaml
240
+ - name: pipewatch audit
241
+ env:
242
+ GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
243
+ PIPEWATCH_HMAC_KEY: ${{ secrets.PIPEWATCH_HMAC_KEY }}
244
+ run: |
245
+ pipewatch audit --verify-shas --json | tee pw-report.json
246
+ jq -e '.summary.HIGH == 0 and .summary.CRITICAL == 0' pw-report.json
247
+ ```
248
+
249
+ Use `init-runner` to add runner environment monitoring alongside the audit step.
250
+
251
+ ---
252
+
253
+ ## Design Decisions
254
+
255
+ **HMAC-signed baselines** — tamper-evident storage for the known-good commit reference. The HMAC covers both the commit SHA and the timestamp, so an attacker who can write to the repo but wants to suppress findings would need to forge the HMAC — not just overwrite the file or revert it to an older signed state. Attempting to downgrade a signed baseline to unsigned plain text is also refused when `PIPEWATCH_HMAC_KEY` is set.
256
+
257
+ **Volatile variable exclusion** — `snapshot` strips run-specific GitHub variables so that `env-diff` doesn't generate noise on every comparison. Only structurally stable variables that could indicate environment manipulation are tracked. Variables whose names suggest credentials (containing `token`, `secret`, `key`, `password`, etc.) are also excluded so secrets are never written to the snapshot file or the Actions cache.
258
+
259
+ **Conservative SHA verification** — `--verify-shas` treats network failures as non-findings. A flaky connection or GitHub API outage should not produce spurious HIGH alerts.
260
+
261
+ **Stdlib-first** — `pyyaml` is the only dependency. The tool audits supply-chain risk; its own footprint is minimal by design.
262
+
263
+ ---
264
+
265
+ ## Platform Support
266
+
267
+ | Platform | Coverage |
268
+ |---|---|
269
+ | GitHub Actions (`.github/workflows/*.yml`) | Full — file diff, step fingerprinting, static analysis, pin audit |
270
+ | GitLab CI (`.gitlab-ci.yml`) | File diff + `before_script` / `script` / `after_script` fingerprinting |
271
+ | Jenkins (`Jenkinsfile`) | File diff + best-effort stage / `sh` / `bat` fingerprinting (regex-based — not a Groovy parser) |
272
+
273
+ ---
274
+
275
+ ## License
276
+
277
+ GPLv2. See [LICENSE](LICENSE).