Permissions Declared + GitHub Actions Collector

✓ Guardrail ↓ Collector Beta Security And Compliance

Enforce Permissions Declared using data collected by GitHub Actions Collector. Automatically check security and compliance standards on every PR.

Guardrail: Flags workflows with no permissions: key at workflow or job level. Without explicit permissions, workflows inherit org/repo defaults which may be write-all on repos created before GitHub's Feb 2023 default change.

Data Source: Parses and lints GitHub Actions workflow files. Extracts structured data from every workflow (triggers, jobs, action references), runs actionlint for syntax and type checking, and classifies version pinning status for all third-party action references.

Get Started View on GitHub

How GitHub Actions Collector Powers This Guardrail

The GitHub Actions Collector gathers metadata from your systems. This data flows into Lunar's Component JSON, where the Permissions Declared guardrail evaluates it against your standards.

When enabled, this check runs automatically on every PR and in AI coding workflows, providing real-time enforcement with actionable feedback.

↓ GitHub Actions Collector Gathers Data Collector

Extracts metadata from code, configs, and tool outputs

{ } Component JSON

Data centralized in structured format for evaluation

✓ Permissions Declared Checks Guardrail

Pass/fail result with actionable feedback in PRs

Quick Start Configuration

Add both the collector and policy to your lunar-config.yml to enable this guardrail.

📄 lunar-config.yml

# Step 1: Enable the GitHub Actions Collector
collectors:
  - uses: github://earthly/lunar-lib/collectors/github-actions@v1.0.5
    # with: ...

# Step 2: Enable the GitHub Actions Security Guardrails
policies:
  - uses: github://earthly/lunar-lib/policies/github-actions@v1.0.5
    include: [permissions-declared]
    # with: ...

What GitHub Actions Collector Collects

This collector gathers the following data that the Permissions Declared guardrail evaluates.

Collector code

`workflows`

Parses all GitHub Actions workflow files in .github/workflows/, runs actionlint for lint errors, and classifies action version pinning (SHA, tag, branch, unpinned) for supply-chain hygiene.

Example Data Flow

Here's an example of the data that GitHub Actions Collector writes to the Component JSON, which Permissions Declared then evaluates.

{ } component.json From GitHub Actions Collector

{
  "ci": {
    "lint": {
      "source": { "tool": "actionlint", "version": "1.7.7", "integration": "code" },
      "errors": [
        {
          "file": ".github/workflows/ci.yml",
          "line": 42,
          "column": 9,
          "message": "property \"unknown_field\" is not defined",
          "rule": "syntax-check"
        }
      ],
      "error_count": 1,
      "warning_count": 0
    },
    "dependencies": {
      "source": { "tool": "github-actions", "version": "0.1.0", "integration": "code" },
      "total": 3,
      "pinned": 2,
      "unpinned": 1,
      "items": [
        { "name": "actions/checkout", "ref": "abc123def456", "pinning": "sha", "party": "1st" },
        { "name": "docker/build-push-action", "ref": "v5.1.0", "pinning": "tag", "party": "3rd" },
        { "name": "docker/login-action", "ref": "main", "pinning": "branch", "party": "3rd" }
      ],
      "third_party_unpinned": ["docker/login-action@main"]
    },
    "native": {
      "github_actions": {
        "source": { "tool": "github-actions", "version": "0.1.0", "integration": "code" },
        "workflows": [
          {
            "file": ".github/workflows/ci.yml",
            "name": "CI",
            "triggers": ["push", "pull_request"],
            "jobs": {
              "build": {
                "steps": [
                  { "uses": "actions/checkout@abc123def456", "with": { "persist-credentials": false } },
                  { "run": "make build" }
                ]
              },
              "test": {
                "steps": [
                  { "uses": "actions/checkout@abc123def456" },
                  { "run": "make test" }
                ]
              }
            },
            "permissions": { "contents": "read" },
            "actions": [
              { "uses": "actions/checkout@abc123def456", "pinning": "sha", "party": "1st" },
              { "uses": "docker/build-push-action@v5.1.0", "pinning": "tag", "party": "3rd" },
              { "uses": "docker/login-action@main", "pinning": "branch", "party": "3rd" }
            ]
          }
        ]
      }
    }
  }
}

Learn More

Guardrail · GitHub Actions Security Guardrails Permissions Declared View all compatible integrations

→

Collector GitHub Actions Collector View full documentation

→

Ready to Automate Your Standards?

See how Lunar can turn your AGENTS.md, engineering wiki, compliance docs, or postmortem action items into automated guardrails with our 100+ built-in guardrails.

Works with any process

AI agent rules & prompt files

Post-mortem action items

Security & compliance policies

Testing & quality requirements

Automate Now

Paste your AGENTS.md or manual process doc and get guardrails in minutes

Book a Demo