GitHub Actions Collector
Parses and lints GitHub Actions workflow files. Extracts structured data from every workflow (triggers, jobs, action references), runs actionlint for syntax and type checking, and classifies version pinning status for all third-party action references.
github-actions to your lunar-config.yml:uses: github://earthly/lunar-lib/collectors/github-actions@v1.0.5
What This Integration Collects
This integration includes 1 collector that gather metadata from your systems.
workflows
Parses all GitHub Actions workflow files in .github/workflows/, runs actionlint for lint errors, and classifies action version pinning (SHA, tag, branch, unpinned) for supply-chain hygiene.
How Collectors Fit into Lunar
Lunar watches your code and CI/CD systems to collect SDLC data from config files, test results, IaC, deployment configurations, security scans, and more.
Collectors are the automatic data-gathering layer. They extract structured metadata from your repositories and pipelines, feeding it into Lunar's centralized database where guardrails evaluate it to enforce your engineering standards.
Learn How Lunar Works →Example Collected Data
This collector writes structured metadata to the Component JSON. Here's an example of the data it produces:
{
"ci": {
"lint": {
"source": { "tool": "actionlint", "version": "1.7.7", "integration": "code" },
"errors": [
{
"file": ".github/workflows/ci.yml",
"line": 42,
"column": 9,
"message": "property \"unknown_field\" is not defined",
"rule": "syntax-check"
}
],
"error_count": 1,
"warning_count": 0
},
"dependencies": {
"source": { "tool": "github-actions", "version": "0.1.0", "integration": "code" },
"total": 3,
"pinned": 2,
"unpinned": 1,
"items": [
{ "name": "actions/checkout", "ref": "abc123def456", "pinning": "sha", "party": "1st" },
{ "name": "docker/build-push-action", "ref": "v5.1.0", "pinning": "tag", "party": "3rd" },
{ "name": "docker/login-action", "ref": "main", "pinning": "branch", "party": "3rd" }
],
"third_party_unpinned": ["docker/login-action@main"]
},
"native": {
"github_actions": {
"source": { "tool": "github-actions", "version": "0.1.0", "integration": "code" },
"workflows": [
{
"file": ".github/workflows/ci.yml",
"name": "CI",
"triggers": ["push", "pull_request"],
"jobs": {
"build": {
"steps": [
{ "uses": "actions/checkout@abc123def456", "with": { "persist-credentials": false } },
{ "run": "make build" }
]
},
"test": {
"steps": [
{ "uses": "actions/checkout@abc123def456" },
{ "run": "make test" }
]
}
},
"permissions": { "contents": "read" },
"actions": [
{ "uses": "actions/checkout@abc123def456", "pinning": "sha", "party": "1st" },
{ "uses": "docker/build-push-action@v5.1.0", "pinning": "tag", "party": "3rd" },
{ "uses": "docker/login-action@main", "pinning": "branch", "party": "3rd" }
]
}
]
}
}
}
}Documentation
View on GitHubGitHub Actions Collector
Parses GitHub Actions workflows, runs actionlint, and detects version pinning status for supply-chain hygiene.
Overview
This collector analyzes all GitHub Actions workflow files (.github/workflows/*.yml) in a repository. It extracts structured data from each workflow (name, triggers, jobs, action references), runs actionlint for syntax and type checking, and classifies version pinning status for every action reference. The result is a comprehensive view of GHA workflow quality and supply-chain hygiene.
Skips gracefully if no .github/workflows/ directory exists.
Collected Data
This collector writes to both normalized (vendor-agnostic) and native (GHA-specific) Component JSON paths:
Normalized paths
| Path | Type | Description |
|---|---|---|
.ci.lint |
object | CI config lint results (errors with file/line/rule, counts) |
.ci.dependencies |
object | CI dependency pinning status (total, pinned, unpinned, item details) |
Native paths
| Path | Type | Description |
|---|---|---|
.ci.native.github_actions |
object | Raw GHA workflow data (full parsed workflows with triggers, jobs, permissions, action refs) |
Collectors
This integration provides the following collectors (use include to select a subset):
| Collector | Description |
|---|---|
workflows |
Parses workflows, runs actionlint, and detects version pinning |
Installation
Add to your lunar-config.yml:
collectors:
- uses: github://earthly/lunar-lib/collectors/github-actions@main
on: ["domain:your-domain"] # Or use tags like [backend, frontend]
Open Source
This collector is open source and available on GitHub. Contribute improvements, report issues, or fork it for your own use.
Common Use Cases
Explore guardrails that use data from GitHub Actions Collector.
Ready to Automate Your Standards?
See how Lunar can turn your AGENTS.md, engineering wiki, compliance docs, or postmortem action items into automated guardrails with our 100+ built-in guardrails.
AI agent rules & prompt files
Post-mortem action items
Security & compliance policies
Testing & quality requirements