# CI Workflow Audit

> CI Workflow Audit is a paid API for AI agents from api.zfinia.com, paid per call via x402, $0.12/call, status unknown (last checked 2026-10-10).

Audits a GitHub Actions CI workflow file for security and reliability issues: unpinned actions, missing permissions/timeouts, undeclared job dependencies, dangerous trigger events, and shell injection risks.

## Facts

- Endpoint: POST https://api.zfinia.com/x402/v1/ci-workflow-contract-audit?utm_source=zero.xyz
- Price: $0.12/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-10
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ci-workflow-audit-87bb9586
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_CTNE1v-GTr-qiDfyi8tWf

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ci-workflow-audit-87bb9586 -d '<json body>'
```

Example prompt: Audit this GitHub Actions workflow for security issues — flag any actions pinned to a tag instead of a commit SHA, missing job-level permissions or timeouts, any use of pull_request_target, shell injection from expression interpolation, and make sure these jobs are all declared: [build, test, deploy].

## When to prefer this

Choose this endpoint when you need a fast, automated security audit of a GitHub Actions workflow file focused specifically on supply-chain and privilege-escalation risks: unpinned actions, missing permissions/timeouts, dangerous triggers, and shell injection. It is purpose-built for CI workflow contracts rather than generic SAST tools, and supports declarative contracts (required jobs, pinning/timeout/permission requirements) so you can enforce org-wide policies programmatically.

## Known failure modes

- Invalid or unparseable workflow object — returns validation error
- required_jobs list references jobs not present in the workflow — flagged as missing dependency
- Empty workflow object — may return no findings or schema error
- Malformed contract object (unknown fields rejected due to additionalProperties: false)
- Payment failure (x402) — 402 response if USDC payment not included

## How this service works

Audit a CI workflow for what it leaves movable or undeclared. Reports actions pinned to a tag rather than a commit - a tag can be moved by whoever owns the action, so the code a step runs can change without this file changing - missing permissions and timeouts, a job depending on one that is not declared, a pull_request_target trigger, and an expression interpolated straight into a shell command.

## Output

A structured report listing: actions pinned to mutable tags (not commit SHAs) with step identifiers; jobs missing explicit permissions declarations; jobs missing timeout-minutes; job dependency edges referencing undeclared jobs; presence of pull_request_target trigger; and shell commands containing direct expression interpolation. Each finding references the relevant job or step for remediation.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "contract": {
   "type": "object",
   "properties": {
    "required_jobs": {
     "type": "array",
     "items": {
      "type": "string",
      "maxLength": 128
     },
     "maxItems": 200,
     "minItems": 1
    },
    "require_timeout": {
     "type": "boolean"
    },
    "require_permissions": {
     "type": "boolean"
    },
    "require_pinned_actions": {
     "type": "boolean"
    },
    "forbid_pull_request_target": {
     "type": "boolean"
    }
   },
   "additionalProperties": false
  },
  "workflow": {
   "type": "object"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ci-workflow-audit-87bb9586/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.zfinia.com](https://www.zero.xyz/host/api.zfinia.com/llms.txt)