Scan of 925 GitHub repos finds 46 with Actions inputs that do nothing
A researcher scanned 8,793 workflow files across 751 of GitHub's 925 most-starred public repositories and found 113 inputs that the referenced action does not declare. At least one such input appears in 46 repositories (5%), yet CI stays green and the value is silently ignored.
- 102,293 inputs checked; 113 are not declared by their action
- 46 of 925 repositories (5%) have at least one no-op input
- 70 cases are missing or removed inputs, 23 are newer than the pinned version, 20 are typos
- An open-source checker, proof-of-effect, was released to audit repos
Read next
Security