chiprook
← Software
SoftwareOctober 27, 2026, 20:45

Scan of 925 GitHub repos finds 46 with Actions inputs that do nothing

A researcher scanned 8,793 workflow files across 751 of GitHub's 925 most-starred public repositories and found 113 inputs that the referenced action does not declare. At least one such input appears in 46 repositories (5%), yet CI stays green and the value is silently ignored.

Scan of 925 GitHub repos finds 46 with Actions inputs that do nothing
#GitHub
Read next
Security

GhostAction returns: 772 repos hit in new GitHub Actions wave

Security

Scan of 13 Popular AI-App Starter Repos Finds Only 4 Clean

Software

GitHub locked down star data: Show HN study finds launches now run on fresh repos

Security

Audit of 60 public GitHub Actions workflows finds 6 exploitable via pull_request_target