enhancement: github-actions analysis

Is there interest in performing analysis of GitHub Actions implementations, e.g. pkg:githubactions/actions/checkout@v4.1.6?

I'm interested in the same outputs: files/networks/executables the action performs as it's executing.
I'm uniquely interested in writes to the $GITHUB_ENV path (e.g. if an action modifies the PATH variable).

The system could use https://github.com/nektos/act to provide an Actions-compatible sandbox to run on any compute.
The system could run on Actions compute, as an instrumented workflow: https://medium.com/develeap/verifiable-github-actions-and-workflow-security-using-ebpf-an-insight-from-kubecon-2023-858567dc9a64

Shopify built a system that combines both: we set up tracee on an Actions worker, then invoke Actions-on-Actions using nektos/act pointed at a honeypot repository.

The biggest gap would be the lack of package-feeds support - since GitHub acts as the registry, detecting new versions of known Actions is trivial but detecting new Actions is ~impossible(?).

Related

• Actions in the PURL spec https://github.com/package-url/purl-spec/pull/243
• Slack discussion - https://openssf.slack.com/archives/C04KSQC9E5P/p1715081187200429

Start by reviewing the proposed nektos/act sandbox approach, the instrumented-workflow option, and the related package-analysis issue 586. Define the supported GitHub Actions analysis scope, including files, networks, executables, and GITHUB_ENV writes, and resolve how package feeds and new Action detection should work before implementation.