Actions Permissions Check vs. OpenSSF Scorecard
The same underlying question, two different shapes of answer. Scorecard's Token-Permissions check scores a whole repository's least-privilege posture using the GitHub API and a token, usually wired into CI. This page checks the same thing on one workflow file you paste, free, with no token, no install, and no network call of its own.
What each tool is for
OpenSSF Scorecard (github.com/ossf/scorecard) is an open-source project that
runs 18 named checks against a repository -- among them Branch-Protection, Code-Review,
Dangerous-Workflow, Vulnerabilities, Pinned-Dependencies, and Token-Permissions -- and
scores each 0 to 10. The Token-Permissions check, per its own documentation, looks at whether a
repository's workflows follow least privilege for the GITHUB_TOKEN, penalizing workflows
that grant broader write access than a job appears to need, and returns one aggregate score for the
repository. Running it needs a GitHub token to avoid API rate limits, and it is typically run through the
ossf/scorecard-action in CI or read from Scorecard's own public dataset of already-scanned
open-source repositories.
This checker does the narrower version of the same job: you paste the YAML of one or
more workflow files, and it lists every workflow-level and job-level permissions: grant --
file, line, and whether it is explicit, write-all, or unspecified
(running on the ambient repository/organization default). It runs entirely in your browser, needs no
GitHub token and no install, and makes no network call of its own, so it works the same on a private
repository's workflow, an unpushed fork, or a file from a repo you do not administer.
| Question | Where to answer it |
|---|---|
| How does my whole repository score across 18 supply-chain dimensions, tracked over time? | OpenSSF Scorecard -- that is its entire job, and this tool does not attempt it. |
| Which exact workflow or job in one file has no permissions block, or grants write-all, and what should I put there instead? | This checker -- a file:line table with an explicit/write-all/unspecified classification, not a score. |
| I need this to work on a private repository's workflow, or a file I have not pushed anywhere. | This checker -- no token, no repository access, nothing leaves your browser. Scorecard's public dataset and default setup target public repositories. |
| I want one score I can track over time and compare against other repositories. | OpenSSF Scorecard -- this tool produces a per-file finding list, not a trackable score. |
| I want this wired into CI to block a merge automatically. | Either: Scorecard's own GitHub Action, or this tool's check.py --fail-on-risk for the permissions question specifically. |
The two are complementary, not competing: a repository can run Scorecard for the ongoing 18-dimension score and still reach for this tool the moment the question is "which workflow or job, right now, and is it write-all or just unspecified" on a file that is not yet in a public, tokened CI run.
Common questions
Should I use this checker or OpenSSF Scorecard?
They answer an overlapping question in different shapes. Scorecard is a broader, ongoing measurement: it runs 18 named checks against a repository -- Branch-Protection, Code-Review, Dangerous-Workflow, Token-Permissions, Vulnerabilities, Pinned-Dependencies, and more -- each scored 0 to 10, using the GitHub API and a token, usually wired into CI or read from Scorecard's own public dataset of already-scanned open-source repositories. This tool answers only the permissions question: you paste the YAML of a workflow file, and it lists every workflow or job with no explicit permissions block, or with permissions: write-all, file and line. It runs entirely in your browser, needs no token, no install, and no repository access, because it never talks to GitHub at all. If you want an ongoing score across 18 dimensions of a public repository's supply-chain posture, Scorecard is the right tool. If you want a fast, private, no-setup answer to the permissions question on one workflow file in front of you right now, this is the narrower tool for that.
Does Scorecard's Token-Permissions check do the same thing as this tool?
The underlying question is the same; the shape of the answer is not. Scorecard's own documentation describes Token-Permissions as checking whether a project's workflows follow the principle of least privilege for the GITHUB_TOKEN, and it returns one 0-to-10 score for the repository as a whole, penalizing write permissions that are broader than a job appears to need. This tool checks the same underlying fact -- an explicit permissions block versus an ambient default, and write-all specifically -- but instead of a score it lists every workflow-level and job-level grant individually, with the file, line, and its classification (explicit, write-all, or unspecified). Running both is not redundant: Scorecard's score reflects GitHub's live view of your repository and can move for reasons unrelated to the one file you are editing, while this tool's file:line list is exact for the YAML you actually pasted.
Why would I need a token-free, no-install checker if Scorecard already exists?
Three reasons this tool exists alongside it. First, Scorecard's CLI needs a GitHub token to avoid API rate limits in practice, and its GitHub Action needs to run inside your CI with repository access -- this tool needs neither, so it works on a workflow file from a private repository, a fork you have not pushed anywhere, or a repo you do not administer, with nothing leaving your browser. Second, Scorecard is a Go binary (or a container image) you install and configure; this tool is a page you open and paste into. Third, when the answer you actually want is "which workflow or job, and is it write-all or just unspecified," a single 0-to-10 repository score is a worse fit than a table naming every grant, which is the only thing this tool produces.
Is this page affiliated with OpenSSF or the Scorecard project?
No. This site is not affiliated with, endorsed by, or sponsored by the Open Source Security Foundation or the Scorecard project. Scorecard is an open-source project of the OpenSSF, named here only to describe what this checker is and is not, using facts drawn from Scorecard's own public documentation and source repository at github.com/ossf/scorecard.