How act is put together
nektos/act is a Go CLI that runs GitHub Actions workflows locally. It parses `.github/workflows/*.yml` into a workflow plan (pkg/model), evaluates GitHub Actions expressions (pkg/exprparser), and executes jobs/steps either inside Docker containers (via the Docker API) or directly on the host, emulating GitHub runner environments. Supporting subsystems include a local artifact upload/download HTTP server (pkg/artifacts), a local actions cache server backed by bbolt storage (pkg/artifactcache), an action cache for remote/local actions (pkg/runner/action_cache.go), and reusable-workflow resolution via go-git. Data flow: user flags/env -> cobra command -> Config -> WorkflowPlanner -> PlanEvent -> Runner/NewPlanExecutor -> step executors -> Docker Engine or host processes.
Languages
Frameworks
Datastores
Infrastructure
Major components
cmd
Cobra-based CLI entrypoint defining root/list/graph/platforms commands, input parsing, secret loading, and graceful cancellation context.
pkg/model
Parses and models GitHub Actions workflow and action YAML files, including planner, anchors handling, and github_context construction.
pkg/runner
Core execution engine: run context, job executor, step factory, and step executors for run/docker/action-local/action-remote steps plus action caching and reusable workflows.
pkg/container
Docker integration layer for pulling/building images, running job/service containers, host environments, volumes, networks, auth, and socket handling.
pkg/exprparser
Implements the GitHub Actions expression language interpreter and built-in functions (hashFiles, format, etc.).
pkg/artifacts
HTTP server emulating Azure DevOps/GitHub artifact APIs (v1-style uploads/downloads and v4 routes) storing artifacts on the local filesystem.
pkg/artifactcache
Local cache server implementing the GitHub Actions cache API with bbolt-backed storage.
pkg/common
Shared utilities: executor pipeline combinators, logging, context helpers, line writers, git helpers, and JWT authorization-token creation/parsing.
No digest this week
1 weeksWeek of
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
All routes registered in pkg/artifacts/server.go Serve(): POST /_apis/pipelines/workflows/:runId/artifacts, PUT /upload/:runId, PATCH /_apis/pipelines/workflows/:runId/artifacts, GET /_apis/pipelines/workflows/:runId/artifacts, GET /download/:container, GET /artifact/*path
An attacker on the network can silently exfiltrate every artifact produced by the victim's local workflow runs and replace artifact contents with attacker controlled data that downstream steps will consume.
Fix: Bind the artifact server to 127.0.0.1 by default and require a per invocation random bearer token in the URL prefix or Authorization header, exactly as pkg/artifactcache/handler.go already does with its 16 byte random token, rejecting requests that do not carry it.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required