The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →APort Repository Guard can check repository and workflow changes in GitHub Actions, with its documented default setup starting in report-only mode. To test the documented permission-escalation denial, generate the workflow, review its permissions, enable hosted enforcement, and open a test pull request that adds a workflow with permissions: write-all. APort describes that test as a high-confidence denial; this is the vendor-documented expected result, not an independently verified test.
What APort checks—and what it does not
APort Repository Guard is a GitHub Action for surfacing repository and workflow signals, including changes to protected paths, use of pull_request_target, workflow permission escalation, additions of OIDC permissions, and suspicious or remote-execution code on selected sensitive surfaces. Its Marketplace listing says the Action produces a summary of checked signals.
As an Amazon Associate I earn from qualifying purchases.
APort positions the guard as complementary to security scanners and GitHub protections, not as a replacement for code scanning, dependency checks, or branch rules. Its stated purpose includes making agent authorship and authorization provenance visible; the guard’s listed checks do not establish that every change was authored by an AI agent or that all risky changes will be detected. APort Repository Guard on GitHub Marketplace
Generate and inspect the GitHub Actions workflow
-
From the repository root, run
npx @aporthq/aport-agent-guardrails github.#1 Best Overall
-
Inspect the generated
.github/workflows/aport-guard.ymlbefore relying on it. The command is documented in APort’s quickstart and public repository. -
Review the workflow’s permission block. The Marketplace example lists
id-token: write,contents: read, andpull-requests: read. The OIDC token permission supports the hosted identity flow; it is not a general repository write grant. Treat other broad write permissions as something to scrutinize, not as a harmless default.
APort describes the default auto path as using GitHub OIDC and creating or reusing a repository-scoped hosted passport. It begins with report-only evidence. That distinction matters: a report is not, by itself, a merge-blocking check.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How GitHub OIDC fits the hosted verification path
In the documented flow, GitHub issues an OIDC identity token for the workflow, which APort uses for hosted verification. The integration documentation describes issuing or reusing the identity and calling code.repository.merge.v1. The Marketplace example’s id-token: write permission enables the workflow to request that token; it does not grant the workflow broad write access to repository contents.
These are distinct layers: the workflow’s GitHub token permissions govern what the job can request from GitHub, while the hosted passport and verification path provide identity and policy context for APort’s check. The available documentation does not make report-only evidence equivalent to an enforced denial.
Run the documented permission-escalation exercise
-
First generate and inspect the workflow, and confirm the report-only setup is running as expected.
-
Configure hosted enforcement for the repository before attempting to validate a denial. Hosted enforcement is a separate step from the default report-oriented path; configure the repository’s branch-protection behavior as needed if the goal is to prevent merging.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Create a test branch and pull request that adds a workflow file containing an escalation such as
permissions: write-all. Keep this change confined to a test repository or a clearly isolated test branch. -
Inspect the APort finding and the GitHub Actions job summary. The quickstart describes this scenario as producing a high-confidence denial once hosted enforcement is enabled. That is APort’s documented expected behavior, not a result independently measured here.
The Marketplace listing notes report-mode exit behavior, so a reported finding should not be assumed to fail the job or block a merge. Check the configured enforcement and repository branch-protection behavior rather than inferring a gate from the presence of a finding.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Keep the check in its proper security role
A permission-escalation exercise validates one documented scenario; it does not establish comprehensive protection for a repository. Keep the guard alongside appropriate code and dependency scanning, GitHub security features, and repository rules. When evaluating any permission-checking approach, distinguish checks that run on proposed changes from source-only scans, report evidence from enforced blocking, and narrow workflow token permissions from provenance about who or what authored a change.
Free tools Windows power users keep installed
One-click scans. No signup required.
For implementation details that may change, consult APort’s quickstart, repository, and Marketplace listing.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
