What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A safe pull-request audit treats proposed code as untrusted text: it parses the source, checks explicit syntax rules, and reports stable findings without running the project. For ordinary contribution checks that need no secrets or write access, GitHub recommends the pull_request event. Keep the parser and its options fixed, limit the workflow token, and make the audit’s coverage and failures visible.
Choose the event that matches the trust boundary
For a source-only audit that needs neither secrets nor write access, use pull_request. GitHub documents that fork pull requests using this event receive a read-only GITHUB_TOKEN and do not receive repository secrets by default. That makes it the safer default for inspecting contributions from outside the repository.
pull_request_target is different: it runs with the trust of the base repository. The risk is not simply checking out a pull request’s files; it is then running attacker-controlled content with those privileges. Build scripts, tests, package installation hooks, Makefiles, and project configuration can all execute code. GitHub’s guidance is explicit: “You must ensure the checked-out code is only ever inspected as data and never executed before using a pull_request_target event.”
An AST harness should therefore read source files and parse them as data. Do not add build, test, dependency-install, or configuration-execution steps to the privileged inspection path. If a privileged event is genuinely required, document why, grant only the necessary permissions, and ensure no step executes pull-request-controlled files.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
Compare the two event choices
| Event | Trust and default access | When it fits |
|---|---|---|
pull_request |
Fork workflows receive a read-only token; secrets are withheld by default, according to GitHub’s secure-use guidance. | Source inspection and other checks that do not require secrets or write access. |
pull_request_target |
Runs with base-repository trust. Checking out a pull request is not itself execution, but running its code or configuration in this context can expose that trust. | Only a justified workflow that needs base-repository privileges and is designed to keep untrusted files as data. |
GitHub’s documentation says the default policy for affected public repositories using pull_request_target is currently in evaluate mode, with enforcement scheduled for November 2, 2026. This is a changing platform policy: check GitHub’s current policy guidance and the repository’s policy insights before changing a live workflow.
Limit the workflow token
Set workflow permissions explicitly and grant only what the audit needs. A read-only inspection commonly needs no write permission; when permissions are specified, GitHub Actions treats omitted scopes as none. A minimal starting point for reading repository contents is:
permissions:
contents: readPlace any additional permission only on the job that requires it. For example, a separate job that publishes a result may need a narrowly scoped write permission; the parser job should not inherit that authority merely because another job uses it. Review the permissions together with the trigger: a restrictive token does not make it safe to execute untrusted code in a privileged event.
Make the parser contract repeatable
Determinism is a property of the harness you design, not a guarantee supplied by GitHub Actions or an AST library. Fix the language runtime and parser version, declare parse mode and options, version your rule set, and define how findings are ordered. Record the runtime/parser and policy versions with the result so reviewers can tell which contract produced it.
Pin runtime, parser, and options
Use a fixed runtime version in the workflow rather than a floating “latest” selection. Pin third-party actions to reviewed immutable references, and audit every action that consumes pull-request data. Python is one possible implementation, not an assumption about the target project: its documentation notes that the abstract grammar can change between releases. Its ast.parse API has options such as feature_version and optimize; choose and record the options that match the policy rather than silently inheriting changing defaults.
When evaluating a parser for any language, compare its supported language versions, source-location fidelity, behavior under fixed options, and whether it only parses syntax or also attempts semantic analysis. The cited Python documentation establishes version sensitivity, but does not rank parser products or prescribe one universal architecture.
Rank #3
Keep the audit’s promise narrow
For Python, ast.parse(source, filename=..., mode=...) constructs an AST. Successful parsing alone does not prove that the source will execute successfully: Python documents that compilation may still raise SyntaxError. More importantly, an AST rule check is not proof of runtime safety, correct behavior, or harmless intent. It detects only patterns its rules express in the parsed syntax.
Define explicit rules and stable findings
Write each rule against named AST node types and relationships, including what is allowed as well as what is disallowed. Keep rule identifiers versioned so a policy change can be distinguished from a parser upgrade. Do not imply that a syntax-only rule resolves aliases, dynamic dispatch, or runtime behavior unless the harness actually analyzes those cases.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallFor example, a Python rule can identify a direct call whose syntactic callee is the bare name eval. That is a deliberately narrow pattern: it does not claim to find every alias or indirect route to evaluation.
import ast
def direct_eval_findings(source, path):
tree = ast.parse(source, filename=path, mode="exec")
findings = []
for node in ast.walk(tree):
if (isinstance(node, ast.Call)
and isinstance(node.func, ast.Name)
and node.func.id == "eval"):
findings.append({
"path": path,
"line": node.lineno,
"column": node.col_offset,
"rule_id": "PY-DIRECT-EVAL",
"severity": "error",
"message": "Direct call to eval",
})
return findings
def stable_findings(findings):
return sorted(
findings,
key=lambda item: (
item["path"], item["line"], item["column"], item["rule_id"]
),
)This is an illustrative rule, not a complete audit program or a claim that banning this call is a universal policy. A production harness also needs an explicit file-selection policy, error handling, output serialization, and tests for both matching and non-matching syntax. Define locations consistently; for Python, AST column offsets are source positions as represented by the parser, so document the convention your consumers should expect.
Use a machine-readable schema with stable fields such as repository-relative path, start and end location, rule ID, severity, and concise explanation. Sort findings by a documented tuple such as path, start line, start column, then rule ID. Do not use timestamps, runner identifiers, or traversal order as part of comparison output. Python can include location attributes in an AST dump when requested, but neither its documentation nor GitHub specifies a universal audit-report schema.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Handle failures and exclusions visibly
Keep parser failures separate from policy violations. A rule finding means the file parsed and a rule matched; a parse error means that file could not be checked under the selected parser contract. Report the path and parser error, and make clear whether the whole audit failed or coverage is incomplete.
Best Value
- Do not silently skip unsupported syntax or files. Report exclusions and the policy reason so reviewers can see what the gate did not inspect.
- Define what happens when a file exceeds a size limit or parsing exhausts resources. Fail closed or report an incomplete audit according to the repository’s policy; do not treat the condition as a clean pass.
- Keep machine-readable output stable, while sending operational details that vary between runs to a separate log if needed.
Parsing is not a sandbox. A parser can reject malformed input or run into resource limits, but it does not establish that the proposed program is safe to execute.
Make the GitHub workflow reviewable
Keep the trigger, permissions, runtime selection, and action references visible in the workflow file. Review every step that handles pull-request-controlled values, including shell interpolation, artifact downloads, caches, dependency installation, and third-party actions. GitHub’s secure-use guidance calls for auditing third-party actions and handling untrusted input carefully.
For a basic audit, the workflow should have a source-only path: obtain the proposed files, invoke the pinned parser and harness, then publish the findings or fail the check. Do not invoke the repository’s own test suite, build tooling, package hooks, or configuration as part of that path. If the chosen event or reporting mechanism requires extra privileges, isolate that job from the parser job and grant only the precise scope it needs.
Review what the check actually guarantees
- It can guarantee: under a pinned runtime and declared options, the configured parser and rules produce a consistently ordered report for the files the harness says it inspected.
- It cannot guarantee: semantic correctness, complete detection of a behavior across aliases or runtime dispatch, or safety if the code is later executed.
- It depends on: the rule definitions, supported syntax, file-selection policy, parser version, and transparent handling of errors and exclusions.
GitHub’s event and token guidance establishes how workflow trust and permissions work; Python’s AST documentation establishes the parser-specific behavior described above. Neither prescribes a complete deterministic audit architecture or a language-neutral ruleset, so those remain engineering decisions the maintainers must document.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
