// gh-actions 패키지

orkspace/orkestra-action

The official GitHub Action for Orkestra — runs the full ork CLI surface from any workflow

github.com/marketplace tarball repo homepage

AUTO-PUBLISHED·3개 버전 인덱싱됨·최근 publish: 2026-06-05

// exfil path

what is read → where it ships

steals

(no specific credential-read flag matched)

sends to

⚙ curl | bash(fetches + executes remote payload)

// offending code· @2026-06-05T22:53:30· 1 file flagged

llm: malicious · 0.95

→ 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

@2026-06-05T22:53:30·2026-06-05·AUTO-PUBLISHED·publisher: orkspace

heuristic 72/100

static flags 1

llm malicious (0.95) via fast-track

publish-burst:6new-publisher:0dhas-source-repopublisher-version-pump:6curl-pipe-bash

→ 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

// offending code· 1 file flaggedpatterns: 1

--- action.yml ---
name: "Orkestra"
description: "The official GitHub Action for Orkestra — runs the full ork CLI surface from any workflow"

inputs:
  ork-version:
    description: "Version of the ork CLI to install (e.g. v1.2.3). Defaults to the latest release."
    required: false
    default: ""

  working-directory:
    description: "Directory to run commands in. Defaults to the repository root."
    required: false
    default: "."

  # ── init ────────────────────────────────────────────────────────────────────
  init:
    description: "Run ork init before all other steps. Useful in CI when example files are not checked in."
    required: false
    default: "false"
  pack:
    description: "Example pack to initialise (beginner, intermediate, advanced, use-cases, …). Used with init: true."
    required: false
    default: ""

  # ── validate ────────────────────────────────────────────────────────────────
  validate:
    description: "Enable validate. 'true' = auto-detect katalog.yaml/komposer.yaml. Path = validate that file."
    required: false
    default: ""
  validate-depth:
    description: "full → ork validate --full (RBAC, dependency graph, per-CRD permissions)."
    required: false
    default: "single"

  # ── simulate ─────────────────────────────────────────────────────────────────
  simulate:
    description: "Enable simulate. 'true' = auto-detect (simulate.yaml → e2e.yaml → katalog.yaml). Path = use that file directly."
    required: false
    default: ""
  simulate-depth:

--- action.yml --- name: "Orkestra" description: "The official GitHub Action for Orkestra — runs the full ork CLI surface from any workflow" inputs: ork-version: description: "Version of the ork CLI to install (e.g. v1.2.3). Defaults to the latest release." required: false default: "" working-directory: description: "Directory to run commands in. Defaults to the repository root." required: false default: "." # ── init ──────────────────────────────────────────────────────────────────── init: description: "Run ork init before all other steps. Useful in CI when example files are not checked in." required: false default: "false" pack: description: "Example pack to initialise (beginner, intermediate, advanced, use-cases, …). Used with init: true." required: false default: "" # ── validate ──────────────────────────────────────────────────────────────── validate: description: "Enable validate. 'true' = auto-detect katalog.yaml/komposer.yaml. Path = validate that file." required: false default: "" validate-depth: description: "full → ork validate --full (RBAC, dependency graph, per-CRD permissions)." required: false default: "single" # ── simulate ───────────────────────────────────────────────────────────────── simulate: description: "Enable simulate. 'true' = auto-detect (simulate.yaml → e2e.yaml → katalog.yaml). Path = use that file directly." required: false default: "" simulate-depth: