Suspicious GitHub Action pre/post hook

This detector flags a GitHub Custom Action whose pre/post hook entry point both reaches the network and reads secrets, credentials, or CI tokens. That combination — not the mere presence of a hook — is the signal.

pre/post hooks run around the main action and, with post-if: always(), even when the job fails, which makes them an ideal place to smuggle exfiltration logic. Only JavaScript actions (runs.pre / runs.post) and Docker container actions (runs.pre-entrypoint / runs.post-entrypoint) have such hooks; composite actions do not and are not inspected.

A malicious or compromised Action can read the workflow’s secrets (process.env.TOKEN, GITHUB_TOKEN, cloud credentials) and quietly ship them to an attacker-controlled endpoint from a hook that most reviewers never look at. Requiring *both a network egress (fetch/axios/http(s).request/curl/wget/nc) and a secret-shaped environment read keeps false positives low: benign cleanup or telemetry hooks typically do one but rarely both, and legitimately reading INPUT* alone is not enough to trip the rule.

The pre/post timing trick is exactly how several real GitHub Actions supply-chain compromises staged their theft of CI secrets.