CI/CD Security Best Practices and GitHub Actions Documentation Software

An academic security research project evaluating how security best practices for GitHub Actions CI/CD pipelines are communicated in GitHub's official documentation, and how that guidance compares against state-of-the-art standards such as the OWASP Top 10 CI/CD Security Risks. The work is motivated by the fact that both developers and LLMs rely on official documentation for security guidance. The project is built as a data pipeline: a TypeScript/Docker crawler collects GitHub docs as markdown; a Python extraction stage uses a local fork of Google's langextract (with Gemini) to pull security-advice spans from the text and evaluate them against ground-truth annotations; additional stages analyze documentation "alerts" (Warnings, Cautions, Notes) and classify advice by OWASP category; and a final evaluation stage measures the overlap between the documentation's advice and OWASP recommendations.