$ show ashishb/android-security-awesome
This is not a conventional software application — it is a curated awesome-list repository (classified as 'application' only because its CI/CD pipeline and shell tooling are the sole executable content). The actual product is README.md: a comprehensive, categorized catalog of Android security resources covering online analyzers, static/dynamic analysis tools, reverse-engineering utilities, fuzzers, vulnerability scanners, intentionally vulnerable practice apps, research papers, malware datasets, exploit lists, and bug bounty programs. The repository ships no libraries, services, or user-facing code; its runtime behavior is limited to link-liveness checking (urlsup) and linting of the repository's own documentation and automation. The repository's engineering value lives in its maintenance infrastructure. GitHub Actions workflows lint Markdown (mdl), shell scripts (shellcheck), YAML (yamllint), and the workflows themselves (actionlint plus a zizmor security scan), while a scheduled job validates all README links weekly using a carefully curated urlsup configuration (.urlsup.toml) that distinguishes dead links (strikethrough-removed from the list) from flaky or bot-protected endpoints (allowed 403/429/503). Dead and archived tools are explicitly marked with strikethrough in the README, keeping the resource list honest without silently deleting historical references. All third-party actions are pinned to commit SHAs, permissions are least-privilege, and the cargo-based link checker is cached for fast CI runs. For an Android security practitioner, the repo serves as the de facto reference index for the ecosystem — many entries point to the actual tools (MobSF, Drozer, Frida, jadx, Androguard, QARK) and malware datasets (AndroZoo, Drebin, Kharon). For an engineer, the reusable assets are the link-liveness pipeline and the CI self-audit pattern, both of which can be transplanted into any link-heavy or automation-heavy repository. The repo is a hybrid: content-curation project with application-grade CI scaffolding around it, rather than either a true application or a data research project.
The LLM identified 3 files worth highlighting for reuse:
A hand-maintained configuration for the urlsup link checker that encodes accumulated knowledge about external URL health: a ~40-entry allowlist that cleanly separates genuinely dead links from merely flaky/timeout endpoints, permitted HTTP status codes (403/429/503) for bot-protected services, and tuned retry/rate-limit parameters. This is the kind of institutional knowledge that keeps a link-liveness CI green without silently ignoring broken links — directly reusable in any link-heavy repository (docs, awesome-lists, registry sites) that uses urlsup.
A scheduled link-liveness workflow that demonstrates a smart pattern for on-demand Rust tooling in CI: caches Cargo registry, git db, and target/ artifacts; lazy-installs urlsup via `command -v urlsup || cargo install --locked urlsup`; runs on a weekly cron plus push/PR triggers; and retries the entire check once to absorb transient network failures. Portable as-is to any repository needing dependable broken-link detection without a paid SaaS link-checking service.
A workflow that self-audits the repository's own GitHub Actions: actionlint for syntax/logic errors and a containerized, offline zizmor scan for security vulnerabilities in the workflows. It applies least-privilege permissions (contents: read), sparse-checkout to minimize exposed repo content, and pins every third-party action to a commit SHA. This supply-chain-hardened CI linting pattern is a strong non-obvious template for any repository that wants to audit its own automation for malicious or dangerous workflow patterns.