Assess the risk of third-party GitHub Actions

Examples: ,

Actions

Assess all the actions

step-integration-tests/auto-pdpr-test-38233-10/.github/workflows/install-and-build

Test repository created from policy-based-prs template for integration testing

2/10

nvidia-bionemo/bionemo-inference-runtime/.github/actions/cubin-packs

Easy, fast, and memory-efficient structure prediction inference

5/10

step-security/dynamic-matrix/__builder_checkout_dir__/.github/actions/privacy-check

Secure drop-in replacement for coactions/dynamic-matrix.

10/10

lfit/releng-reusable-workflows/.github/actions/repository-metadata-action

Reusuable workflows developed by LF Release Engineering

7/10

coveo/areas

GitHub action to manage the ownership of code areas and its PR reviews and labeling

2/10

Maintained action available

step-security/mikefarah-yq

yq is a portable command-line YAML, JSON, XML, CSV, TOML, HCL and properties processor. Secure drop-in replacement for mikefarah/yq.

10/10

Maintained by StepSecurity

launchdarkly/dotnet-logging-adapter-ms/.github/actions/release-build

Adapter from LaunchDarkly.Logging API to Microsoft.Extensions.Logging

4/10

rapidsai/dependency-file-generator/.github/actions/semantic-release

6/10

stackadapt/incubator-devlake/.github/actions/public-layout.tsx

Apache DevLake is an open-source dev data platform to ingest, analyze, and visualize the fragmented data from DevOps tools, extracting insights for engineering excellence, developer experience, and community growth.

2/10

step-security/protobuf-ci/__builder_checkout_dir__/.github/actions/public-layout.tsx

A shared repository for Protobuf CI actions. Secure drop-in replacement for protocolbuffers/protobuf-ci.

10/10

aerospike/aerospike-client-java/.github/actions/publish-build-info-to-jfrog

Aerospike Java Client Library

5/10

Maintained action available

step-security/winterjung-comment/__builder_checkout_dir__/.github/actions/image

GitHub action to comment on pr, issue. Secure drop-in replacement for winterjung/comment.

10/10

cybrking/thr8

Automatically generate PASTA threat models from your repo using Claude AI.

1/10

Maintained action available

redpanda-data/redpanda/ghca/actions/slash-command-error

Redpanda is a streaming data platform for developers. Kafka API compatible. 10x faster. No ZooKeeper. No JVM!

4/10

Maintained action available

redpanda-data/llvm-project/.github/workflows/get-llvm-version

The LLVM Project is a collection of modular and reusable compiler and toolchain technologies. Note: the repository does not accept github pull requests at this moment. Please submit your patches at http://reviews.llvm.org.

3/10

hiddenlayerai/hiddenlayer-model-scan-github-action

Official HiddenLayer Github Action for the Model Scanner

7/10

palewire/install-python-pipenv-pipfile

Easily install Python, pipenv and Pipfile packages in your GitHub Action

3/10

step-security/action-install-gh-release

GitHub Action to install the Github Release binaries. Secure drop-in replacement for jaxxstorm/action-install-gh-release.

10/10

Maintained by StepSecurity

ministryofjustice/laa-manage-your-civil-cases/.github/actions/deploy

A service to centrally manage civil legal aid cases for the Legal Aid Agency

7/10

rudderlabs/kata-containers/.github/cargo-deny-composite-action

Kata Containers is an open source project and community working to build a standard implementation of lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload isolation and security advantages of VMs. https://katacontainers.io/

3/10