StepSecurity Logo
StepSecurity
LoginStart free

Assess the risk of third-party GitHub Actions

Actions

Assess all the actions

nvidia/aicr/.github/actions/prep-kind-runner

nvidia/aicr/.github/actions/prep-kind-runner

Tooling for optimized, validated, and reproducible GPU-accelerated AI runtime in Kubernetes

7/10
carabiner-dev/actions/install/ampel-bootstrap

carabiner-dev/actions/install/ampel-bootstrap

GiitHub actions for various tools in the Carabiner ecosystems

6/10
chainguard-actions/snok-install-poetry

chainguard-actions/snok-install-poetry

2/10
Maintained action available
christian-korneck/delete-run-artifacts-action

christian-korneck/delete-run-artifacts-action

github action to delete artifacts at the end of a workflow run

2/10
viasat::Git-Viasat-Com-PoC::seceng-vionix-stepsecurity-poc-test/github/docker-setup-buildx-action

viasat::Git-Viasat-Com-PoC::seceng-vionix-stepsecurity-poc-test/github/docker-setup-buildx-action

Mirror from https://github.com/docker/setup-buildx-action

3/10
Maintained action available
windlasstech/actionlint-hardened-action

windlasstech/actionlint-hardened-action

Docker-based GitHub Action for running actionlint with SHA-pinned images and Dependabot-managed updates.

6/10
touchlab/sample-group-sanity-check

touchlab/sample-group-sanity-check

Github action to do sanity check around org name and group id

4/10
Maintained action available
ministryofjustice/opg-github-actions/actions/terraform-version

ministryofjustice/opg-github-actions/actions/terraform-version

OPG shared GitHub composite actions for workflows.: Managed by opg-org-infra & Terraform

6/10
broadsage/container-images/.github/actions/discover-containers

broadsage/container-images/.github/actions/discover-containers

Primary source of truth for the Broadsage Container Images

5/10
step-security/action-yamllint

step-security/action-yamllint

GitHub Action - Yaml Lint. Secure drop-in replacement for ibiqlik/action-yamllint.

10/10
Maintained by StepSecurity
gurock/trcli-action

gurock/trcli-action

CI/CD integration

3/10
devantler-tech/ksail/.github/actions/restore-mirror-cache

devantler-tech/ksail/.github/actions/restore-mirror-cache

All-in-one Kubernetes SDK: create, manage, and operate clusters across distributions (Kind, K3d, Talos, VCluster) with built-in GitOps, secrets, AI assistant, and MCP server. Only requires Docker or a Cloud Provider.

3/10
Maintained action available
timschoenle/portfolio/.github/actions/image

timschoenle/portfolio/.github/actions/image

Dioxus fullstack (SSR + hydration) portfolio served by Axum.

4/10
Maintained action available
octodemo/pull-request-review-action

octodemo/pull-request-review-action

3/10
coveooss/terraform/.github/actions/equivalence-test

coveooss/terraform/.github/actions/equivalence-test

Terraform enables you to safely and predictably create, change, and improve infrastructure. It is a source-available tool that codifies APIs into declarative configuration files that can be shared amongst team members, treated as code, edited, reviewed, and versioned.

0/10
openzeppelin/openzeppelin-contracts/.github/actions/storage-layout

openzeppelin/openzeppelin-contracts/.github/actions/storage-layout

OpenZeppelin Contracts is a library for secure smart contract development.

5/10
Maintained action available
step-security/moon-ci-retrospect

step-security/moon-ci-retrospect

This action is designed for projects using Moonrepo, making the test results of the moon ci command more readable in GitHub Actions logs. Secure drop-in replacement for appthrust/moon-ci-retrospect.

10/10
Maintained by StepSecurity
slsa-framework/slsa-github-generator/.github'/actions/secure-builder-checkout

slsa-framework/slsa-github-generator/.github'/actions/secure-builder-checkout

Language-agnostic SLSA provenance generation for Github Actions

4/10
coveord/renovate/.github/actions/setup-node

coveord/renovate/.github/actions/setup-node

Home of the Renovate CLI: Cross-platform Dependency Automation by Mend.io

4/10
sonarsource/sonar-php/gh-action_release/main

sonarsource/sonar-php/gh-action_release/main

:elephant: SonarPHP: PHP static analyzer for SonarQube & SonarLint

5/10
Maintained action available