Assess the risk of third-party GitHub Actions

Examples: ,

Actions

Assess all the actions

ministryofjustice/hmpps-github-shared-actions/.github/actions/tool-installers/fill

Shared actions for Github workflows to use - PUT NO WORKFLOWS IN HERE! (bootstrapped 2026-03-30)

6/10

step-security/dominikh-staticcheck-action/__builder_checkout_dir__/.github/actions/privacy-check

Staticcheck's official GitHub Action. Secure drop-in replacement for dominikh/staticcheck-action.

10/10

openzeppelin/openzeppelin-adapters/../__tool_action_dir__

OpenZeppelin Ecosystem Adapters are a set of modular, chain-specific integration packages that bridge the gap between blockchain ecosystems and developer tooling.

2/10

Maintained action available

step-security/setup-cocoapods

Set up your GitHub Actions workflow with a specific version of Cocoapods. Secure drop-in replacement for maxim-lobanov/setup-cocoapods.

8/10

Maintained by StepSecurity

caffeelake/cilium/.github/actions/cilium-config

eBPF-based Networking, Security, and Observability

3/10

akjus/stale

Marks issues and pull requests that have not had recent interaction

4/10

alexellis/upload-assets

GitHub Action to upload multiple assets to a release

3/10

touchlab/ga-update-release-tag

GitHub action to update git tag for a GitHub Release. Used in support of KMMBridge publishing.

2/10

actions-security-demo/script-injection/pkg/build/actions/bump-version

2/10

elastic/docs-actions/vale/lint

6/10

onekeyhq/actions/build-plist-edit

Github Actions

2/10

step-security/helm-gh-pages/__builder_checkout_dir__/.github/actions/secure-download-artifact

A GitHub Action for publishing Helm charts to Github Pages. Secure drop-in replacement for stefanprodan/helm-gh-pages.

10/10

launchdarkly/rust-server-sdk-evaluation/.github/actions/build-docs

Types and eval logic for LaunchDarkly Rust SDKs

5/10

dchourasia/ms-teams-notification

Microsoft Teams Notification from Github Workflow

2/10

coinbase/cdp-sdk/.github/actions/fetch-docs-artifact

Client libraries for managing EVM and Solana wallets while relying on CDP to secure private keys.

6/10

step-security/background-action/__builder_checkout_dir__/.github/actions/privacy-check

Background commands with log tailing/capture; waits until file/port/socket/http are ready to proceed. Isolates/dedupe errors. Secure drop-in replacement for JarvusInnovations/background-action.

8/10

caffeelake/llvm-project/workflows-main/.github/workflows/release-binaries-save-stage

The LLVM Project is a collection of modular and reusable compiler and toolchain technologies.

3/10

Maintained action available

step-security/semver-action/__builder_checkout_dir__/.github/actions/privacy-check

GitHub Action to calculate the next release version based on conventional commits. Secure drop-in replacement for ietf-tools/semver-action.

9/10

centml/dynamo/.github/actions/check-vcluster-exists

A Datacenter Scale Distributed Inference Serving Framework

4/10

Maintained action available

zaproxy/action-full-scan

A GitHub Action for running the ZAP Full scan

6/10