Assess the risk of third-party GitHub Actions

Actions

Assess all the actions

cloudposse/atmos/.github/actions/download-artifact-retry

Atmos is the open-source runtime for infrastructure — it builds, authenticates, and ships Terraform, OpenTofu, Kubernetes, Helm, and containers the same way on your laptop, in CI, and with AI agents.

6/10

step-security/github-action-aerospike/_next/static/chunks/80627-0608ba4420f1144d.js

GitHub Action to set up an Aerospike database. Secure drop-in replacement for reugn/github-action-aerospike.

10/10

entle/action-pagerduty-alert

0/10

ministryofjustice/laa-manage-your-civil-cases/.github/actions/set_up_app

A service to centrally manage civil legal aid cases for the Legal Aid Agency

7/10

posthog/posthog/.github/actions/wait-for-check

:hedgehog: PostHog is the leading platform for building self-driving products. Our developer tools – AI observability, analytics, session replay, flags, experiments, error tracking, logs, and more – capture all the context agents need to diagnose problems, uncover opportunities, and ship fixes. Steer it all from Slack, web, desktop, or the MCP.

4/10

Maintained action available

step-security/gh-action-pypi-publish

The blessed :octocat: GitHub Action, for publishing your :package: distribution files to PyPI, the tokenless way: https://github.com/marketplace/actions/pypi-publish. Secure drop-in replacement for pypa/gh-action-pypi-publish.

10/10

Maintained by StepSecurity

yonasbsd/affine/.github/actions/setup-version

There can be more than Notion and Miro. AFFiNE is a next-gen knowledge base that brings planning, sorting and creating all together. Privacy first, open-source, customizable and ready to use.

4/10

Maintained action available

argoproj/argo-rollouts/__builder_checkout_dir__/.github/actions/secure-download-artifact

Progressive Delivery for Kubernetes

6/10

jahid11978/neon/.github/actions/neon-branch-delete

Neon: Serverless Postgres. We separated storage and compute to offer autoscaling, code-like database branching, and scale to zero.

2/10

step-security/trigger-workflow-and-wait/__builder_checkout_dir__/.github/actions/fill

Trigger a workflow in another (or same) repository and wait for the job to finish. Secure drop-in replacement for convictional/trigger-workflow-and-wait.

10/10

asymmetric-research/clusterfuzz-fuzzbot-builder/assets/brand/step-security-full-logo.svg

Build environment matching a FuzzBot running Ubuntu 22.04

2/10

tobked/github-forks-sync-action

GitHub Action to synchronise forks

4/10

secretonline/client-side-painting-variants/.github/actions/update-versions

Add custom painting variants to Minecraft without overwriting existing paintings by using resource packs

2/10

dustin4444/desktop/.github/actions/setup-ci-environment

Focus on what matters instead of fighting with Git.

5/10

Maintained action available

step-security/codeowners-validator/__builder_checkout_dir__/.github/actions/privacy-check

The GitHub CODEOWNERS file validator. Secure drop-in replacement for mszostok/codeowners-validator.

8/10

sonarsource/sonarjs/.github/actions/ruling_bot

SonarSource Static Analyzer for JavaScript and TypeScript

4/10

Maintained action available

step-security/github-action-required-labels/__builder_checkout_dir__/.github/actions/privacy-check

Fail the build if/unless a certain combination of labels are applied to a pull request. Secure drop-in replacement for mheap/github-action-required-labels.

10/10

modeseven-lfreleng-actions/tag-push-verify-action

Verifies the action/workflow event trigger was a tag push event

5/10

Maintained action available

edera-dev/ocirender/.github/actions/quality-gate

Stream and merge OCI image layers into squashfs, tar, or directory output

5/10

nvidia/cccl/.github/actions/upload-artifacts

CUDA Core Compute Libraries

5/10

Maintained action available