Assess the risk of third-party GitHub Actions

Examples: ,

Actions

Assess all the actions

ministryofjustice/laa-manage-your-civil-cases/.github/actions/build_and_push

A service to centrally manage civil legal aid cases for the Legal Aid Agency

7/10

adrise/connectedhomeip/.github/actions/git-safe-directory

Fork of project-chip/connectedhomeip

3/10

ashishkurmi/setup-bun

2/10

austenstone/get-org-repos

A GitHub Action to get organization repositories.

3/10

dustin4444/turborepo/.github/actions/setup-protoc

Build system optimized for JavaScript and TypeScript, written in Rust

3/10

project-dalec/dalec/.github/actions/format-repo

📦 Produce secure packages and containers with declarative configurations

6/10

ministryofjustice/hmpps-github-shared-actions/.github/actions/build-test-and-deploy/image

Shared actions for Github workflows to use - PUT NO WORKFLOWS IN HERE! (bootstrapped 2026-03-30)

8/10

step-integration-tests/auto-pdpr-test-79603-13/.github/workflows/install-and-build

Test repository created from policy-based-prs template for integration testing

2/10

turtlequeue/setup-babashka

github actions for installing borkdude/babashka

1/10

step-security/swift-codecov-action

Secure drop-in replacement for mattpolzin/swift-codecov-action.

10/10

Maintained by StepSecurity

elastic/oblt-actions/public-layout.tsx

6/10

step-security/add-pr-comment/_next/static/chunks/98234-276d5b47fca26766.js

GitHub Action which adds a comment to a pull request's issue. Secure drop-in replacement for mshick/add-pr-comment.

10/10

yonasbsd/bun/bun/.github/actions/setup-bun

Incredibly fast JavaScript runtime, bundler, transpiler and package manager – all in one.

4/10

Maintained action available

sonarsource/sonar-html/gh-action_release/fill

Static analyzer for HTML used in Sonar ecosystem

6/10

githubocto/repo-visualizer

0/10

fortify/github-action/internal/fill

Fortify GitHub Actions

1/10

Maintained action available

aidenterfurt/bc-ai-reviewer

Business Central-specific code review composite action with contextual integration (linked issues, app.json files, README files, and coding guidelines).

0/10

orcasound/get-ooi-data/.github/actions/get-ooi-data

GitHub Action for acquiring Ocean Observatories Initiative hydrophone data

3/10

openai/codex-security/.github/actions/download-native

OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security

4/10

nvidia/ncx-infra-controller-core/.github/actions/docker-auth

NVIDIA Infra Controller - Hardware Lifecycle Management and multitenant networking

5/10

Maintained action available