Assess the risk of third-party GitHub Actions

Examples: ,

Actions

Assess all the actions

ministryofjustice/cloud-platform-environments/cmd/push-terraform-module-version

Environment configuration for the Cloud Platform

6/10

danger/danger-js

⚠️ Stop saying "you forgot to …" in code review

5/10

Maintained action available

step-security/vitest-coverage-report-action/__builder_checkout_dir__/.github/actions/secure-download-artifact

A GitHub Action to report vitest test coverage results. Secure drop-in replacement for davelosert/vitest-coverage-report-action.

10/10

bit-tasks/dependency-update

Bit component updates lookup task for CI/CD

0/10

step-security/dependabot-fetch-metadata/__builder_checkout_dir__/.github/actions/privacy-check

Extract information about the dependencies being updated by a Dependabot-generated PR. Secure drop-in replacement for dependabot/fetch-metadata.

10/10

step-security/docker-bake-action

GitHub Action to use Docker Buildx Bake as a high-level build command. Secure drop-in replacement for docker/bake-action.

10/10

Maintained by StepSecurity

step-security/push-md-to-notion

Push Markdown to Notion. Secure drop-in replacement for JoshStern/push-md-to-notion.

10/10

Maintained by StepSecurity

emqx/push-helm-action

3/10

nvidia/nemoclaw/.github/actions/resolve-hermes-base-image

Run agents like Hermes, LangChain Deep Agents, and OpenClaw more securely inside NVIDIA OpenShell with managed inference

6/10

aquanow/usdu-smart-contracts/.github/actions/public-layout.tsx

Source repository for the smart contracts powering the USD-backed stablecoin issued by Universal Digital Intl Limited (“Universal”).

4/10

step-security/setup-qemu-action/_next/static/chunks/app/(dashboard)/not-found-78ffcd161e5e6323.js

GitHub Action to install QEMU static binaries. Secure drop-in replacement for docker/setup-qemu-action.

9/10

secretonline/minecraft-actions/get-test-matrix

A collection of GitHub actions to aid in mod and modpack development for Minecraft

2/10

Maintained action available

frederick888/gh-ph

`gh-ph` is a GitHub CLI extension and a GitHub Action that puts commit history into your pull request description

4/10

cloudposse/atmos/.github/actions/setup-go-cache

Atmos is the open-source runtime for infrastructure — it builds, authenticates, and ships Terraform, OpenTofu, Packer, Ansible, Kubernetes, Helm, and containers the same way on your laptop, in CI, and with AI agents.

7/10

posthog/posthog/.github/actions/setup-pnpm

:hedgehog: PostHog is the leading platform for building self-driving products. Our developer tools – AI observability, analytics, session replay, flags, experiments, error tracking, logs, and more – capture all the context agents need to diagnose problems, uncover opportunities, and ship fixes. Steer it all from Slack, web, desktop, or the MCP.

4/10

Maintained action available