Security GitHub Actions

A fence keeps things out, but also in. This project is still in early, and active development.

Open-source AI agent firewall for MCP security and agent egress. Scans mediated HTTP, MCP, A2A, and WebSocket traffic for exfiltration, SSRF, and prompt injection, and emits mediator-signed action receipts: verifiable audit evidence from outside the agent.

Open-source AI agent firewall for MCP security and agent egress. Scans mediated HTTP, MCP, A2A, and WebSocket traffic for exfiltration, SSRF, and prompt injection, and emits mediator-signed action receipts: verifiable audit evidence from outside the agent.

The deterministic merge gate for AI-generated agent capability changes — a local-first, static Tool-Use Readiness review for MCP, OpenAPI, and SDK tool surfaces. Open-source CLI + GitHub Action.

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.

Anchore container analysis and scan provided as a GitHub Action

Configure AWS credential environment variables for use in other GitHub Actions.

GitHub Action that detects the Shai-Hulud 2.0 (Nov 2025) and ChainDrop (Aug 2026) npm supply-chain attacks. Scans dependencies, lockfiles and CI workflows against a daily-updated database of 1,200+ compromised packages, flags malicious install scripts, TruffleHog secret theft and SHA1HULUD runners. SARIF output for GitHub Code Scanning.

A cross-platform, open-source Salesforce CLI plugin, VS Code extension, and GitHub Action for analysing and optimising Salesforce Flows. It scans metadata against 20+ community-driven rules — hardcoded IDs, missing fault paths, inefficient DML, recursion risks, and more. Includes auto-fixes, configurable rules, and CI/CD integration

Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/

Catch risky npm dependency changes before they merge.

Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.

Run zizmor from GitHub Actions!

Official GitHub Action for OpenSSF Scorecard.

Open source (AGPL-3.0) evidence-grounded repository audit CLI - deterministic scanner, MCP server, live dashboard, and a GitHub Action that posts PR diffs.

A Github Action to ensure that actions are pinned to full length commit SHAs

Get rid of personal access tokens (PAT) and credential management, use temporary GitHub Application access tokens instead!

GitHub Action for creating a GitHub App Installation Access Token

A GitHub Action for sigstore-python

The open source security engine for AI agent and supply-chain trust.

Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CIS Docker Benchmark.

Quality gate for AI/Codex-generated pull requests: blocks TODO leftovers, leaked secrets, sloppy commits and red CI before they reach main.

Sealed execution environment for GitHub Actions.

The GitHub Action for Promptfoo. Test your prompts, agents, and RAGs. AI Red teaming, pentesting, and vulnerability scanning for LLMs. Compare performance of GPT, Claude, Gemini, Llama, and more. Simple declarative configs with command line and CI/CD integration.

Fail CI when dependencies in your lockfile lose npm provenance or trusted publisher status

Find and govern AI attack surfaces in application code, at PR time and inside your AI coding tool (MCP server, Claude Code hook). Free, OSS, runs offline.

Open source AI code review for coding agents. A separate reviewer checks every change your agent writes before you push, in Claude Code, Codex, Cursor and Cline. No account or key of its own.

GitHub Actions to pin GitHub Actions by pinact

Run tfsec with reviewdog on pull requests to enforce security best practices

🐚 GitHub Action for running ShellCheck differentially

Runs Trivy as GitHub action to scan your Docker container image for vulnerabilities

Dependency-free preflight checks for repositories before making them public

⚙️ Scan your Go, Java, Kotlin, PHP, Python, JavaScript, TypeScript, .NET projects at GitHub with Qodana. This repository contains Qodana for Azure, GitHub, CircleCI and Gradle

Github Action for downloading provisioning profiles from Apple AppStore Connect

GitHub Action for Importing Code-signing Certificates into a Keychain

Load secrets from 1Password into your GitHub Actions jobs

Docker Scout GitHub Action

The blessed GitHub Action, for publishing your distribution files to PyPI, the tokenless way: https://github.com/marketplace/actions/pypi-publish

GitHub Action to check for vulnerabilities in your container image

Actions for running CodeQL analysis

A local-first repository health scanner with actionable scoring for open-source maintainers.

A set of GitHub actions for checking your projects for vulnerabilities.

Simple plug-and-play Github Action to block unauthorized outbound traffic (egress) in your Github workflows

Runtime Security Solution for your CI/CD Pipeline

🐸 Scans your Git repository with JFrog Xray & JFrog advanced security for security vulnerabilities. 🤖

A GitHub Action that simplifies using HashiCorp Vault™ secrets as build variables.

GitHub Actions CI/CD - Master Template & Reusable Workflows Library - Docker Builds, AWS, Python, Terraform, Jenkins, Linting, Security Scanning, Make Builds etc.

Install 1Password CLI into your GitHub Actions jobs.