A curated list of tools, research, incident write-ups and official guidance for securing and reviewing GitHub Actions workflows.
CI/CD pipelines run untrusted code, hold powerful credentials and publish software that thousands of projects depend on, which makes them a favorite target. The March 2025 compromise of a popular action exposed secrets from more than 23,000 repositories. This list collects what defenders, maintainers and bug bounty researchers need: scanners, pinning tools, hardening controls, attack research and the incidents that explain why they matter.
Beyond links, this repository ships practical guides:
- Tool comparison - What zizmor, poutine, actionlint and Scorecard each detect, where they disagree, and how to combine them.
- Attack patterns - The common workflow vulnerabilities, how to spot each one, and how to fix it.
- Hardening checklist - Controls to apply to repositories and organizations, in priority order.
- Incident response playbook - What to do in the first hours when an action or workflow you use may be compromised.
- Incident timeline - Major Actions supply chain incidents and what GitHub changed in response.
- Review workflow - How to audit a project's workflows safely, including for bug bounty programs.
- Quickstart - Install and first-run commands for the main tools.
- Secure workflow example - A hardened workflow template to adapt.
- Maintenance status - Last-activity snapshot of every GitHub project in the list, so you can judge which tools are still alive.
- Workflow Scanners and Linters
- Pinning and Dependency Management
- Runtime Hardening and Monitoring
- Secrets and Credentials
- Provenance, Signing and Policy
- Local Testing
- Attack Research and Training
- Official Guidance and Roadmap
- Incidents and Case Studies
- zizmor - Static analysis for GitHub Actions workflows that finds injection, permission and pinning problems.
- poutine - Security scanner for build pipelines that detects misconfigurations in GitHub Actions and other pipeline formats.
- actionlint - Static checker for workflow files that catches syntax and type errors and flags untrusted inputs used in scripts.
- Octoscan - Static vulnerability scanner for GitHub Actions workflows, from Synacktiv.
- Raven - Graph-based analyzer that stores workflows in Neo4j to find vulnerabilities across many repositories; low recent activity.
- Semgrep Rules - Community rules that include GitHub Actions checks such as shell injection.
- CodeQL - Semantic analysis engine whose supported languages include GitHub Actions workflows.
- OpenSSF Scorecard - Automated checks that include token permissions, pinned dependencies and dangerous workflow patterns.
- zizmor-action - Action that runs zizmor from a workflow; the maintainers say it is ready for public use but still in early development.
- Scorecard Action - Official GitHub Action that runs OpenSSF Scorecard checks on a repository and can publish the results.
- pinact - Pins actions and reusable workflows to full commit SHAs and keeps version comments up to date.
- ratchet - Pins and updates actions and container references across several CI systems.
- frizbee - Pins actions and container image references to checksums, from Stacklok.
- pin-github-action - Command line tool that pins action versions to commit SHAs and works in pre-commit hooks.
- Dependabot Core - Engine behind Dependabot, which can update pinned actions when set up for the github-actions ecosystem.
- Renovate - Automated dependency updater that supports GitHub Actions and digest pinning.
- Dependency Review Action - Fails pull requests that introduce vulnerable dependencies.
- Harden-Runner - Runtime security agent that monitors and restricts network and file activity on runners.
- Actions Permissions - GitHub Security Lab tool that helps find least-privilege GITHUB_TOKEN permissions for workflows.
- StepSecurity Secure Repo - Applies security best practices to workflows, such as pinning and token permissions.
- TruffleHog - Finds secrets in repositories and other sources, and can verify whether they are live; keep verification off unless you are allowed to test credentials.
- Gitleaks - Scans repositories and history for hardcoded secrets using configurable rules.
- attest-build-provenance - Official action for signed build provenance attestations; since version 4 it is a thin wrapper, and new workflows should use actions/attest.
- SLSA GitHub Generator - Generators that produce SLSA provenance for builds on GitHub-hosted runners; no longer actively maintained, and its maintainers suggest GitHub artifact attestations instead.
- Cosign - Signs and verifies container images and other artifacts.
- Allstar - GitHub app that continuously enforces security policies on repositories, such as branch protection.
- SLSA - Framework of supply chain security levels and requirements for build provenance.
- attest - Official action that generates attestations for workflow artifacts, and the base that the provenance and SBOM actions now wrap.
- Gitsign - Keyless Git commit signing with Sigstore, tied to your GitHub or OIDC identity.
- act - Runs workflows locally in containers, a safe way to experiment without touching a real repository.
- Gato-X - Enumeration and vulnerability-finding tool for GitHub Actions pipelines, for use only within authorized scope.
- GitHub Actions Goat - Intentionally vulnerable repository for learning about Actions attacks and runtime hardening.
- Top 10 CI/CD Security Risks - Write-up of the ten most critical CI/CD risks, with examples and mitigations.
- Preventing Pwn Requests - GitHub Security Lab article on the dangerous pull_request_target pattern.
- CI/CD Security Cheat Sheet - OWASP Cheat Sheet Series, which includes a CI/CD security cheat sheet among many others.
- Unpacking Security Scanners for GitHub Actions - Comparative study from Université de Montréal showing that workflow scanners cover different weaknesses and disagree on the same workflows.
- gha-hazmat - Collection of insecure and exploitable workflows and action definitions, each isolated, with Actions disabled so nothing runs.
- CI/CD Goat - Deliberately vulnerable CI/CD environment with capture-the-flag challenges, from Cider Security; low recent activity.
- Trajan - Praetorian scanner for CI/CD pipeline weaknesses on GitHub, GitLab and Azure DevOps that also automates attacks, so use it only inside authorized scope.
- Security Hardening for GitHub Actions - GitHub's guide, which states that pinning to a full-length commit SHA is the only way to use an action as an immutable release.
- Actions 2026 Security Roadmap - GitHub plan for workflow dependency locking, immutable releases, policy controls and an egress firewall for hosted runners.
- SHA Pinning Enforcement and Blocking - Changelog describing the policy that blocks specific actions and fails workflows that are not SHA pinned.
- Securely Using pull_request_target - GitHub guide for deciding whether a workflow needs that privileged event and how to use it safely.
- Secure Use Reference - GitHub reference of good practices, including patterns that mitigate script injection.
- tj-actions Advisory - GitHub advisory for the tj-actions/changed-files compromise, which affected more than 23,000 repositories.
- Unit 42 Analysis - Timeline of how a targeted attack on Coinbase expanded into the tj-actions and reviewdog incidents.
- Orca Hardening Guide - Walkthrough of the tj-actions chain in five steps, with matching hardening measures.
- Cycode Analysis - Comparison of documented Actions attacks that share the same pattern.
- 15 Security Pitfalls - Checklist of common mistakes mapped to real 2025 and 2026 campaigns.
- The Case for GitHub Actions Security - Datadog Security Labs article on pwn requests, script injection and compromised credentials after recent attacks.
- Static Analysis - Curated list of static analysis tools, linters and code quality checkers for many languages.
Contributions are welcome. Please read the contribution guidelines first.