Skip to content
@step-security

StepSecurity

Secure your GitHub Actions with StepSecurity: Your Trusted CI/CD Security Partner
README.md

Step Security Logo

Close the CI/CD Security Gap

Pinned Loading

  1. harden-runner harden-runner Public

    Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in re…

    TypeScript 1.3k 117

  2. dev-machine-guard dev-machine-guard Public

    Scan your dev machine for AI agents, MCP servers, IDE extensions, and suspicious packages - in seconds.

    Go 187 23

  3. secure-repo secure-repo Public

    Orchestrate GitHub Actions Security

    Go 332 54

  4. github-actions-goat github-actions-goat Public

    GitHub Actions Goat: Deliberately Vulnerable GitHub Actions CI/CD Environment

    JavaScript 521 347

Repositories

Showing 10 of 645 repositories
  • spellcheck-github-actions Public

    Spell check action. Secure drop-in replacement for rojopolis/spellcheck-github-actions.

    step-security/spellcheck-github-actions's past year of commit activity
    Shell 0 MIT 1 1 7 Updated Oct 12, 2026
  • setup-tflint Public

    A GitHub action that installs Terraform linter TFLint. Secure drop-in replacement for terraform-linters/setup-tflint.

    step-security/setup-tflint's past year of commit activity
    JavaScript 0 MIT 1 1 10 Updated Oct 12, 2026
  • github-action-benchmark Public

    GitHub Action for continuous benchmarking to keep performance. Secure drop-in replacement for benchmark-action/github-action-benchmark.

    step-security/github-action-benchmark's past year of commit activity
    TypeScript 0 MIT 1 1 24 Updated Oct 12, 2026
  • action-android-lint Public

    GitHub Action for Android Lint. Secure drop-in replacement for yutailang0119/action-android-lint.

    step-security/action-android-lint's past year of commit activity
    TypeScript 0 MIT 1 1 12 Updated Oct 12, 2026
  • label-sync Public

    :octocat: An action that allows you to sync labels from a repository or a config file. Secure drop-in replacement for EndBug/label-sync.

    step-security/label-sync's past year of commit activity
    TypeScript 0 MIT 1 1 10 Updated Oct 12, 2026
  • fossa-action Public

    Find license compliance and security issues in your applications with FOSSA and GitHub Actions. Secure drop-in replacement for fossas/fossa-action.

    step-security/fossa-action's past year of commit activity
    TypeScript 0 MPL-2.0 1 1 11 Updated Oct 12, 2026
  • get-cmake Public

    Install and Cache latest CMake and Ninja for your workflows on your GitHub. Secure drop-in replacement for lukka/get-cmake.

    step-security/get-cmake's past year of commit activity
    TypeScript 0 MIT 1 1 20 Updated Oct 12, 2026
  • gh-action-bump-version Public

    GitHub Action for automated npm version bump. Secure drop-in replacement for phips28/gh-action-bump-version.

    step-security/gh-action-bump-version's past year of commit activity
    JavaScript 0 MIT 1 1 10 Updated Oct 12, 2026
  • renovatebot-github-action Public

    Secure drop-in replacement for renovatebot/github-action.

    step-security/renovatebot-github-action's past year of commit activity
    TypeScript 0 AGPL-3.0 1 1 12 Updated Oct 12, 2026
  • pypa-hatch Public

    Modern, extensible Python project management. Secure drop-in replacement for pypa/hatch.

    step-security/pypa-hatch's past year of commit activity
    Shell 0 MIT 1 1 4 Updated Oct 12, 2026
View all repositories