Observed arrival · 2026-11-14
SecureCI’s GitHub Actions supply-chain assessment
SecureCI’s open-source CLI inventories GitHub Actions workflows across repositories and reports supply-chain and policy findings.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- Platform and security teams managing many GitHub Actions repositories
- Worth noticing
- The sample report traces unpinned actions in a shared reusable workflow to 112 repositories; its figures are explicitly fictional.
Field notes
The report groups findings by repository and includes a CSV; examples cover missing commit-SHA pins, known advisories, token permissions, and pull_request_target workflows that check out pull-request code. The page says analysis runs in the customer’s own CI and source code stays in its infrastructure, and links to CLI documentation, npm, and GitHub.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
✦PrettyNotable craft visible
●ProPolished or operationally mature
◎NicheUnusually specific use
One card from the complete issue