Repositories list

• create-pull-request

  Public

  step-security/create-pull-request’s past year of commit activity
  A GitHub action to create a pull request for changes to your repository in the actions workspace. Secure drop-in replacement for peter-evans/create-pull-request.

  step-security-maintained-actions

  0•0•0•1•Updated Jan 4, 2026Jan 4, 2026

• actions-oidc-debugger

  Public
  An Action for printing OIDC claims in GitHub Actions. Secure drop-in replacement for github/actions-oidc-debugger.

  step-security-maintained-actions

  Go

  •

  MIT License

  •1•0•1•7•Updated Jan 4, 2026Jan 4, 2026

• release-notes-generator-action

  Public
  Action to auto generate a release note based on your events. Secure drop-in replacement for Decathlon/release-notes-generator-action.

  step-security-maintained-actions

  Shell

  •

  Apache License 2.0

  •1•0•1•8•Updated Jan 4, 2026Jan 4, 2026

• create-or-update-comment

  Public

  step-security/create-or-update-comment’s past year of commit activity
  A GitHub action to create or update an issue or pull request comment. Secure drop-in replacement for peter-evans/create-or-update-comment.

  step-security-maintained-actions

  0•0•0•1•Updated Jan 4, 2026Jan 4, 2026

• setup-uv

  Public
  Set up your GitHub Actions workflow with a specific version of https://docs.astral.sh/uv/. Secure drop-in replacement for astral-sh/setup-uv.

  step-security-maintained-actions

  TypeScript

  •

  MIT License

  •1•0•0•14•Updated Jan 2, 2026Jan 2, 2026

• aqua-installer

  Public

  step-security/aqua-installer’s past year of commit activity
  Install aqua securely and quickly. Secure drop-in replacement for aquaproj/aqua-installer.

  step-security-maintained-actions

  Shell

  •

  MIT License

  •1•0•0•4•Updated Jan 2, 2026Jan 2, 2026

• r-lib-actions

  Public
  GitHub Actions for the R community. Secure drop-in replacement for r-lib/actions.

  step-security-maintained-actions

  TypeScript

  •

  Creative Commons Zero v1.0 Universal

  •1•0•1•34•Updated Jan 2, 2026Jan 2, 2026

• octocov-action

  Public
  GitHub Action for octocov. Secure drop-in replacement for k1LoW/octocov-action.

  step-security-maintained-actions

  MIT License

  •1•0•1•4•Updated Jan 2, 2026Jan 2, 2026

• get-secretmanager-secrets

  Public
  A GitHub Action for accessing secrets from Google Secret Manager and making them available as outputs. Secure drop-in replacement for google-github-actions/get-secretmanager-secrets.

  step-security-maintained-actions

  TypeScript

  •

  Apache License 2.0

  •1•0•1•9•Updated Jan 2, 2026Jan 2, 2026

• mozilla-sops-action

  Public
  GitHub Action for installing Sops. Secure drop-in replacement for mdgreenwald/mozilla-sops-action.

  step-security-maintained-actions

  TypeScript

  •

  MIT License

  •1•0•1•12•Updated Dec 31, 2025Dec 31, 2025

• fetch-gh-release-asset

  Public
  Github Action to download an asset from a Github release. Secure drop-in replacement for dsaltares/fetch-gh-release-asset.

  step-security-maintained-actions

  TypeScript

  •

  MIT License

  •1•0•1•9•Updated Dec 31, 2025Dec 31, 2025

• gh-setup

  Public
  Setup asset of Github releases. Secure drop-in replacement for k1LoW/gh-setup.

  step-security-maintained-actions

  Go

  •

  MIT License

  •1•0•1•4•Updated Dec 31, 2025Dec 31, 2025

• action-download-artifact

  Public
  ⚙️ A GitHub Action to download an artifact associated with given workflow and commit or other criteria. Secure drop-in replacement for dawidd6/action-download-artifact.

  step-security-maintained-actions

  JavaScript

  •

  MIT License

  •1•0•1•5•Updated Dec 30, 2025Dec 30, 2025

• action-golangci-lint

  Public
  Run golangci-lint with reviewdog. Secure drop-in replacement for reviewdog/action-golangci-lint.

  step-security-maintained-actions

  TypeScript

  •

  MIT License

  •1•0•1•10•Updated Dec 30, 2025Dec 30, 2025

• secure-repo

  Public

  step-security/secure-repo’s past year of commit activity
  Orchestrate GitHub Actions Security

  githubgolangsecurity+ 5workflowactionssecurity-toolsgithub-actionssupply-chain-security

  Go

  •

  GNU Affero General Public License v3.0

  •50•303•71•491•Updated Dec 30, 2025Dec 30, 2025

• action-markdownlint

  Public
  Run markdownlint with reviewdog. Secure drop-in replacement for reviewdog/action-markdownlint.

  step-security-maintained-actions

  Shell

  •

  MIT License

  •2•0•1•7•Updated Dec 30, 2025Dec 30, 2025

• setup-buildx-action

  Public
  GitHub Action to set up Docker Buildx. Secure drop-in replacement for docker/setup-buildx-action.

  step-security-maintained-actions

  TypeScript

  •

  Apache License 2.0

  •1•0•1•9•Updated Dec 29, 2025Dec 29, 2025

• jest-coverage-action-demo

  Public
  Go

  •

  MIT License

  •0•0•10•90•Updated Dec 29, 2025Dec 29, 2025

• setup-applanga-cli

  Public
  Secure drop-in replacement for applanga/setup-applanga-cli.

  step-security-maintained-actions

  JavaScript

  •

  MIT License

  •1•0•1•10•Updated Dec 29, 2025Dec 29, 2025

• git-auto-commit-action

  Public
  Automatically commit and push changed files back to GitHub with this GitHub Action for the 80% use case. Secure drop-in replacement for stefanzweifel/git-auto-commit-action.

  step-security-maintained-actions

  Shell

  •

  MIT License

  •1•1•1•9•Updated Dec 29, 2025Dec 29, 2025

• vitest-coverage-report-action

  Public
  A GitHub Action to report vitest test coverage results. Secure drop-in replacement for davelosert/vitest-coverage-report-action.

  step-security-maintained-actions

  TypeScript

  •

  MIT License

  •1•0•1•11•Updated Dec 29, 2025Dec 29, 2025

• action-actionlint

  Public
  run actionlint with reviewdog. Secure drop-in replacement for reviewdog/action-actionlint.

  step-security-maintained-actions

  Dockerfile

  •

  MIT License

  •1•1•1•8•Updated Dec 29, 2025Dec 29, 2025

• proof-html

  Public
  A GitHub Action to validate HTML, check links, and more ✅. Secure drop-in replacement for anishathalye/proof-html.

  step-security-maintained-actions

  Ruby

  •

  MIT License

  •1•0•1•5•Updated Dec 29, 2025Dec 29, 2025

• ghcommit-action

  Public

  step-security/ghcommit-action’s past year of commit activity
  GitHub Action to commit files to a git branch using the ghcommit utility. Secure drop-in replacement for planetscale/ghcommit-action.

  step-security-maintained-actions

  Shell

  •

  Apache License 2.0

  •1•0•1•8•Updated Dec 29, 2025Dec 29, 2025

• setup-vals

  Public
  Github Action for installing vals (https://github.com/helmfile/vals). Secure drop-in replacement for jkroepke/setup-vals.

  step-security-maintained-actions

  TypeScript

  •

  MIT License

  •1•0•1•14•Updated Dec 29, 2025Dec 29, 2025

• dispatch-workflow

  Public
  A GitHub Action to Dispatch and Discover GitHub Workflows using workflow_dispatch or repository_dispatch. Secure drop-in replacement for lasith-kg/dispatch-workflow.

  step-security-maintained-actions

  TypeScript

  •

  MIT License

  •1•0•1•11•Updated Dec 29, 2025Dec 29, 2025

• hide-comment-action

  Public
  Action to hide (minimize) comments in pull request. Secure drop-in replacement for int128/hide-comment-action.

  step-security-maintained-actions

  TypeScript

  •

  Apache License 2.0

  •1•0•1•12•Updated Dec 29, 2025Dec 29, 2025

• ssh-key-action

  Public
  GitHub Action that installs SSH key to .ssh. Secure drop-in replacement for shimataro/ssh-key-action.

  step-security-maintained-actions

  TypeScript

  •

  MIT License

  •1•1•1•13•Updated Dec 29, 2025Dec 29, 2025

• ghaction-setup-containerd

  Public
  GitHub Action to set up containerd. Secure drop-in replacement for crazy-max/ghaction-setup-containerd.

  step-security-maintained-actions

  TypeScript

  •

  MIT License

  •1•0•1•12•Updated Dec 29, 2025Dec 29, 2025

• prisma-cloud-scan

  Public
  GitHub action to scan container images with Palo Alto Networks' Prisma Cloud. Secure drop-in replacement for PaloAltoNetworks/prisma-cloud-scan.

  step-security-maintained-actions

  JavaScript

  •

  Apache License 2.0

  •1•0•1•10•Updated Dec 29, 2025Dec 29, 2025