Tools
pinact
suzuki-shunsuke/pinact
pinact is a CLI that pins GitHub Actions and reusable workflows to full commit SHAs, updates their versions, and verifies version comments to harden CI supply-chain security.
Topics
Related projects
zizmor6.9kzizmor is a static analysis tool for CI/CD configurations such as GitHub Actions, detecting template injection, credential leakage, excessive permissions, and other security issues.
wrkflw3.3kwrkflw validates and runs GitHub Actions and GitLab CI workflows locally, supporting Docker, Podman, Kubernetes, sandboxed emulation, a TUI, and an optional MCP server.
landrun2.3kLandrun is a lightweight CLI sandbox that uses Linux Landlock to run arbitrary processes with fine-grained filesystem and network restrictions.
aqua1.9kaqua is a declarative CLI version manager written in Go. It pins tool versions per project, installs lazily from a registry, and supports continuous updates via Renovate.
trivy-action1.5kTrivy Action wraps the Trivy scanner as a GitHub Action so CI pipelines can scan container images, filesystems and infrastructure-as-code for vulnerabilities and upload SARIF reports.
auth1.4kThis GitHub Action authenticates workflows to Google Cloud using Workload Identity Federation or service account keys, simplifying secure CI/CD access.