SecureCI maps every GitHub Actions workflow, reusable workflow and third-party action in your organisation, checks them against your pipeline standards, and alerts you when something drifts — like an action tag that suddenly points at different code.
For platform and security teams running GitHub Actions at scale — GitHub.com or GitHub Enterprise Server.
Your code stays yours: analysis runs in your own CI, powered by our open-source CLI. SecureCI only receives findings — never your source code.
Hundreds of repositories, thousands of workflows. Which ones deploy to production, which third-party actions they call — including inside reusable workflows and composite actions — is rarely written down anywhere.
Platform teams agree on a golden path — scan before deploy, approved actions only, pinned versions. Six months later, nobody can say which repositories still follow it.
In March 2025, tags of the widely used tj-actions/changed-files action were moved to malicious code that dumped CI secrets into build logs. Workflows that referenced it by tag silently ran it.
Every workflow, reusable workflow and action across your organisation — resolved through calls, not just what's written in each file — with where it runs and who owns it.
Define your golden path once — required steps, approved actions, minimum versions, the order things run in — and see every repository that meets it, and every one that doesn't.
Hear about it when an action tag starts pointing at new code, a new third-party action appears, pins are removed, or a repository falls out of your standards.
Install the SecureCI GitHub App with read-only access. Analysis runs in your own CI, and we guide you through onboarding.
Start from sensible defaults, then encode your own golden path for every team.
Get a live view of compliance across repositories and alerts the moment something changes.
Define the golden path once, and see which repositories follow it.
Know which third-party code runs in CI, and hear about it when it changes.
Evidence of CI controls for audits — supporting controls in PCI DSS, DORA, NIS2, ISO 27001 and SOC 2 — with analysis that stays in your infrastructure, including GitHub Enterprise Server. See the compliance mapping →
SecureCI gives platform and security teams an org-wide inventory of every GitHub Actions workflow, reusable workflow and third-party action, checks them against your pipeline standards, and alerts you when something drifts.
SecureCI secures your GitHub Actions workflows across every repository: it inventories every workflow and third-party action, checks them against the pipeline standards you define, and alerts you to supply-chain drift — such as an action tag that starts pointing at different code.
Analysis runs in your own CI using our open-source CLI. SecureCI receives only findings and metadata — never your source code — which also makes it a fit for regulated organisations.
Pipeline standards let you define a golden path once — required steps, approved actions, minimum versions and the order they run in — then see every repository that meets it and every one that doesn't.
SecureCI tracks what each action resolves to and alerts you when a tag starts pointing at new code, a new third-party action appears, or version pins are removed — the pattern behind the 2025 tj-actions/changed-files compromise.
Yes. SecureCI supports GitHub.com and GitHub Enterprise Server, with analysis that stays inside your own infrastructure.
It supports specific controls for your CI pipelines — for example PCI DSS 6.3.2 (an inventory of third-party components, via secureci.lock) and change control for workflows — and the evidence for them. It doesn't make you compliant on its own; your assessor decides. See the compliance mapping.
Yes. The SecureCI CLI (@secureci/cli) is free and MIT-licensed. Install it with npm install -g @secureci/cli or download a standalone binary for Linux, macOS or Windows. It is free for public and private repositories. See the CLI docs.
Yes. secureci run runs a workflow on your machine in Docker, Podman or containerd, one container per job, and secureci run --dry-run shows what would run. It is an alternative to nektos/act that also checks workflows against your pipeline standards.
Run secureci pin: it rewrites action tags to full commit SHAs in place and keeps the tag as a comment, so Dependabot and Renovate can still update them. secureci validate can then require SHA pinning in a pipeline contract.
Platform and DevEx teams, security and AppSec teams, and regulated organisations that run GitHub Actions across many repositories.
We're onboarding organisations in batches, starting with teams that run GitHub Actions across many repositories. Tell us about your setup and we'll get you started.