SecureCI vs nektos/act: run GitHub Actions locally, and know they’re safe to ship

Q: Is SecureCI an alternative to nektos/act?

Yes. secureci run runs GitHub Actions workflows locally in containers, using the same runner images as act, and the same CLI also validates workflows against your pipeline standards, enforces SHA pinning and catches action supply-chain drift.

Q: Can I switch from act to SecureCI?

Yes. Most commands map directly: act -j build becomes secureci run wf.yml --job build, act -n becomes --dry-run, and -s becomes --secret. Jobs run in Linux containers with the same catthehacker/ubuntu images act uses.

Q: Can I run GitHub Actions locally with Podman?

Yes. SecureCI supports Podman natively with --container-runtime podman, and containerd via nerdctl. No socket configuration is needed.

Q: Can I test a workflow without running anything?

Yes. secureci run --dry-run shows what would run, and secureci validate checks syntax, expressions and your pipeline contract without executing any step.

Last reviewed: 24 October 2026

nektos/act made running GitHub Actions on your own machine popular. The SecureCI CLI does that too, and goes further: one command checks a workflow against your organisation’s pipeline standards, enforces SHA pinning and fails when an action tag quietly moves — before you push.

Short answer:

Run workflows locally in Docker, Podman or containerd, with dry runs, artifacts, cache and step summaries built in.
Validate before you push: required and forbidden actions, their order, minimum versions, SHA pinning and allowed owners, checked through composite actions and reusable workflows.
Catch supply-chain drift: secureci.lock records what every action tag resolves to, and CI fails when one moves.
CI-ready output: JSON and SARIF for GitHub code scanning.

At a glance

	nektos/act	SecureCI CLI
Validate against your pipeline standards	No	Yes `validate --contract`: required / forbidden actions, order, minimum versions
Enforce SHA pinning and allowed owners	No	Yes through composite actions and reusable workflows
Action lockfile: fail when a tag moves	No	Yes `secureci inventory --check`
Checks mapped to compliance controls (PCI DSS, DORA, ISO 27001…)	No	Partial published mapping; supports controls, doesn’t certify
SARIF / JSON output for code scanning	No `--json` is log output, not findings	Yes `--format sarif\|json`
Checks `if:` expressions before running	Not documented	Yes unknown functions and unavailable contexts fail up front
Podman and containerd	Partial via a Docker-API-compatible `DOCKER_HOST` socket	Yes built in: `--container-runtime podman\|containerd`
Artifacts	Partial server starts only with `--artifact-server-path`	Yes built-in local `upload-artifact` / `download-artifact`
`$GITHUB_STEP_SUMMARY`	No discarded	Yes printed at the end of each job
Job-level `continue-on-error`	No ignored	Yes
Run workflows locally in containers	Yes	Yes one container per job, never a silent fallback to your host
Dry run	Yes `-n`	Yes `run --dry-run`
`actions/cache`	Yes	Yes with GitHub’s key and `restore-keys` rules
Secret masking	Yes	Yes values never appear on the container command line
Runner images	`catthehacker/ubuntu:act-*` (Medium; Micro and Large images also offered)	The same images, mappable per `runs-on` label
Run a subset of matrix combinations	Yes `--matrix`	Yes `--matrix`
Load secrets / env / inputs from files	Yes `--secret-file`, `--env-file`, `--var-file`, `--input-file`	Yes `--secret-file`, `--env-file`, `--input-file`, `--var-file`
Install	Homebrew, Scoop, WinGet, Nix and more	`npm install -g @secureci/cli`, or a standalone binary for Linux, macOS and Windows

One CLI for running and checking workflows

act answers “does this workflow run?”. SecureCI answers that and the question platform teams care about next: “does it meet our standards, and is it running the code we reviewed?”

# Run it locally, like act
secureci run .github/workflows/ci.yml

# Fail if a deploy skips the security scan, runs it in the wrong order, or uses an unpinned action
secureci validate .github/workflows/deploy.yml --contract contracts/platform-standard.yml

# Record what every action tag resolves to, then fail CI when one moves
secureci inventory          # writes secureci.lock
secureci inventory --check  # in CI

The lockfile check targets the pattern behind the 2025 tj-actions/changed-files compromise, where existing tags were moved to malicious code. With SecureCI, that becomes a failing check instead of a silent compromise.

Closer to the real runner

Step summaries written to $GITHUB_STEP_SUMMARY are printed at the end of each job, and job-level continue-on-error behaves as on GitHub.
Artifacts and cache work out of the box: upload-artifact, download-artifact and actions/cache run locally with GitHub’s path and key rules, no extra server flags.
Invalid if: expressions, unknown functions and contexts used where GitHub doesn’t allow them fail before anything runs, just like on GitHub.
Any container engine: Docker, Podman or containerd (nerdctl), with service containers, health checks and per-job networks.
Safe by default: if the container runtime is missing, SecureCI stops. Running on your host is an explicit --container-runtime host opt-in that lists the remote actions first.

Switching from act

Most act commands have a direct equivalent:

You want to…	nektos/act	SecureCI CLI
Run a workflow	`act -W .github/workflows/ci.yml`	`secureci run .github/workflows/ci.yml`
Simulate without running	`act -n`	`secureci run … --dry-run`
Run one job	`act -j build`	`secureci run … --job build`
Pass a secret	`act -s TOKEN`	`secureci run … --secret TOKEN`
Set a repository variable	`act --var ENV=staging`	`secureci run … --var ENV=staging`
Simulate an event	`act pull_request -e event.json`	`secureci run … --event-name pull_request --event-path event.json`
Use Podman	`DOCKER_HOST=unix:///…/podman.sock act`	`secureci run … --container-runtime podman`

Try the SecureCI CLI

Free and open source (MIT). Needs Node.js 20+ and, to run workflows, Docker, Podman or containerd.

npm install -g @secureci/cli
secureci validate .github/workflows/ci.yml
secureci run .github/workflows/ci.yml --dry-run

Get it on npm → Read the CLI docs

Running GitHub Actions across many repositories? Get early access to org-wide SecureCI →

FAQ

Is SecureCI an alternative to nektos/act?

Yes. secureci run runs GitHub Actions workflows locally in containers, using the same runner images as act, and the same CLI also validates workflows against your pipeline standards, enforces SHA pinning and catches action supply-chain drift.

Can I switch from act to SecureCI?

Yes. Most commands map directly: act -j build becomes secureci run wf.yml --job build, act -n becomes --dry-run, and -s becomes --secret. Jobs run in Linux containers with the same catthehacker/ubuntu images act uses.

Can I run GitHub Actions locally with Podman?

Yes. SecureCI supports Podman natively with --container-runtime podman, and containerd via nerdctl. No socket configuration is needed.

Can I test a workflow without running anything?

Yes. secureci run --dry-run shows what would run, and secureci validate checks syntax, expressions and your pipeline contract without executing any step.

Is SecureCI free?

Yes. The SecureCI CLI is free and open source under the MIT license, for public and private repositories. An org-wide SecureCI platform for platform and security teams is in early access.

Sources

Competitor features change quickly. We checked these on 24 October 2026; if something here is out of date, email [email protected] and we'll fix it.