SecureCI vs StepSecurity: stop risky workflow changes before they merge

Last reviewed: 24 October 2026

StepSecurity focuses on watching jobs while they run. The SecureCI CLI stops problems earlier: it checks every workflow against your standards, locks the actions you use and runs workflows locally, on a developer’s laptop or in a pull request, for every repository, at no cost.

Short answer:

Prevention before merge: required actions, their order, minimum versions, SHA pinning and allowed owners, checked on every pull request.
Drift caught early: secureci.lock fails CI as soon as an action tag moves, before the new code ever runs.
Free everywhere: public and private repositories, GitHub.com and GitHub Enterprise Server, any runner. No agent to install on runners.
Developer-friendly: the same checks run locally, and secureci run executes the workflow before you push.

At a glance

	StepSecurity	SecureCI CLI
Free for private repositories	No Enterprise (paid) tier	Yes MIT open source
Free on self-hosted runners	No Enterprise (paid) tier	Yes nothing to install on runners
Runs on a developer’s machine before push	No	Yes
Required actions, their order and minimum versions	Not documented	Yes `validate --contract`
Fail a pull request when an action tag moves	Partial blocks workflow runs that use known-compromised actions (Enterprise)	Yes `secureci inventory --check`
Checks mapped to compliance controls (PCI DSS, DORA, ISO 27001…)	Partial runtime controls (runner audit logs, egress policy) aligned with PCI DSS, SOC 2 and ISO 27001	Partial published mapping; supports controls, doesn’t certify
Run workflows locally	No	Yes
Enforce SHA pinning	Yes	Yes with per-owner exceptions
Third-party action inventory	Yes Enterprise	Yes per repository; org-wide in the SecureCI platform
Automatic pinning fixes	Yes Secure Workflow	Yes `secureci pin`, keeping the tag as a comment

Prevention beats detection

Runtime monitoring tells you something bad happened during a build. SecureCI makes sure the risky change never merges: a deploy that skips the required security scan, an action pulled from an unapproved owner, an unpinned tag, or a tag that has started pointing at different code. Those checks run in seconds, on a laptop or in a pull request, before a runner ever starts.

Catching a moved tag before it runs

secureci inventory          # first run writes secureci.lock with each tag's commit SHA
git add secureci.lock
secureci inventory --check  # in CI: fails if any tag now resolves to a different commit

If a tag is moved, as in the 2025 tj-actions/changed-files incident, the next pull request fails with the exact action and old and new commits, before the new code executes anywhere.

Your standards, in a few lines of YAML

required:
  - uses: org/security-scan
    min-version: v1.2.0
  - uses: org/deploy          # must run after security-scan
pins:
  required: true
allowed-owners: [actions, my-org]

SecureCI checks this through composite actions and reusable workflows, so wrapping an action never hides it, and reports violations as SARIF in GitHub code scanning.

Already using Harden-Runner?

SecureCI works alongside it. Harden-Runner watches the runner, and SecureCI keeps risky workflow changes from merging in the first place.

Try the SecureCI CLI

Free and open source (MIT). Needs Node.js 20+ and, to run workflows, Docker, Podman or containerd.

npm install -g @secureci/cli
secureci validate .github/workflows/ci.yml
secureci run .github/workflows/ci.yml --dry-run

Get it on npm → Read the CLI docs

Running GitHub Actions across many repositories? Get early access to org-wide SecureCI →

FAQ

Is SecureCI an alternative to StepSecurity?

For preventing risky GitHub Actions changes, yes. SecureCI enforces your pipeline standards, SHA pinning and allowed owners, and fails CI when an action tag moves, before anything runs. It is free for public and private repositories and needs no agent on your runners.

Is the SecureCI CLI free for private repositories?

Yes. The CLI is MIT-licensed and free on any repository, public or private, on GitHub.com and GitHub Enterprise Server, with any runner.

How can I stop a compromised GitHub Action like tj-actions/changed-files?

Pin actions to commit SHAs and record what each tag resolves to, so a moved tag fails CI before it runs. SecureCI does both: pins.required in a contract and secureci inventory --check with a committed secureci.lock.

Does SecureCI need anything installed on CI runners?

No. SecureCI is a CLI and a GitHub Action that analyses workflow files. Nothing is installed on or monitors your runners.

Do StepSecurity and SecureCI help with compliance?

Both, at different points. StepSecurity positions its runtime controls, such as runner audit logs and egress policy, as aligned with PCI DSS, SOC 2 and ISO 27001. SecureCI supports pre-merge controls, such as a PCI DSS 6.3.2 inventory of third-party actions and change control for workflows. Neither makes you compliant on its own. See the compliance mapping.

Sources

Competitor features change quickly. We checked these on 24 October 2026; if something here is out of date, email [email protected] and we'll fix it.