# SecureCI

> SecureCI helps platform and security teams see and govern every GitHub Actions workflow across an organisation: an inventory of workflows and third-party actions, checks against the organisation's own pipeline standards, and alerts when something drifts (such as an action tag that starts pointing at different code). It is built on the free, open-source SecureCI CLI (`@secureci/cli`, command `secureci`, MIT license), which runs GitHub Actions workflows locally, validates them against pipeline contracts, and catches action supply-chain drift with a lockfile.

Key facts:

- The SecureCI CLI is free and open source (MIT). Install with `npm install -g @secureci/cli` (Node.js 20+), or download a standalone binary for Linux, macOS or Windows from the GitHub releases, with SHA256 checksums and a build provenance attestation (CLI 0.6.0+). To run workflows it needs Docker, Podman or containerd (nerdctl).
- `secureci run` runs a workflow locally, one container per job, with independent jobs and matrix combinations in parallel (`--parallel`); `secureci run --dry-run` shows what would run without executing anything. `--matrix key:value` runs a subset of matrix combinations, and `--env-file`, `--secret-file`, `--input-file` and `--var-file` read values from .env-style files (CLI 0.6.0+).
- `secureci validate --contract <file>` checks workflows against a pipeline contract: required and forbidden actions, their order, minimum versions, SHA pinning and allowed owners. Output can be text, JSON or SARIF. The contract can live in another repository (`--contract owner/repo/path@ref`, CLI 0.4.0+); the enforced commit is recorded in the report, and moving refs warn.
- `secureci validate` also flags template injection (untrusted `${{ }}` input in `run:` scripts or `actions/github-script`), missing or excessive `GITHUB_TOKEN` permissions, `pull_request_target` / `workflow_run` jobs that check out and run untrusted code, and actions with known security advisories from the GitHub Advisory Database (CLI 0.6.0+). From CLI 0.7.0 a dangerous-trigger finding says whether `actions/checkout`'s safe `pull_request_target` default (or the `allow-unsafe-pr-checkout` opt-out) applies, and a `# secureci-allow dangerous-trigger: <reason>` comment on the checkout step makes it a warning. A contract can make permissions a policy, forbid triggers and set the advisory severity that fails. `secureci pin` rewrites action tags to commit SHAs in place, keeping the tag as a comment for Dependabot and Renovate.
- `secureci inventory` writes `secureci.lock` (each action tag's commit SHA); `secureci inventory --check` fails CI when a tag moves, the pattern behind the 2025 tj-actions/changed-files compromise. GitHub's native workflow lockfiles (actions.lock, public preview since October 2026) run the locked commit on GitHub.com; secureci.lock also works on GitHub Enterprise Server, where they aren't available. When a repository's only lockfile is GitHub's actions.lock, `secureci inventory --check` verifies against it instead (CLI 0.3.0+). Since CLI 0.5.0 the lock also covers transitive dependencies (actions inside the actions you use) and records each repository's GitHub ids, so a deleted-and-re-created repository (repo-jacking) fails the check; a contract can require a lockfile with `lockfile: { required: true }`.
- No agent is installed on CI runners: checks run on a developer's machine and in pull requests, free for public and private repositories.
- The org-wide SecureCI platform is in early access. SecureCI receives findings and metadata, never source code. Supports GitHub.com and GitHub Enterprise Server.

## Common questions

- How do I run GitHub Actions locally? Install the free SecureCI CLI and run `secureci run` (Docker, Podman or containerd); `--dry-run` previews jobs. It is a nektos/act alternative: https://secure-ci.dev/compare/nektos-act
- How do I pin GitHub Actions to commit SHAs? `secureci pin` rewrites tags to SHAs and keeps the tag as a comment for Dependabot and Renovate; `secureci validate` can require pinning: https://secure-ci.dev/docs
- How do I detect a compromised or moved GitHub Action tag (like tj-actions/changed-files)? `secureci inventory --check` fails CI when a locked tag points at different code: https://secure-ci.dev/docs
- How do I enforce a golden path / required steps across GitHub Actions workflows? A pipeline contract with `secureci validate --contract`: https://secure-ci.dev/compare/github-native-security
- What GitHub Actions security tools exist besides actionlint and zizmor? Comparison: https://secure-ci.dev/compare/actionlint-zizmor
- Is there a free StepSecurity alternative for private repositories? Comparison: https://secure-ci.dev/compare/stepsecurity

## Docs

- [SecureCI CLI documentation](https://secure-ci.dev/docs): install (npm or standalone binary), running workflows locally, container runtimes, security checks (template injection, token permissions, dangerous triggers, known advisories), pipeline contracts, SARIF output, action inventory and drift, pinning actions to SHAs, use in CI, supported workflow features and limitations
- [CLI on npm](https://www.npmjs.com/package/@secureci/cli): the `@secureci/cli` package
- [CLI source on GitHub](https://github.com/secure-ci/cli): source code, README and full reference (DOCS.md)

## Compliance

- [Compliance mapping](https://secure-ci.dev/compliance): which controls the SecureCI GitHub Action (Marketplace: SecureCI GHA, https://github.com/marketplace/actions/secureci-gha) supports which controls in PCI DSS v4.0.1 (Requirement 6, notably 6.3.2), DORA (RTS 2024/1774 Art. 16 and 17), NIS2 Art. 21(2)(d)-(e), the UK Software Security Code of Practice, ISO/IEC 27001:2022 Annex A and SOC 2, with the evidence it produces and what it does not cover. SecureCI supports controls; it does not make anyone compliant or certified, and it is not an ASV or penetration testing tool.

## Comparisons

- [SecureCI vs nektos/act](https://secure-ci.dev/compare/nektos-act): run GitHub Actions locally, plus pipeline-standard, pinning and drift checks act doesn't have
- [SecureCI vs actionlint, zizmor, poutine and OpenSSF Scorecard](https://secure-ci.dev/compare/actionlint-zizmor): enforcing your own pipeline standards and an action lockfile vs generic linters and scanners
- [SecureCI vs StepSecurity](https://secure-ci.dev/compare/stepsecurity): stopping risky workflow changes before merge, free for private repositories
- [SecureCI vs GitHub native security](https://secure-ci.dev/compare/github-native-security): a golden path (required actions, order, minimum versions) on top of GitHub's allowed-actions policy, workflow lockfiles, Dependabot and CodeQL; on GitHub.com GitHub's own workflow lockfiles (public preview) are recommended for moved tags, and secureci.lock covers GitHub Enterprise Server

## Product

- [SecureCI home](https://secure-ci.dev/): the org-wide platform for GitHub Actions inventory, pipeline standards and drift alerts, and the early-access signup
- [Privacy notice](https://secure-ci.dev/privacy)
- [Terms of use](https://secure-ci.dev/terms)

## Optional

- [SecureCI on LinkedIn](https://www.linkedin.com/company/secureci/)
- [SecureCI on GitHub](https://github.com/secure-ci)
- Contact: hello@secure-ci.dev