step-security/harden-runner

CI/CD Security Analyzer

Static analysis for GitHub Actions (and more)

Plumber detects CI/CD security issues in your GitHub workflows and gives you a score

poutine, a supply chain vulnerability scanner for build pipelines

GitHub Actions Goat: Deliberately Vulnerable GitHub Actions CI/CD Environment

GitHub Attack Toolkit - Extreme Edition - A static analysis and exploit toolkit for GitHub Actions.

The Runner for GitHub Actions 🚀

📚 A curated list of awesome CI CD security resources

A curated list of awesome self-hosted GitHub Action runners in a large comparison matrix