Repositories list

• docker-build-push-action

  Public

  step-security/docker-build-push-action’s past year of commit activity
  GitHub Action to build and push Docker images with Buildx. Secure drop-in replacement for docker/build-push-action.

  step-security-maintained-actions

  TypeScript

  •

  Apache License 2.0

  •1•0•0•10•Updated Jan 6, 2026Jan 6, 2026

• dependabot-fetch-metadata

  Public
  Extract information about the dependencies being updated by a Dependabot-generated PR. Secure drop-in replacement for dependabot/fetch-metadata.

  step-security-maintained-actions

  0•0•0•0•Updated Jan 6, 2026Jan 6, 2026

• google-github-auth

  Public
  A GitHub Action for authenticating to Google Cloud. Secure drop-in replacement for google-github-actions/auth.

  step-security-maintained-actions

  TypeScript

  •

  Apache License 2.0

  •1•0•2•6•Updated Jan 6, 2026Jan 6, 2026

• upload-cloud-storage

  Public
  A GitHub Action for uploading files to a Google Cloud Storage (GCS) bucket. Secure drop-in replacement for google-github-actions/upload-cloud-storage.

  step-security-maintained-actions

  TypeScript

  •

  Apache License 2.0

  •1•0•0•9•Updated Jan 6, 2026Jan 6, 2026

• create-pull-request

  Public

  step-security/create-pull-request’s past year of commit activity
  A GitHub action to create a pull request for changes to your repository in the actions workspace. Secure drop-in replacement for peter-evans/create-pull-request.

  step-security-maintained-actions

  TypeScript

  •

  MIT License

  •1•0•0•9•Updated Jan 6, 2026Jan 6, 2026

• create-or-update-comment

  Public
  A GitHub action to create or update an issue or pull request comment. Secure drop-in replacement for peter-evans/create-or-update-comment.

  step-security-maintained-actions

  TypeScript

  •

  MIT License

  •1•0•0•9•Updated Jan 6, 2026Jan 6, 2026

• setup-uv

  Public
  Set up your GitHub Actions workflow with a specific version of https://docs.astral.sh/uv/. Secure drop-in replacement for astral-sh/setup-uv.

  step-security-maintained-actions

  TypeScript

  •

  MIT License

  •1•0•1•14•Updated Jan 6, 2026Jan 6, 2026

• changed-files

  Public
  Github action to retrieve all (added, copied, modified, deleted, renamed, type changed, unmerged, unknown) files and directories. Secure drop-in replacement for tj-actions/changed-files.

  step-security-maintained-actions

  TypeScript

  •

  MIT License

  •6•77•2•23•Updated Jan 6, 2026Jan 6, 2026

• action-send-mail

  Public
  A GitHub Action to send an email to multiple recipients. Secure drop-in replacement for dawidd6/action-send-mail.

  step-security-maintained-actions

  JavaScript

  •

  MIT License

  •1•0•1•14•Updated Jan 6, 2026Jan 6, 2026

• vitest-coverage-report-action

  Public
  A GitHub Action to report vitest test coverage results. Secure drop-in replacement for davelosert/vitest-coverage-report-action.

  step-security-maintained-actions

  TypeScript

  •

  MIT License

  •1•0•1•11•Updated Jan 5, 2026Jan 5, 2026

• release-notes-generator-action

  Public
  Action to auto generate a release note based on your events. Secure drop-in replacement for Decathlon/release-notes-generator-action.

  step-security-maintained-actions

  Shell

  •

  Apache License 2.0

  •1•0•1•7•Updated Jan 5, 2026Jan 5, 2026

• actions-oidc-debugger

  Public

  step-security/actions-oidc-debugger’s past year of commit activity
  An Action for printing OIDC claims in GitHub Actions. Secure drop-in replacement for github/actions-oidc-debugger.

  step-security-maintained-actions

  Go

  •

  MIT License

  •1•0•1•6•Updated Jan 5, 2026Jan 5, 2026

• aqua-installer

  Public
  Install aqua securely and quickly. Secure drop-in replacement for aquaproj/aqua-installer.

  step-security-maintained-actions

  Shell

  •

  MIT License

  •1•0•1•4•Updated Jan 5, 2026Jan 5, 2026

• action-download-artifact

  Public

  step-security/action-download-artifact’s past year of commit activity
  ⚙️ A GitHub Action to download an artifact associated with given workflow and commit or other criteria. Secure drop-in replacement for dawidd6/action-download-artifact.

  step-security-maintained-actions

  JavaScript

  •

  MIT License

  •1•0•1•5•Updated Jan 5, 2026Jan 5, 2026

• docs-as-code-confluence

  Public
  Publish the content of a folder to confluence Github Action. Secure drop-in replacement for Bhacaz/docs-as-code-confluence.

  step-security-maintained-actions

  JavaScript

  •

  MIT License

  •1•0•1•14•Updated Jan 5, 2026Jan 5, 2026

• fetch-gh-release-asset

  Public
  Github Action to download an asset from a Github release. Secure drop-in replacement for dsaltares/fetch-gh-release-asset.

  step-security-maintained-actions

  TypeScript

  •

  MIT License

  •1•0•1•9•Updated Jan 5, 2026Jan 5, 2026

• dispatch-workflow

  Public

  step-security/dispatch-workflow’s past year of commit activity
  A GitHub Action to Dispatch and Discover GitHub Workflows using workflow_dispatch or repository_dispatch. Secure drop-in replacement for lasith-kg/dispatch-workflow.

  step-security-maintained-actions

  TypeScript

  •

  MIT License

  •1•0•1•11•Updated Jan 5, 2026Jan 5, 2026

• git-auto-commit-action

  Public
  Automatically commit and push changed files back to GitHub with this GitHub Action for the 80% use case. Secure drop-in replacement for stefanzweifel/git-auto-commit-action.

  step-security-maintained-actions

  Shell

  •

  MIT License

  •1•1•1•9•Updated Jan 5, 2026Jan 5, 2026

• hide-comment-action

  Public
  Action to hide (minimize) comments in pull request. Secure drop-in replacement for int128/hide-comment-action.

  step-security-maintained-actions

  TypeScript

  •

  Apache License 2.0

  •1•0•1•12•Updated Jan 5, 2026Jan 5, 2026

• r-lib-actions

  Public
  GitHub Actions for the R community. Secure drop-in replacement for r-lib/actions.

  step-security-maintained-actions

  TypeScript

  •

  Creative Commons Zero v1.0 Universal

  •1•0•1•34•Updated Jan 5, 2026Jan 5, 2026

• setup-protoc

  Public
  GitHub Action to setup the protoc compiler for protocol buffers. Secure drop-in replacement for arduino/setup-protoc.

  step-security-maintained-actions

  TypeScript

  •

  GNU General Public License v3.0

  •1•0•1•11•Updated Jan 5, 2026Jan 5, 2026

• ghaction-setup-containerd

  Public

  step-security/ghaction-setup-containerd’s past year of commit activity
  GitHub Action to set up containerd. Secure drop-in replacement for crazy-max/ghaction-setup-containerd.

  step-security-maintained-actions

  TypeScript

  •

  MIT License

  •1•0•1•13•Updated Jan 5, 2026Jan 5, 2026

• setup-vals

  Public
  Github Action for installing vals (https://github.com/helmfile/vals). Secure drop-in replacement for jkroepke/setup-vals.

  step-security-maintained-actions

  TypeScript

  •

  MIT License

  •1•0•1•14•Updated Jan 5, 2026Jan 5, 2026

• get-secretmanager-secrets

  Public

  step-security/get-secretmanager-secrets’s past year of commit activity
  A GitHub Action for accessing secrets from Google Secret Manager and making them available as outputs. Secure drop-in replacement for google-github-actions/get-secretmanager-secrets.

  step-security-maintained-actions

  TypeScript

  •

  Apache License 2.0

  •1•0•1•9•Updated Jan 5, 2026Jan 5, 2026

• setup-buildx-action

  Public
  GitHub Action to set up Docker Buildx. Secure drop-in replacement for docker/setup-buildx-action.

  step-security-maintained-actions

  TypeScript

  •

  Apache License 2.0

  •1•0•1•9•Updated Jan 5, 2026Jan 5, 2026

• octocov-action

  Public
  GitHub Action for octocov. Secure drop-in replacement for k1LoW/octocov-action.

  step-security-maintained-actions

  MIT License

  •1•0•1•4•Updated Jan 2, 2026Jan 2, 2026

• mozilla-sops-action

  Public

  step-security/mozilla-sops-action’s past year of commit activity
  GitHub Action for installing Sops. Secure drop-in replacement for mdgreenwald/mozilla-sops-action.

  step-security-maintained-actions

  TypeScript

  •

  MIT License

  •1•0•1•12•Updated Dec 31, 2025Dec 31, 2025

• gh-setup

  Public
  Setup asset of Github releases. Secure drop-in replacement for k1LoW/gh-setup.

  step-security-maintained-actions

  Go

  •

  MIT License

  •1•0•1•4•Updated Dec 31, 2025Dec 31, 2025

• action-golangci-lint

  Public
  Run golangci-lint with reviewdog. Secure drop-in replacement for reviewdog/action-golangci-lint.

  step-security-maintained-actions

  TypeScript

  •

  MIT License

  •1•0•1•10•Updated Dec 30, 2025Dec 30, 2025

• secure-repo

  Public

  step-security/secure-repo’s past year of commit activity
  Orchestrate GitHub Actions Security

  githubgolangsecurity+ 5workflowactionssecurity-toolsgithub-actionssupply-chain-security

  Go

  •

  GNU Affero General Public License v3.0

  •50•303•71•491•Updated Dec 30, 2025Dec 30, 2025