Actions inventory
A complete audit of every GitHub Action used across your workflows — categories, SHA pinning, outdated versions, and co-occurrence.
/actions catalogs every uses: step running in your organization's workflows — the supply-chain view of your CI/CD.
Categories
| Category | What it covers |
|---|---|
| Official | actions/* and github/* — GitHub's own actions |
| Third-party | Vendor and community actions (aws-actions/*, docker/*, snyk/*, …) |
| Local | Composite actions inside your repos (./.github/actions/...) |
Security & pinning audit
- Floating tags — actions pinned to
@v1,@main, or@latestinstead of an immutable commit SHA. Floating tags can silently change what your pipeline executes. - Outdated versions — actions lagging behind current releases, a proxy for stale dependencies.
Usage matrix & co-occurrence
Popularity rankings (which actions run most, and where) and co-occurrence analysis — useful for planning migrations like "move every repo off actions/setup-node@v2 at once".
Next step
Turn findings into enforcement: the security policies engine can require pinned or specific actions org-wide.
Auto-retry
Guardrailed automatic retries for transient CI/CD failures — rules scoped by repository, workflow, branch, and job, with backoff and a full audit log.
Security policies
Organization-wide rules checked against every workflow file — runtime versions, timeouts, required actions, approval gates, and runner restrictions.