Tools
Things I build when the tooling that already exists does not do the job.
ActChain
Scans the actions your GitHub Actions use, and the actions those use, all the way down. Then locks down what's clean.
- Maps the full chain. Every action your workflows use, and every action those use, recursively. Then zizmor and opengrep on each link, down the whole tree.
- AI on top, opt in. One agent triages the findings, another reads the action code itself, hunting for exfiltration, obfuscated payloads and typosquats.
- Malicious? You'll know. Red alert in the terminal, first page of every report, exit code 2 for CI.
- Clean? It locks it down. Opens a PR pinning every action to the exact commit SHA it just scanned, not whatever the tag points to tomorrow. The gate fails closed on any coverage gap, and AI can only make it stricter, never greener.
- Reports for everyone. Terminal, JSON, HTML, PDF.
$ pip install git+https://github.com/iggypopi/ActChain.git
More tools are in the works. They land here first.