Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Orchestrate GitHub Actions Security
| Date | Stars |
|---|---|
| 2026-07-24 | 330 |
| 2026-07-25 | 330 |
| 2026-07-28 | 330 |
| 2026-07-30 | 330 |
| 2026-08-06 | 329 |
Today
-1 stars today
This week
-1 stars this week
This month
— stars this month
Momentum
35.0
growth rate 0.00%/day
<p align="center"><img src="images/banner1.png" width="350" /></p> <div align="center"> [](https://stepsecurity.io/?utm_source=github&utm_medium=organic_oss&utm_campaign=secure-repo) [](https://goreportcard.com/report/github.com/step-security/secure-repo) [](https://codecov.io/gh/step-security/secure-repo) [](https://api.securityscorecards.dev/projects/github.com/step-security/secure-repo) </div> <p align="center"> Automatically apply security best practices in your GitHub repository </p> <p align="center"> <img src="images/secure-repo-1.gif" alt="Secure repo screenshot" > </p> <h3> <a href="#catalog-of-fixes">Catalog of Fixes</a> <span> • </span> <a href="#quickstart">Quickstart</a> <span> • </span> <a href="#contributing">Contributing</a> </h3> ## Catalog of Fixes 1. [Automatically set minimum GITHUB_TOKEN permissions](#1-automatically-set-minimum-github_token-permissions) 2. [Add Harden-Runner GitHub Action to each job](#2-add-harden-runner-github-action-to-each-job) 3. [Pin Actions to a full length commit SHA](#3-pin-actions-to-a-full-length-commit-sha) 4. [Pin image tags to digests in Dockerfiles](#4-pin-image-tags-to-digests-in-dockerfiles) 5. [Add or update Dependabot configuration](#5-add-or-update-dependabot-configuration) 6. [Add CodeQL workflow (SAST)](#6-add-codeql-workflow-sast) 7. [Add Dependency review workflow](#7-add-dependency-review-workflow) 8. [Add OpenSSF Scorecard workflow](#8-add-openssf-scorecard-workflow) ### 1. Automatically set minimum GITHUB_TOKEN permissions #### Why is this needed? - The GITHUB_TOKEN is an automatically generated secret to make authenticated calls to the GitHub API - If the token is compromised, it can be abused to compromise your environment (e.g., to overwrite releases or source code). This compromise will also impact everyone using your software in their supply chain. - To limit the damage, [GitHub recommends setting minimum token permissions for the GITHUB_TOKEN](https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/). #### Before and After the fix **Pull request example**: https://github.com/nginxinc/kubernetes-ingress/pull/3134 In this pull request, minimum permissions are set automatically for the GITHUB_TOKEN <p align="center"><img src="images/token-perm-example.png" alt="Screenshot of token permissions set in a workflow" width="600" /></p> #### How does Secure-Repo fix this issue? - Secure-Repo stores the permissions needed by different GitHub Actions in a [knowledge base](<(https://github.com/step-security/secure-repo/tree/main/knowledge-base/actions)>) - It looks up the permissions needed by each Action in your workflow and sums the permissions up to come up with a final recommendation - If you are the owner of a GitHub Action, please [contribute to the knowledge base](https://github.com/step-security/secure-repo/blob/main/knowledge-base/actions/README.md) ### 2. Add Harden-Runner GitHub Action to each job #### Why is this needed? [Harden-Runner GitHub Action](https://github.com/step-security/harden-runner) installs a security agent on the Github-hosted runner to prevent exfiltration of credentials, monitor the build process, and detect compromised dependencies. #### Before and After the fix **Pull request example**: https://github.com/python-attrs/attrs/pull/1034 This pull request adds the Harden Runner GitHub Action to the workflow file. <p align="center"><img src="images/harden-runner-example.png" width="600" alt="Screenshot of Harden-Runner GitHub Action added to a workflow" /></p> #### How
Excerpt of 12,081 characters
Read on GitHubWould you bet a product on this? Bounded 0–100 and slow moving.
matched fp:f3bbb63fb68867ce, topic:workflow