.png)
stepsecurity.ioarticleStepSecurity Maintained Actions Are Now Free for Public Repos
StepSecurity announced its catalog of 500 "Maintained Actions" — security-reviewed, API-compatible drop-in replacements for abandoned or high-risk third-party GitHub Actions — is now free for public repositories, not just enterprise customers. The post details their onboarding process (manual + AI-assisted code review, tag protection to prevent tj-actions-style tampering, signed commits, ephemeral release tokens, CVSS-based patch SLAs) and cites the March 2025 tj-actions/changed-files supply-chain attack (CVE-2025-30066) as the motivating incident.
TL;DR StepSecurity makes its 500 security-hardened, drop-in GitHub Actions replacements free for public repos, motivated by the tj-actions/changed-files supply-chain attack (CVE-2025-30066).
CVEs named here
Technologies named here
- tj-actions/changed-files
- StepSecurity Maintained Actions
- step-security/changed-files
- 8398a7/action-slack
- tibdex/github-app-token
- Harden-Runner
- SwiftDocOrg/swift-doc
- SecureRepo
- Policy-Driven PRs
- actions-rs/cargo
- actions-rs/toolchain
- OpenSSF Scorecard
- CodeQL
- gaurav-nelson/github-action-markdown-link-check
- Dependency Review
- convictional/trigger-workflow-and-wait
- GitHub Action Advisor
- GitHub Actions
- StepSecurity
Techniques named here
- Tag-tampering / malicious commit reference update
- Secrets extraction from runner memory
- Manual secure code review
- AI-assisted secure code review
- Just-in-time access for tag creation
Related in DevSecOps
jfrog.comarticleJFrog: The Governance Gap Between Your Policy and Your Pipeline
stepsecurity.ioarticleDev Machine Guard Now Supports Windows - StepSecurity
socket.devwriteupSocket: TanStack npm Packages Compromised
securitylab.github.comadvisory