cyber.hendryadrian.com
Security News · stepsecurity.io

StepSecurity Makes 500 Maintained GitHub Actions Free for Public Repositories

· Original article ↗

Summary

StepSecurity says its 500 maintained GitHub Actions are now free for public repositories. The replacements undergo code review and controlled releases, addressing supply-chain risks highlighted by the tj-actions/changed-files compromise.

Key points

  • StepSecurity says public repositories can use its 500 maintained actions without a subscription; private repositories require one.
  • The actions are presented as API-compatible replacements, typically requiring a one-line workflow change.
  • StepSecurity describes manual code review, restricted repository access, signed commits, branch protections, and protected release tags as safeguards.
  • The company says it rebuilds and validates Node action distributions, uses environment-based release approvals and ephemeral tokens, and monitors dependencies against patching SLAs.
  • The announcement cites the March 2025 compromise of tj-actions/changed-files, tracked as CVE-2025-30066, in which a malicious commit exposed CI/CD secrets in workflow logs.
  • StepSecurity says enterprise customers can use Policy-Driven PRs to replace supported third-party actions across repositories.

Article Details

Event Type
StepSecurity announced that its maintained GitHub Actions are free for public repositories.
Impact
Public repositories can use StepSecurity-maintained alternatives to third-party GitHub Actions without a subscription. The announcement follows the reported March 2025 compromise of tj-actions/changed-files, in which attackers changed version tags to point to a malicious commit that exposed CI/CD secrets in workflow logs. StepSecurity says its Harden-Runner detected the incident and that it reported it to the maintainers.

CVE

CVE-2025-30066action, used by over 23,000 repositories, was compromised in a supply chain attack (CVE-2025-30066). Attackers exploited a persistent bot account with repository access to update version tags so they

Vendors

GitHubWhat was previously an enterprise-only capability is now available to every open-source project on GitHub. This is a major step in our mission to make CI/CD pipelines more secure for the entire developerStepSecurityToday we are excited to announce that StepSecurity Maintained Actions are now free for public repositories. What was previously an enterprise-only capability is now available to every open-source project on GitHub. This

Products

GitHub ActionsThe Growing Risk of Third-Party GitHub ActionsStepSecurity Maintained ActionsToday we are excited to announce that StepSecurity Maintained Actions are now free for public repositories. What was previously an enterprise-only capability is now available to every open-source project on GitHub. This

Tools

harden-runnerfrom runner memory and exposed them in workflow logs. The incident was detected by StepSecurity's Harden-Runner, and our team reported it to the maintainers within hours.Policy-Driven PRstier customers can replace third-party actions across their repositories automatically using Policy-Driven PRs. You define the policy once, and StepSecurity opens pull requests that swap supported third-partySecureRepoopen-source projects and enterprises, including those maintained by Microsoft, Google, and CISA. Our SecureRepo tool, which creates automated pull requests to harden repository security configurations, is free for

Industries

Open-source softwareto more secure CI/CD workflows across the open-source ecosystem, which benefits everyone, because open-source software is the foundation that enterprises build on.

Related Articles