Tools

Runs GitHub Actions workflows locally in Docker, so you can test .github/workflows changes without repeated commits and pushes, or use workflows as a local task runner. Needs Docker installed.

Static security analysis for CI/CD config: finds template injection, credential leaks, excessive permissions and more in GitHub Actions workflows, also covers Dependabot and pre-commit configs, and auto-fixes some findings.

GitHub's official gh extension for writing Actions workflows in Markdown that AI agents execute, compiled into standard Actions. Choose engines like Copilot, Claude Code or Codex; runs in a read-only sandbox by default. Requires gh.