Home / Security tooling

security-actions

GitHub Actions for AI agent and supply chain security checks.

Python · MIT · latest v0.1.0

What it is

GitHub Actions for AI agent and supply chain security checks. Six small composite actions, each in its own directory with a dependency-free Python or Node script and a test suite, that teams drop into CI with one uses: line. The agent-side actions find risky agent configuration and leaked credentials in prompt files; the supply-chain actions diff SBOMs, audit licences, keep llms.txt valid and tell search engines about changed pages.

- uses: basitalisandhu/security-actions/agent-config-audit@v1

Install

name: security-actions
on:
  push:
    branches: [main]
  pull_request:
permissions:
  contents: read
  security-events: write
jobs:
  checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: basitalisandhu/security-actions/agent-config-audit@v1
      - uses: basitalisandhu/security-actions/prompt-secrets-scan@v1
      - uses: basitalisandhu/security-actions/license-audit@v1
# ... see the README for the rest

From the README; see the full README for every option.

Releases

Topics: agent-security, ai-security, code-scanning, composite-action, cyclonedx, devsecops, github-actions, hacktoberfest, indexnow, license-compliance, llms-txt, mcp, prompt-injection, sarif, sbom, secret-scanning, security-automation, spdx, supply-chain-security