Aqua Security’s Trivy GitHub Action was compromised, and Checkmarx’s KICS too: a reminder that I wrote an Actions audit script that can search for particular Actions and versions run in workflows (or just list all Actions with exact commit versions run in all workflows).
Auditing script:
https://github.com/github/audit-actions-workflow-runs
StepSecurity blogs in the thread 🧵






