CI/CD Pipeline Security

Now pick what to compare zizmor against.

zizmor clear

Open a name for its full profile

GitLab Ultimate
Scored
GitLab · Freemium · 1 capabilities in this domain · 3.95 / 5
Compare →
GitHub Actions
Capabilities only
GitHub · Freemium · 5 capabilities in this domain
Compare →
zizmor
Capabilities only
zizmor Project · Open Source · 4 capabilities in this domain
selected
StepSecurity Secure Repo and Maintained Actions
Capabilities only
StepSecurity · Freemium · 3 capabilities in this domain
Compare →
Chainguard Actions
Capabilities only
Chainguard · Commercial · 2 capabilities in this domain
Compare →
StepSecurity Harden-Runner
Capabilities only
StepSecurity · Freemium · 2 capabilities in this domain
Compare →
actionlint
Capabilities only
actionlint Project · Open Source · 2 capabilities in this domain
Compare →
poutine
Capabilities only
BoostSecurity · Open Source · 2 capabilities in this domain
Compare →
Gato-X
Capabilities only
Gato-X Project · Open Source · 1 capabilities in this domain
Compare →
Legit Security
Capabilities only
Legit Security · Commercial · 1 capabilities in this domain
Compare →

In CI/CD Pipeline Security

Chainguard Actions

Chainguard · CI/CD Pipeline Security

Close ×

CommercialCompany

A third-party GitHub Action runs with access to the workflow's secrets and token, which makes every referenced action part of the build's trusted computing base. Chainguard Actions centralizes the work of reviewing, pinning, rebuilding and monitoring those actions so that teams consume a maintained catalog instead of auditing each action themselves, with provenance attached so the action's origin can be verified.

What it does2 capabilities · 1 at full coverage

1 of 2 at full coverage.

Curated Hardened Action CatalogFullCICD · level 4 · 3 providers
Third-Party Action & Plugin Pinning EnforcementPartialCICD · level 2 · 6 providers

What it proves7 controls across 6 frameworks

Satisfied through its capabilities, not claimed by the vendor.

CI/CD Top 102 / 10CICD-SEC-3 CICD-SEC-8
CIS Benchmarks1 / 6CIS Software Supply Chain Security Guide
CNAS Top 101 / 10CNAS-4
SP 800-204D1 / 11204D-CI-BUILD
SSDF 1.11 / 42PO.3.2
Scorecard1 / 20Pinned-Dependencies

What it stops2 techniques · 1 risk

2 techniques countered, 2 of them common

Compromise Software Supply ChainT1195.002Common
Mutable Tag Hijack of CI Actions and ImagesCommon

1 risks reduced

Attacker executes code in the CI/CD pipelineCritical

Where it runs1 phase · 1 way to deploy

Capabilities per lifecycle phase

Build2

How it is delivered

SaaS

What it unlocks2 activities · reaches level 5

Program activities its capabilities support, reaching level 5. Supporting an activity is not completing it.

Level 2

SHA-pin actions and set least-privilege tokensLow effort

Level 5

CuratedHigh effort

How it holds up2 strengths · 2 limitations · 1 use it suits

Strengths

Removes per-team action review effort
Provenance on every published action

Limitations

Catalog coverage is narrower than the actions a large org actually uses
GitHub Actions only

Best for

Organizations standardizing GitHub Actions workflows across many teams

Proof points

Removes per-team review of third-party actions that can read workflow secrets
Same signing and provenance pipeline as Chainguard Containers
Adoption is per-action and incremental

How it works

Chainguard maintains rebuilt versions of commonly used actions, tracking upstream changes, reviewing them and republishing under its own namespace with provenance. Workflows reference the Chainguard action in place of the upstream one; because the reference is just a string in the workflow file, adoption is per-action and incremental. The rebuilt actions are produced by the same signing and attestation pipeline as the rest of the catalog.

What it costsPer image or catalog subscription

LicensingPer image or catalog subscription

Priced perimage or catalog per year

BillingSubscription

Scales withNumber of hardened images or catalog tier consumed

Total cost

Compare against engineering time spent triaging and patching base-image CVEs.

What it takes to run2 evidence outputs

Evidence it produces

Provenance attestation for each published actionCatalog record of the upstream revision an action was rebuilt from

Compliance reporting

SSDF PO.3 and PS.1 evidence for trusted build tooling

Migrating to it

Coverage is limited to the commonly used actions in the catalog, so it narrows rather than eliminates third-party action risk. Keep SHA pinning and an allowlist policy in place for the actions that remain outside the catalog.

What it works with

No supported language, standard, integration or named feature recorded.

What else to look at1 alternative · 9 siblings

Open-source alternatives

StepSecurity Harden-RunnerFreemium

Same family

Chainguard ContainersFreemium · 4.04
Chainguard FactoryCommercial
Chainguard LibrariesCommercial
Chainguard OS PackagesCommercial
Chainguard VMsCommercial
The GuardenerCommercial
WolfiOpen Source
apkoOpen Source
melangeOpen Source

What backs this up

No measurement, incident or pipeline using it.

Gantry 7.1.0 · OFF.12 · OFF.13