Provides Trivy security scanning capabilities through a standardized interface, allowing users to scan projects for vulnerabilities and automatically fix them by updating dependencies.
Run a comprehensive security audit combining dependency scanning, secret detection, and pattern checks. Automatically collects evidence, creates governance tasks, and sends notifications for critical findings.
Retrieve a compact summary of supply-chain threat incidents for a GitHub organization. Quickly identify incidents by name (e.g., 'axios compromise') to find the matching incident ID before fetching full details.
Lists the 100 most recent Harden-Runner-monitored workflow runs for a GitHub organization or repository, returning run IDs and clickable dashboard URLs for CI/CD security investigation.
Scan Infrastructure as Code and Dockerfiles with Trivy to detect misconfigurations, vulnerabilities, and security issues across Dockerfile, Terraform, Kubernetes, and config files.
Search across a GitHub organization to locate all workflows referencing a specific Action. Essential for responding to compromised Actions by identifying affected repositories and workflows.
Scan container images for known vulnerabilities in OS packages and application dependencies with Trivy. Identify affected packages, fixed versions, and severity to secure deployments before release.