gosec is a production-grade static analysis security scanner for Go source code. It analyzes Go programs by traversing the AST and SSA representations to detect a wide range of security vulnerabilities, including SQL injection, command injection, path traversal, cross-site scripting (XSS), hardcoded credentials, weak cryptography, TLS misconfigurations, and more. The tool is distributed as a CLI binary, a Docker image, a GitHub Action, and a reusable Go library. The architecture is modular: a core analysis engine loads Go packages, applies AST-based rules and SSA-based analyzers, and runs a configurable taint analysis engine that tracks data flow from user-controlled sources to dangerous sinks. Results are output in multiple formats (text, JSON, SARIF, CSV, JUnit, HTML, SonarQube, golint, YAML). The tool also integrates with AI providers (OpenAI, Claude, Gemini, Atlas) to suggest automated fixes for detected vulnerabilities. Notable design highlights include a generic LRU cache for regex matching, a path-based rule exclusion filter, a comprehensive CWE knowledge base, and a well-abstracted taint analysis configuration system. The codebase demonstrates strong engineering practices with extensive test coverage, performance benchmarks, and CI/CD pipelines for release and scanning.
This repository provides a comprehensive suite of GitHub Actions for automating Terraform and OpenTofu workflows in CI/CD pipelines. Each action (e.g., terraform-apply, terraform-plan, terraform-validate) is implemented as a standalone reusable workflow with standardized inputs, outputs, and Docker-based execution environments. The architecture features a common shell library (actions.sh) that handles tool installation, backend initialization, and shared utilities, while individual actions focus on specific operations like plan generation, state management, or pull request commenting. Key capabilities include version detection from multiple sources, backend fingerprinting for state identification, automated PR commenting with approval workflows, and support for both Terraform and OpenTofu. The project emphasizes reliability through extensive testing across versions and backends, with clear separation of concerns between action definitions, implementation logic, and documentation generation.
This repository provides a GitHub Action (stale-repos) that scans a GitHub organization or user account to identify repositories that have been inactive for a configurable number of days. It is implemented as a Python script packaged in a Docker container, using the PyGithub library to interact with the GitHub API. The action supports authentication via personal access token or GitHub App installation, and can optionally include additional metrics such as days since last release or pull request. Output is generated as both a Markdown report and JSON, and can be automatically added to the GitHub Actions workflow summary. The codebase is well-structured with clear separation of concerns (auth, env, markdown, main logic), comprehensive test coverage, and modern Python tooling (uv, type hints, linting). It is actively maintained with a robust CI/CD pipeline and follows semantic versioning.
TruffleHog is a comprehensive, actively maintained secret scanning tool written in Go. It detects exposed credentials, API keys, tokens, and other sensitive information across a wide range of sources including Git repositories, cloud storage (S3, GCS), Docker images, CI/CD systems (Jenkins, Travis CI, CircleCI), and many third-party services. The architecture is modular: a core engine orchestrates scanning from various sources, a large library of over 700 detectors (each implementing a standard interface) identifies secrets using regex patterns and Aho-Corasick pre-filtering, and optional HTTP-based verification confirms whether discovered secrets are still valid. The tool also includes a terminal UI (Bubble Tea), a permissions analyzer for deeper credential assessment, and output formats like JSON, SARIF, and GitHub Actions annotations. External dependencies include cloud SDKs, database drivers, and numerous third-party API clients, but the core scanning logic is self-contained and well-structured.
Wait-for-secrets is a GitHub Action designed to pause workflow execution until a user manually inputs required secrets via a web interface. It leverages GitHub's OIDC tokens to authenticate with the StepSecurity API, which temporarily stores secret metadata and provides a unique URL for user interaction. The action polls the API until secrets are submitted, then makes them available as outputs for subsequent workflow steps. Key features include optional Slack notifications and configurable timeouts. The architecture is straightforward: a TypeScript-based action compiled via ncc into a single JavaScript file, with core logic separated into utility functions for environment parsing, URL generation, and secret handling.
This repository implements a GitHub Action that automates deployment of static content to GitHub Pages. It takes a folder from the workspace, optionally builds it, and pushes the contents to a specified branch (default `gh-pages`) using git worktrees and rsync. The action supports authentication via GitHub token, personal access token, or SSH deploy keys, and offers extensive configuration options including clean deployments, single-commit history, target subfolders, dry runs, tags, and Git LFS. The architecture is modular: `src/main.ts` is the entry point, `src/lib.ts` orchestrates the workflow, `src/git.ts` handles repository initialization and deployment, `src/worktree.ts` manages git worktree creation with retry logic, `src/ssh.ts` configures SSH clients, and `src/execute.ts` provides a reusable command execution wrapper. The action relies on external tools `git`, `rsync`, and `ssh-agent`, and uses the `@actions/*` toolkit for GitHub Actions integration. The codebase is well-structured TypeScript with comprehensive unit and integration tests, and follows modern JavaScript practices with ESLint, Prettier, and Jest.
WinGet Releaser is a GitHub Action that automates publishing application releases to the Windows Package Manager (WinGet). When triggered by a GitHub release, it fetches release assets, uses the komac tool to generate/update WinGet manifests, and submits a pull request to the microsoft/winget-pkgs repository. The action supports configurable version retention, installer filtering, and custom release notes. Core functionality resides in a PowerShell script that handles input validation, release data fetching, fork synchronization, komac execution, and version cleanup. The action relies on external tools (gh CLI, komac) but encapsulates complex WinGet publishing logic into a reusable CI component.
This is a standalone Rust web server that implements Turborepo's remote caching API. It acts as a sidecar process, typically started inside CI pipelines (GitHub Actions, GitLab, Kubernetes), that forwards artifact storage and retrieval requests to any S3-compatible object store (AWS S3, Cloudflare R2, RustFS). The server exposes a small set of REST endpoints: health check, artifact upload/download/head, event logging, and a team artifact listing stub. Artifacts are streamed directly from the HTTP body to S3 (and vice versa) without buffering into memory. Optional Bearer-token authentication uses constant-time comparison, and the server is instrumented with OpenTelemetry for distributed traces and system-level metrics (CPU, memory) that are exportable via OTLP. The repository also includes a GitHub Action wrapper (Node.js) that manages the binary lifecycle—startup health polling, graceful shutdown, and log collection—and a multi-stage Docker build that produces statically linked Linux binaries and a universal macOS binary. The architecture is a monolith (single binary) built with actix-web, with clear separation into modules for settings, storage, authentication, routes, and telemetry. All artifacts are scoped under a team prefix derived from the Turborepo client's query parameters.
This is a GitHub Action that automates creating releases in Sentry (error monitoring platform). The action wraps the `@sentry/cli` tool and runs as either a Docker container on Linux runners or a composite action installing the CLI on macOS/Windows. Its core workflow (in `src/main.ts`) parses inputs, validates environment variables, then orchestrates a sequence of sentry-cli calls: creating a release, optionally setting commits (auto/skip/manual), injecting debug IDs into source files, uploading source maps, deploying to an environment, and finalizing the release. Telemetry via `@sentry/node` is collected to monitor action performance. The codebase is small (5 source files plus tests), cleanly structured, and well-tested with both unit tests and end-to-end integration tests against Sentry's API. It is actively maintained with recent dependency bumps and proper CI/CD pipelines.
This repository implements the official GitHub Action `actions/setup-node`, which sets up a Node.js environment in GitHub Actions workflows. It downloads and caches the requested Node.js version (including LTS, nightly, RC, and v8-canary builds), adds it to the PATH, optionally caches npm/yarn/pnpm dependencies using `actions/cache`, registers problem matchers for TypeScript and ESLint, and configures authentication for private npm registries. The architecture is a composite action with a main entry point (`src/setup-node.ts`) and a post-job cache-save entry point (`src/cache-save.ts`), both compiled via ncc. The codebase is well-structured with abstract base classes for distribution handling, a factory pattern for selecting the correct distribution, and separate modules for cache utilities and authentication. It relies on the `@actions/*` toolkit libraries and external services (GitHub node-versions manifest, nodejs.org dist mirrors).
This is a GitHub Action that parses JaCoCo XML coverage reports and posts a formatted coverage summary as a comment on pull requests. It supports single and multi-module projects, aggregate reports, multiple counter types (INSTRUCTION, BRANCH, LINE, COMPLEXITY, METHOD), custom emojis, and comment update strategies. The action fetches the list of changed files from the PR via the GitHub API, computes overall and per-file coverage percentages, and renders a markdown table with pass/fail indicators based on configurable thresholds. The codebase is written in TypeScript, well-structured with clear separation of concerns (action orchestration, XML parsing, coverage computation, markdown rendering), and includes a comprehensive test suite with fixtures covering various report structures and edge cases.
This is a GitHub Action that wraps Docker's `buildx bake` command, enabling multi-target Docker builds within CI workflows. It parses bake definition files (HCL or JSON), translates GitHub Action inputs into bake arguments (including support for provenance, SBOM, custom outputs, and build checks), executes the build, and generates a detailed job summary with optional build record upload. The action integrates tightly with the `@docker/actions-toolkit` library to manage Docker contexts, builder instances, and GitHub API interactions. While the core action is specific to GitHub Actions, a subaction (`subaction/matrix`) demonstrates a reusable pattern for generating a multi-dimensional GitHub Actions matrix from a bake definition's targets and fields, which can be extracted and adapted for other CI systems or deployment pipelines. The repository is well-maintained with daily dependency updates and comprehensive CI tests across various buildx versions and scenarios.
This repository is the official GitHub Action for setting up the Google Cloud SDK (`gcloud`) in GitHub Actions workflows. It handles downloading, installing, and configuring the Cloud SDK, including optional components and authentication. The action is a thin TypeScript wrapper around the internal `@google-github-actions/setup-cloud-sdk` and `@google-github-actions/actions-utils` packages. The main entry point is `src/main.ts`, which reads inputs (version, project ID, install components, etc.), installs the SDK if necessary, authenticates using credentials from the `google-github-actions/auth` action, and sets the default project. It outputs the installed version. The code is well-structured, uses strict TypeScript with up-to-date dependencies, and includes both unit and integration tests. Because the heavy logic is delegated to internal packages, this action is straightforward and reliable but not architecturally remarkable. The repository is actively maintained by Google with rigorous CI/CD and dependabot security updates.
This repository implements a GitHub Action that cancels previous workflow runs that are not completed (queued or in_progress) for a given workflow. The action is written in TypeScript and bundled using vercel/ncc for distribution. It processes inputs to determine which workflows to target, handles various GitHub events (push, pull_request, workflow_run), and uses the GitHub API via @actions/github to query and cancel workflow runs based on configurable conditions like ignoring SHA, canceling all but the latest, filtering by status, or force canceling. The architecture is a single source file (src/index.ts) that collects context from the GitHub Actions environment, resolves target workflows, lists relevant runs, applies filters, and cancels matching runs. The action demonstrates proper error handling, logging, and use of the GitHub Actions toolkit, making it a reliable tool for managing workflow concurrency.
This repository is a GitHub Action written in TypeScript that installs and configures Mozilla's sccache compilation cache inside GitHub Actions workflows. The main entry point (src/setup.ts) reads a version input; if none is given, it queries the GitHub API for the latest sccache release. It then downloads the platform-specific binary from sccache's GitHub releases, verifies the downloaded archive's SHA-256 checksum against the released .sha256 sidecar, extracts it, caches it in the Actions tool directory, adds it to PATH, exports SCCACHE_PATH, and sets ACTIONS_CACHE_SERVICE_V2 plus result URL/token environment variables so sccache can use GitHub Actions cache as its backend. A post step (src/show_stats.ts) runs `sccache --show-stats --stats-format=json`, parses the output, and posts a job annotation and job summary with cache hit/miss/error counts, hit ratio, and durations. Architecturally this is a small two-entry-point action bundled with ncc. The source is strict TypeScript with ESLint, Prettier, and a CI workflow that verifies committed dist bundles match a clean rebuild. It has no real unit tests (jest runs with --passWithNoTests) and a few minor flaws: the zip-extraction branch is dead code because getExtension() always returns 'tar.gz'; unsupported architectures/platforms produce malformed download URLs rather than clean failures; and the displayed cache percentage shows 0% when there are zero requests (e.g., no cache hits). Despite these issues, the code is clear, uses byte-level checksum verification, handles sccache's missing trailing newline in JSON output, and integrates well with GitHub's logging and summary APIs. It is an actively maintained, low-drift repository.
This repository provides a deprecated GitHub Action that automatically updates release notes (Markdown files) with new entries from merged pull requests. It is a Docker-based action that runs on `pull_request_target` or `workflow_dispatch` events, fetches PR details via the GitHub API using PyGithub, and modifies a `release-notes.md` file by inserting a templated message under a configurable header. The core logic includes support for label-based sections, custom Jinja2 templates, skip labels, and retry logic for race conditions during git push. The codebase also includes a companion CLI tool (`scripts/prepare_release.py`) for automating version bumps and release note preparation. The action has been deprecated by the maintainer in favor of a dedicated GitHub App, but the code remains functional and well-maintained.
This repository provides a GitHub Action that wraps the lychee link checker to validate links in Markdown, HTML, and text files. The action downloads and installs a specified version of lychee, runs it with configurable arguments, and processes the output to set exit codes and generate reports. The core action is well-designed with robust version handling and error processing, but the associated workflow files show signs of technical drift due to outdated action versions (e.g., actions/checkout@v7 which doesn't exist). The action is actively maintained with recent commits and automated version update workflows.
This repository implements an AI-powered code review bot for GitHub. It listens for pull request events (opened, synchronize) and uses OpenAI's language models (or Azure OpenAI, GitHub Models) to automatically review code diffs and post inline comments and summary reviews. The system supports multiple deployment modes: a Probot-based GitHub App, a GitHub Action, an AWS Lambda function, and a Vercel serverless function. The core logic is in `src/bot.ts` (event handling, file filtering, review creation) and `src/chat.ts` (LLM API abstraction). The architecture is a monolith with adapter layers for each platform. External dependencies include the OpenAI/LLM API, GitHub API via Octokit, and minimatch for glob-based file filtering. The bot is configurable via environment variables for model selection, prompt customization, language, and file inclusion/exclusion patterns. It also implements an incremental review feature to reduce API costs by only re-reviewing files changed since the last bot review.
gpt-review is a Python CLI tool that integrates OpenAI/Azure OpenAI models to assist with software development workflows. It provides three main functionalities: asking questions to GPT models (with optional file/context), reviewing GitHub pull requests and posting AI-generated comments, and generating git commit messages based on staged changes. The application uses a modular architecture with separate components for different functionalities: question answering (_ask.py), PR review (_review.py), git operations (_git.py), document indexing (_llama_index.py), and API wrappers (_openai.py). It leverages the knack library for CLI structure, GitPython for git operations, Requests for GitHub API calls, and LlamaIndex for context-aware queries. The tool supports both direct OpenAI API and Azure OpenAI with automatic fallback to Azure Key Vault for credentials.
This repository is a GitHub Action designed to capture screenshots of websites across different operating systems. It takes inputs such as source URL or HTML content, destination filename, and optional parameters like full-page capture, width, and delay. The action uses the `capture-website` package (which relies on Puppeteer) to generate the screenshot, then uploads it as an artifact in the GitHub Actions workflow and exposes the file path as an output. The architecture is straightforward: the entry point (index.js) delegates to core logic in lib/screenshot-website.js, which handles input processing, Chrome executable location based on the runner OS, screenshot capture, artifact upload, and output setting. While the main logic is tightly coupled to the GitHub Actions environment, the repository contains a reusable utility function for normalizing and parsing action inputs (lib/load-inputs.js) that could be extracted for use in other Node.js projects. The action shows signs of technical drift due to its reliance on Node.js 12 (end-of-life) and outdated dependencies like Puppeteer 13.7.0, though it remains functional through active Dependabot updates and CI workflows.