Nexora NHI Scanner

Version updated for https://github.com/Nexora-NHI/nexora-cli to version v0.2.0.

  • This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The nexora-cli is an open-source command-line tool designed to identify Non-Human Identity (NHI) risks in GitHub Actions workflows, Kubernetes manifests, and Infrastructure-as-Code (IaC) files like Terraform. By statically detecting misconfigurations such as unpinned actions, hardcoded secrets, and overly permissive policies, it helps prevent security incidents involving service accounts and machine credentials. The tool operates locally, requires no external dependencies or accounts, and provides actionable insights to enhance security posture.

Release notes

Changelog

  • 2de9d1b5d60c5d4386bd5e72cf59a4c6668bd837 chore(enterprise): add P2 enterprise readiness items
  • d5e320b3db0804bebd14b22789a396dc9c7eedbf ci(release): enable Homebrew tap publish via HOMEBREW_TAP_TOKEN
  • 2063229b6a98e162455fdcb4af9d34ff0f6e88c1 docs(install): centralize to scripts/install.sh across README, getting-started, rollout\naction: add optional github-token input, install to C:\Users\Yaser/.local/bin and add to PATH\ndocs: fix artifact naming to avoid 404s (align with GoReleaser archives)
  • 2dc0bc827941da844af24a5326ca5890aa5fe716 docs(security): add AI coding assistant safety statement
  • 655f79e7656fcad8bf33e7b1632564428dcfa28b fix(license): replace with full Apache 2.0 text for Go package registry detection
  • 88f4546824bef507f2ab9d2fb766b2c03804d366 fix(release): remove invalid attestation step blocking workflow