build, 2m 14s
unit tests, 1,284 passed
eunomio / ci-guard, no risky auth change
Replace GitHub Actions AWS secrets with OIDC. Block risky auth changes before they merge. GitHub‑native, narrow by design.
gha-deploy to allow any branch. Consider scoping to refs/heads/main.
Long‑lived AWS credentials sit in GitHub Actions longer than they should. Workflow, IAM, and trust‑policy changes get reviewed like normal code, even though they quietly change what CI can touch in production.
Credential risk lingers. Auth drift accumulates. Risky changes land without a guardrail.
Detect repositories still using long‑lived AWS credentials in GitHub Actions. No surprises about which repos are still on static keys.
Open migration pull requests or managed guidance so teams can move to GitHub Actions OIDC with less manual work.
Catch risky changes to workflows and Terraform‑defined IAM access before they merge.
Where automatic patching is possible, Eunomio CI Guard opens the OIDC migration PR. Where it isn't, you get a managed guidance issue with the exact trust policy and workflow diff to apply.
A safer path from GitHub Actions to AWS, without a heavy security platform.
Risky CI auth changes reviewed before they land. Clear coverage per repo.
Clear guardrails without widening scope into a governance program.