build, 2m 14s
unit tests, 1,284 passed
eunomio / ci-guard, no risky auth change
Replace GitHub Actions AWS secrets with OIDC. Block risky auth changes before they merge. GitHub‑native, narrow by design.
gha-deploy to allow any branch. Consider scoping to refs/heads/main.
Eunomio is building a focused suite of identity, access, trust, and security tools — useful enough for developers and platform engineers who run them, credible enough for IT admins, security teams, and compliance owners who approve them, and narrow enough to operate safely. Eunomio CI Guard is our first product; more focused tools may follow when each one is justified by real customer demand.
Long‑lived AWS credentials sit in GitHub Actions longer than they should. Workflow, IAM, and trust‑policy changes get reviewed like normal code, even though they quietly change what CI can touch in production.
Credential risk lingers. Auth drift accumulates. Risky changes land without a guardrail.
Detect repositories still using long‑lived AWS credentials in GitHub Actions. No surprises about which repos are still on static keys.
Open migration pull requests or managed guidance so teams can move to GitHub Actions OIDC with less manual work.
Catch risky changes to workflows and Terraform‑defined IAM access before they merge.
Where automatic patching is possible, Eunomio CI Guard opens the OIDC migration PR. Where it isn't, you get a managed guidance issue with the exact trust policy and workflow diff to apply.
These are CI Guard's current product boundaries, not a permanent rule for the whole Eunomio suite — future tools may take other shapes.
Platform engineers install and operate CI Guard day to day, but the decision to adopt it usually involves IT admins, security teams, founders or CTOs, and compliance owners. We try to be useful and credible to all of them.
Hands-on operators of the GitHub App. A safer path from GitHub Actions to AWS, without a heavy security platform.
Clear guardrails on CI-to-cloud access. Less static credential exposure, fewer trust-policy surprises, no widening into a governance program.
A narrow, reviewable change path you can stand behind. Risky CI auth changes get reviewed before they land, with clear coverage per repo.