TLDR Tech / InfoSec
Butler (GitHub Repo)
A beta-stage GitHub Actions oversight tool that scans every repo across an organization for workflows, actions, secrets, variables, and third-party dependencies, persisting the inventory to a local SQLite database. It operates as a three-step pipeline (download → process → report) supporting multi-org ingestion, multiple PAT tokens for rate-limit pooling via GITHUB_TOKEN_* wildcards, and configurable thread counts, then emits HTML and CSV outputs for security reviews and third-party action audits. Sample reports for GitHub, OpenAI, Docker, and AWS Labs are published at sadreck.github.io/Butler, which can be useful for AppSec teams hunting for unpinned third-party actions and secret sprawl across CI/CD estates, though the desktop-only reports and active development status warrant caution before production use.
Read the full story