Unpacking Security Scanners for GitHub Actions Workflows
This study systematically compared nine security scanners for GitHub Actions Workflows against ten common security weaknesses. The findings show that no single scanner covers all issues, proving they use fundamentally different analysis strategies. This means developers must select and combine complementary scanners to achieve robust workflow security.