State of CI security 2026
We read the CI configuration of 1,000 of the most-starred GitHub repositories and asked two questions: which security and quality checks run, and can they fail a build?
Tests yes, security no
763 of the 1,000 run unit tests in CI, and 496 of those 763 run no dependency, secret or code scanner in their pipelines. Secrets detection is the rarest security check: 29 repositories run one in CI. Only 16 run all three of dependency scanning, secrets detection and SAST.
Present is not protected
A scanner that cannot fail the build reports findings that nobody is made to act on. Of the 290 repositories that run a dependency, secret or code scanner in CI, 47 have at least one that cannot block a merge: it is behind continue-on-error, runs only on a schedule or a push to the default branch, or is told never to exit with an error. Across all categories, 121 repositories have at least one such check.
Dependency bots are counted apart. Dependabot and Renovate open pull requests rather than fail builds, by design. They are worth having, but a repository whose only dependency check is a bot has nothing that stops a known-vulnerable dependency from being merged.
Every category
| Category | Run in CI, of repositories where it applies | Of those, cannot fail the build |
|---|---|---|
| Unit tests | 763 of 1000 (76%) | 23 |
| Linter | 484 of 1000 (48%) | 22 |
| SCA (dependency scanning) | 425 of 1000 (42%) | 16 |
| SAST | 217 of 1000 (22%) | 29 |
| Coverage | 196 of 1000 (20%) | 13 |
| Workflow security | 137 of 996 (14%) | 19 |
| Supply chain (SBOM, signing) | 81 of 1000 (8%) | 4 |
| Licence compliance | 33 of 1000 (3%) | 4 |
| Secrets detection | 29 of 1000 (3%) | 7 |
| Performance testing | 2 of 1000 (0%) | 0 |
| IaC security | 1 of 501 (0%) | 1 |
| End-of-life checks | 0 of 1000 (0%) | – |
IaC security applies only where the repository holds infrastructure code (501 repositories), and workflow security only to GitHub Actions (996). "Cannot fail the build" counts checks in a pipeline graded advisory or partial; dependency bots are excluded from it.
What this does not see
- Settings. GitHub's secret scanning and push protection, CodeQL default setup and Dependabot alerts are switched on in repository settings and leave no file. Many popular repositories use them, so secrets detection, SAST and dependency scanning here are a floor for what these projects run, not a census. This report measures what their CI configuration enforces.
- Whether a check is required. A check that can fail still blocks nothing unless branch protection requires it. This report does not read branch protection;
zanadir scan --required-checksdoes, for one repository. - Builds that hide their tools. A linter run inside
./gradlew build, or by a script CI calls but zanadir does not follow, is not counted.
Method
The candidates were the 2,000 most-starred public GitHub repositories that are not archived and not forks, taken from GitHub search on 2026-10-17, and scanned on 2026-10-21. Each was scanned in star order with zanadir 0.17.0 (zanadir scan --repo github.com/owner/name --output json) until 1,000 had CI configuration. 225 had none, mostly lists, books and documentation, and 4 were too large to download. 996 of the 1,000 use GitHub Actions, 32 CircleCI, 12 Azure Pipelines, 4 GitLab CI and 4 Jenkins; some use more than one.
zanadir follows what jobs call: Makefiles, Taskfiles, tox, package.json scripts, turbo, nx, reusable workflows and composite actions. Before publishing, we checked a random sample of verdicts by hand against each repository's workflow files. Doing so found five gaps in what zanadir follows, which were fixed in 0.16.0 and 0.17.0 before this scan.
This page reports aggregates only and names no project. The tool that produced it is open source, so you can run it yourself.
Check your own
docker run --rm mustachecase/zanadir scan --repo github.com/owner/name