Vionix

GitHub Actions & Reusable Workflows for the modern DevSecOps platform

Vionix is a curated library of composite GitHub Actions and reusable workflows that encode DevSecOps best practices: supply-chain security, SBOM generation, container scanning, secret management, AI-assisted code review, and more.

Originally developed at Viasat and open-sourced under Apache-2.0.

---

Repository Layout

vionix/
├── actions/                  # Composite GitHub Actions
│   ├── ai/                   # AI-assisted review & analysis
│   ├── build/                # Build utilities (config encoding, env vars, SBOM)
│   ├── docker/               # Container scanning & reporting
│   ├── github/               # GitHub API helpers, GHAS, CODEOWNERS
│   ├── messaging/            # Slack & email notifications
│   ├── network/              # Runner IP probing, network utilities
│   ├── oauth/                # OAuth token helpers
│   ├── platform/             # Core platform values & settings
│   └── secrets/              # Vault/secret retrieval
├── .github/workflows/        # Reusable workflows (call with `uses: Viasat/vionix/.github/workflows/...@main`)
├── products/                 # Bundled product workflows (Looking Glass, LIFT, GHES GHAS enabler)
├── skills/                   # Convention guides and skill definitions
├── docs/                     # Mirror maps and integration documentation
└── problem-matchers/         # GitHub problem matchers for annotating logs

---

Quick Start

Using a Vionix action

jobs:
  notify:
    runs-on: ubuntu-latest
    steps:
      - uses: Viasat/vionix/actions/messaging/slack-notification@v2.0.0
        with:
          channelId: ${{ vars.SLACK_CHANNEL_ID }}
          slackBotToken: ${{ secrets.SLACK_BOT_TOKEN }}
          payload: '{"text": "Build complete!"}'

Using a reusable workflow

jobs:
  scan:
    uses: Viasat/vionix/.github/workflows/docker-compose-devsecops-check-workflow.yaml@v2.0.0
    with:
      image: my-image:latest
    secrets: inherit

Tip: Pin to a specific version tag or commit SHA for production use.

---

Actions Catalog

Category	Action	Description
AI	ai/llm/gcp-anthropic-pr-review	AI-powered PR review via Claude
AI	ai/llm/apigee-pr-review	Apigee API gateway PR review
Build	build/config-stream-encoder	Encode config to base64 stream
Build	build/config-stream-decoder	Decode config stream
Build	build/env-pairs-to-dot-env	Convert env pairs to .env file
Build	build/openssf-dependency-metadata	Generate OpenSSF dependency metadata
Docker	docker/prisma-cloud-scan-reporter	Prisma Cloud scan results reporter
Docker	docker/sbom-reporter	SBOM generation & reporting
GitHub	github/ghas-dependabot-metadata	Dependabot PR metadata enrichment
GitHub	github/ghas-enablement-status	GHAS feature enablement checker
GitHub	github/gh-actions-transitive-sbom	Transitive SBOM for Actions
GitHub	github/mermaid-diagrams/gh-action	Render Mermaid diagrams in PRs
GitHub	github/workflow-run-logs-grep	Search workflow run logs
Messaging	messaging/email	Send email notifications
Messaging	messaging/slack-notification	Send Slack notifications
Network	network/actions-runner/ip-probe	Probe runner IP addresses
Platform	platform/core/set-base-values	Set platform base configuration
Platform	platform/core/set-docker-image-settings	Configure Docker image settings
Secrets	secrets/delinea-vault-secrets	Retrieve secrets from Delinea vault

---

Supply-Chain Security

Vionix follows OpenSSF best practices:

• All third-party uses: references are pinned to full commit SHAs with version comments.
• Harden Runner is enabled on CI workflows.
• SBOM is generated for each release.
• See SECURITY.md for the vulnerability disclosure policy.

---

Contributing

See CONTRIBUTING.md. All commits require a DCO sign-off (git commit -s).

License

Apache-2.0 — see LICENSE.

Copyright 2023–2026 Viasat, Inc. and the Vionix contributors.