Varnish Brings Supply-Chain Enforcement to Self-Hosted GitHub Actions on Kubernetes
The new Varnish Actions Integration Kit puts Varnish Artifact Firewall and Varnish Virtual Registry in the request path of every GitHub Actions runner, so malicious packages are stopped before they install and approved ones arrive faster, with little or no workflow change.
SALT LAKE CITY — November 9, 2026 – Varnish Software today announced the Varnish Actions Integration Kit, a Helm chart that connects self-hosted GitHub Actions runners on Kubernetes to Varnish Artifact Firewall and Varnish Virtual Registry, both already in production with enterprise customers. Platform and security teams get one policy for what their CI pipelines are allowed to pull, enforced on the wire, plus caching that speeds up every build.
CI is where the attacks land
This year's largest open source attacks, including the compromises of axios on npm, LiteLLM on PyPI, and the TanStack worm, did their damage at install time, often inside build pipelines that hold cloud and deployment credentials. TanStack's malicious versions even carried valid build provenance. Most major package managers now offer a release cooldown, and after the axios compromise, CISA recommended a seven-day minimum release age for npm packages. But a cooldown is a client-side setting: it protects a developer, not a cluster, and it is missing from every CI image nobody remembered to configure.
Time beats detection. Most malicious versions are flagged on OSV.dev within hours or days.
"You don't need to detect it first," said Thijs Feryn, Technical Evangelist at Varnish Software. "You just need to not install it first."
How it works
The kit installs next to GitHub's Actions Runner Controller (ARC). When a job starts, it points each package manager at Varnish, with little or no change to existing workflows. It covers:
- 15+ package ecosystems, including npm, PyPI, Maven, NuGet, Go, Cargo, Helm and Linux packages, plus container images from Docker Hub and GitHub Container Registry.
- Git, Git LFS and actions/checkout, with each job's GitHub token checked before cached content is served, so private repositories stay private.
- Enforcement before install for the most widely used ecosystems, including npm, PyPI, Maven and NuGet: Artifact Firewall blocks known-bad versions using more than 250,000 OSV-derived rules refreshed hourly and quarantines brand-new releases.
- Policy as code in the customer's own Git repository, with every package download decision logged through OpenTelemetry.
- Acceleration and resilience from Virtual Registry's persistent cache, which serves packages, images and Git objects locally and survives restarts.
Proven in production
Varnish Virtual Registry is already used in front of Artifactory and GitHub by some of the largest engineering organisations. Customers have reported 90–99% less load on backend repositories, Git clone and build times two to three times faster, and NuGet restores 2.5 times faster. Cached artifacts keep serving when an upstream registry is rate-limited or down. Varnish launched Varnish Artifact Firewall at KubeCon Amsterdam earlier this year and has since signed enterprise customers in software, media and financial services across Europe and North America.
"Every pipeline is now a front door to production, and the people opening it are increasingly AI agents, not engineers," said Kasper Oldmark, General Manager, Varnish Software Supply Chain. "Since we launched Varnish Artifact Firewall, enterprises have used it to control what dependencies their developers pull into the supply chain. The Actions Integration Kit extends that same policy to the CI runner, where this year's attacks landed. Control what artifacts get in, accelerate what you approve, and keep building when upstream breaks."
Availability
Varnish Virtual Registry and Varnish Artifact Firewall, including the Varnish Actions Integration Kit, are available today with a free 30-day trial. Installation instructions are in the Varnish documentation at docs.varnish-software.com.
Varnish is demonstrating the kit on a live cluster at booth 294 at KubeCon + CloudNativeCon North America in Salt Lake City, November 9–12. Request a meeting to learn more.
About Varnish Software
Varnish Software is a global leader in high-performance caching and content delivery. Trusted by leading streaming services and enterprises worldwide, Varnish optimizes the delivery of digital content, APIs, applications and software artifacts. Its Virtual Registry and Artifact Firewall accelerate and secure the software supply chain for platform engineering teams. Varnish is headquartered in Stockholm, Sweden.
Media Enquires
Jenny Lake, Global Events and Marketing Communications Manager
Varnish Software
jenny.lake@varnish-software.com