skills.rest
f4rkh4d
f4rkh4dCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

forge-github-actions

Enforce security and reliability hygiene rules for GitHub Actions workflows.

Updated Aug 23, 2026
Search Tags:#permissions#github actions#supply chain#oidc#workflow hygiene#ci security#secrets handling
One-click install
npx skills add https://github.com/f4rkh4d/forge-skill --skill forge-github-actions
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: forge-github-actions
Source: https://github.com/f4rkh4d/forge-skill/tree/main/skills/infra/forge-github-actions
Command: npx skills add https://github.com/f4rkh4d/forge-skill --skill forge-github-actions

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes assets (resource) and scripts (resource) components.

What problem does it solve?

This Skill prevents common CI workflow security and supply-chain failures in GitHub Actions, such as unpinned third-party actions, overly broad permissions, risky secret handling, and dangerous triggers.

Core Features & Use Cases

  • Pin third-party actions to commit SHAs to reduce supply-chain risk from mutable tags/branches.
  • Enforce least-privilege permissions via permissions: {} at workflow scope and narrowly-scoped per-job grants.
  • Harden secrets and credential flow by rejecting secrets in run: command lines and secret echo patterns, and preferring OIDC over long-lived cloud keys.
  • Reduce CI blast radius and waste by discouraging pull_request_target, avoiding unconditional on: [push], and requiring PR concurrency cancellation.
  • Verification support with a ready-to-run verifier script to flag workflow hygiene violations in .github/workflows/*.yml.

Quick Start

Use the skill to audit your GitHub Actions workflows by running the verifier on your workflow files and fixing any flagged violations.

Frequently Asked Questions about forge-github-actions

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce least-privilege permissions in GitHub Actions workflows?▼

GitHub Actions secrets should be hardened by rejecting them in `run:` command lines and avoiding echo patterns. Prefer OIDC-federated credentials over long-lived cloud keys to secure credential flow.

Why pin third-party GitHub Actions to commit SHAs?▼

Pinning third-party GitHub Actions to commit SHAs reduces supply-chain risk from mutable tags and branches. It ensures workflow execution relies on immutable, verified action versions rather than easily altered references.

How do I audit existing GitHub Actions workflows for CI security violations?▼

Use this Skill to audit both new and existing workflows under `.github/workflows`, specifically for CI and deployment pipelines. It applies hard hygiene rules to any YAML workflow file requiring strict security controls.

What are dangerous GitHub Actions triggers and how do I reduce CI blast radius?▼

Reduce CI blast radius by discouraging `pull_request_target`, avoiding unconditional `on: [push]` triggers, and requiring PR concurrency cancellation. These hard rules prevent dangerous execution contexts and resource waste.

Related Skills

Explore More Legal & Compliance Skills→
rostiSerostiSe
1

expo-cicd-workflows

Validate Expo EAS workflow YAML configurations against the official schema.

Community
Advanced
tankpkgtankpkg
1

@tank/github-actions-mastery

Design secure GitHub Actions workflows with SHA pinning and OIDC federation.

Official
Advanced
d-padmanabhand-padmanabhan
15

workload-identity

Design SPIFFE/SPIRE or cloud IAM workload identity workflows for Kubernetes and multi-cloud systems.

Community
Advanced
ClearMeasureLabsClearMeasureLabs
3

owasp-dependency-scan

Scan .NET and npm dependencies for disclosed CVEs and generate consolidated security reports.

Official
Advanced