gha-workflow-hardening

Enforce least privilege and safe practices in GitHub Actions workflows.

Updated Feb 18, 2026

Search Tags:#permissions #github-actions #least-privilege #workflow-security #ci-cd-security #action-pinning

Ready to run

npx skills add https://github.com/askaret/codex-skills --skill gha-workflow-hardening

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: gha-workflow-hardening
Source: https://github.com/askaret/codex-skills/tree/main/.agents/skills/gha-workflow-hardening
Command: npx skills add https://github.com/askaret/codex-skills --skill gha-workflow-hardening

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

GitHub Actions workflows often run with broad permissions and risky patterns. This skill provides a structured approach to harden workflows, reduce the attack surface, and enforce least privilege across CI/CD pipelines.

Core Features & Use Cases

Pin third-party actions to fixed SHAs and restrict untrusted actions to minimize supply chain risk.
Enforce per-job minimal permissions, safe triggers, and clear review processes during workflow design and deployment.
Provide a practical framework to audit and harden workflows in existing repositories and new projects.

Quick Start

Configure a hardened workflow by pinning actions, restricting permissions, and enabling least-privilege defaults.

Frequently Asked Questions about gha-workflow-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I enforce least privilege permissions in GitHub Actions workflows?▼

To enforce least privilege in GitHub Actions workflows, you must restrict broad default tokens and define per-job minimal permissions. This ensures CI/CD pipelines only grant access to the specific scopes required for each task, reducing the attack surface.

Why should I pin third-party GitHub Actions to fixed SHAs?▼

Pinning third-party GitHub Actions to fixed SHAs minimizes supply chain risk by preventing unauthorized or malicious updates. It ensures workflow security hardening remains intact by executing immutable, verified commits rather than mutable version tags.

What is the best way to audit and harden existing GitHub Actions workflows?▼

The best way to audit and harden existing GitHub Actions workflows is to apply a structured framework enforcing safe triggers, runner hardening, and action pinning. This enforces secure design and deployment practices across repositories.

Can I restrict GitHub Actions workflow triggers to safe events only?▼

Yes, you can restrict GitHub Actions workflow triggers to safe events only. Safe triggers are a core component of workflow security hardening, preventing unauthorized actors from executing CI/CD pipelines through risky automated execution hooks.

Do I need to configure runner hardening for GitHub Actions job security?▼

Yes, runner hardening is necessary for GitHub Actions job security. It works alongside per-job permissions and action pinning to isolate execution environments, limiting the potential impact of compromised dependencies within your CI/CD pipelines.