Implement security and operational best practices for GitHub Actions workflows.
npx skills add https://github.com/bcgov/agent-skills --skill github-actions-bcgov
Please help me install this Agent Skill. Skill: github-actions Source: https://github.com/bcgov/agent-skills/tree/main/skills/github-actions Command: npx skills add https://github.com/bcgov/agent-skills --skill github-actions-bcgov
This Skill addresses the challenge of ensuring secure and compliant GitHub Actions workflows by implementing best practices for security, permissions, and operational excellence.
Add the github-actions skill to your repository and follow the guidelines outlined in the SKILL.md file for setting up your GitHub Actions workflows.
High-intent search queries and answers about installing and using this skill.
To harden GitHub Actions workflows, you enforce best practices for permissions management, action pinning, and runner configuration. This ensures workflows are secure, compliant, and efficient within operational environments.
Best practices for permissions in GitHub Actions CI/CD pipelines involve strictly limiting token scopes and enforcing least privilege access. Applying these hardening patterns prevents unauthorized access and secures operational workflows.
Yes, you need an existing repository with GitHub Actions workflows. The hardening patterns focus on modifying and securing existing workflows by enforcing permissions management and operational excellence standards.
Implementing action pinning and secure runner configuration involves using immutable references for actions and isolating execution environments. These security hardening patterns protect workflows from supply chain attacks and unauthorized modifications.
Ensuring maintainable and secure DevOps workflows in BC Government repositories requires applying specific security hardening patterns and operational excellence templates. This approach standardizes CI/CD pipelines while maintaining strict security compliance.
RedHatProductSecurityAnalyze GitHub Actions workflows for AI agent security issues.
anevjesOrchestrate deployment, evaluation, and management of AI agents in Azure.
Hack23Harden GitHub Actions pipelines with least-privilege permissions and SHA pinning.
adaptive-enforcement-labReference security patterns for hardening GitHub Actions workflows.
