github-actions-security

What problem does it solve?

This Skill helps users harden and secure GitHub Actions workflows by providing guidelines and checks to prevent security pitfalls and misconfigurations.

Core Features & Use Cases

• Pin third-party actions to specific commits to prevent supply chain attacks.
• Assess and scope GITHUB_TOKEN permissions to limit privilege levels.
• Implement OIDC Federation for short-lived, trusted cloud credentials.
• Identify risky usage of pull_request_target workflows to avoid secret leaks.
• Detect untrusted input injection through expression interpolation.
• Review third-party actions for safety and maintenance status before adoption.
• Audit secrets discipline to prevent accidental leaks and enforce rotation.

Quick Start

Review your current workflows to ensure actions are pinned to SHA, permissions are minimized, and no pull_request_target runs code from untrusted sources.