github-actions-security

Harden GitHub Actions workflows with action pinning, permission scoping, and OIDC federation.

15|Updated May 12, 2026

Search Tags:#workflow #ci/cd #security #permissions #github actions #secrets #oidc

Ready to run

npx skills add https://github.com/GoldenWing-360/claude-security-skills --skill github-actions-security

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: github-actions-security
Source: https://github.com/GoldenWing-360/claude-security-skills/tree/main/github-actions-security
Command: npx skills add https://github.com/GoldenWing-360/claude-security-skills --skill github-actions-security

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) and assets (resource) components.

What problem does it solve?

This Skill helps users harden and secure GitHub Actions workflows by providing guidelines and checks to prevent security pitfalls and misconfigurations.

Core Features & Use Cases

Pin third-party actions to specific commits to prevent supply chain attacks.
Assess and scope GITHUB_TOKEN permissions to limit privilege levels.
Implement OIDC Federation for short-lived, trusted cloud credentials.
Identify risky usage of pull_request_target workflows to avoid secret leaks.
Detect untrusted input injection through expression interpolation.
Review third-party actions for safety and maintenance status before adoption.
Audit secrets discipline to prevent accidental leaks and enforce rotation.

Quick Start

Review your current workflows to ensure actions are pinned to SHA, permissions are minimized, and no pull_request_target runs code from untrusted sources.

Frequently Asked Questions about github-actions-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent secret leaks in GitHub Actions workflows?▼

Prevent secret leaks in GitHub Actions by auditing secrets discipline, avoiding risky pull_request_target workflows that execute untrusted code, and scoping GITHUB_TOKEN permissions to limit privilege levels. Ensure sensitive data is protected from accidental exposure.

What is the best way to secure cloud credentials in CI/CD pipelines?▼

Secure cloud credentials in CI/CD pipelines by implementing OIDC Federation to establish short-lived, trusted cloud credentials. This approach replaces long-lived secrets with temporary tokens issued by your cloud provider.

How do I stop supply chain attacks from third-party GitHub Actions?▼

Stop supply chain attacks from third-party GitHub Actions by pinning actions to specific commit SHAs instead of mutable tags. Review third-party actions for safety and maintenance status before adoption to ensure ongoing reliability.

How does untrusted input injection happen in GitHub Actions?▼

Untrusted input injection in GitHub Actions happens through expression interpolation where user-controlled variables are evaluated unsafely. Detect and mitigate these attack vectors by validating inputs and avoiding direct interpolation in run scripts.

What are the limitations of using pull_request_target in GitHub Actions?▼

The limitation of pull_request_target in GitHub Actions is that it runs with privileged repository secrets and token access, making it risky when executing code from untrusted sources. Identify and avoid this misuse to prevent secret leaks.