github-actions-supply-chain

To check GitHub Actions SHA pinning, review every uses: reference in your .github/workflows files to ensure it points to a 40-character commit SHA rather than a mutable tag. This Skill automates that assessment and verifies the human-readable tag is retained as a comment alongside the SHA.

Using pull_request_target in GitHub Actions is risky because it executes workflows with repository secrets and write permissions. This Skill flags unsafe pull_request_target usage, detecting when user-controlled inputs flow into run: commands and identifying potential malicious code execution paths via CI.

The best way to automate updates for pinned commit SHAs is configuring Dependabot or Renovate in your repository. This Skill checks for a dependabot or Renovate configuration file to verify your pinned SHAs are kept up to date automatically.

To scope GitHub Actions permissions and prevent secret exfiltration, apply minimally scoped permissions blocks at the workflow or job level. This Skill verifies that your workflows contain minimal permissions blocks instead of relying on broad default repository settings.

Yes, this supply chain security review flags third-party GitHub Actions by identifying actions outside the actions/ and github/ namespaces. It classifies the risk of these external actions to help prioritize your CI hardening and remediation efforts.

To run a GitHub Actions security assessment, you need repositories containing .github/workflows files. This Skill analyzes those workflow files to evaluate action version pinning, trigger misuse, and Dependabot configuration to produce a prioritized findings table.