github-actions

Auditing GitHub Actions workflows involves checking for proper SHA pinning, minimal permissions, and correct concurrency to enforce security best practices. This skill automates that review and delivers structured reports with auto-fixes for existing configurations.

SHA pinning in GitHub Actions locks workflow dependencies to a specific commit hash, preventing supply chain attacks from mutable tags. This skill enforces SHA pinning rules automatically to reduce security risks and ensure CI reliability.

Yes, you can generate CI workflows for Node.js, Python, and Go projects. The skill detects project conventions and generates appropriate GitHub Actions templates complete with caching, correct node versions, and security checks.

Fixing minimal permissions requires restricting workflow access to only the tokens and scopes needed. This skill reviews existing workflows and auto-fixes permission misconfigurations, ensuring your CI follows strict security guidelines.

Yes, it works on repositories without existing workflows by running in Create mode. It detects your project's ecosystem and generates new, secure GitHub Actions workflows from scratch with proper pinning and permissions.

Automating GitHub Actions security fixes is limited to known rules like action pinning, concurrency, node version, caching, and permissions. Complex custom workflow logic or undocumented actions may require manual review beyond the auto-fix capabilities.