harden-ci-workflows

To secure GitHub Actions workflows against supply-chain attacks, you need to SHA-pin third-party actions, enforce least-privilege token permissions, and verify toolchain installations. This hardening process minimizes write access and ensures artifact integrity.

OpenSSF Scorecard posture grading for CI/CD security is an assessment mechanism that evaluates your project's security posture. It grades your hardened workflows to validate that permissions are minimized and supply-chain risks are actively mitigated.

To set least-privilege permissions for the GITHUB_TOKEN in CI pipelines, you must configure token scopes to limit job write access. This CI hardening technique restricts credentials and secures OIDC tokens from unauthorized modifications.

You need SLSA provenance for GitHub Actions artifact integrity to generate verifiable metadata about how artifacts were built. Applying SLSA provenance ensures tamper protection by cryptographically linking build artifacts to their specific verified toolchain and workflow.

Yes, you can use this CI hardening process for auditing existing workflows before going public. It standardizes security by reviewing third-party actions, validating verified toolchain installs, and addressing vulnerabilities highlighted during a supply-chain review.

The best way to verify toolchain installations and container images in GitHub Actions is by validating checksums or using pinned actions. This verification method ensures securely installed tools and protects your CI/CD pipeline from tampering.