What problem does it solve? CI/CD pipelines are a prime attack target: long-lived cloud secrets get stolen from logs, third-party actions get compromised, and artifacts get tampered with between build and deploy. This Skill provides a prioritized, threat-model-driven checklist to secure GitHub Actions, Azure DevOps, or GitLab pipelines and reach SLSA compliance levels. ## Core Features & Use Cases - Threat-Model-Based Controls: Addresses five concrete threats (stolen secrets, malicious dependencies, compromised actions, tampered artifacts, privilege escalation) with controls ordered by ROI across three maturity levels. - Concrete Hardening Checklist: Covers OIDC federation instead of long-lived secrets, SHA-pinning third-party actions, least-privilege permissions: blocks, SBOM generation, Cosign signing, SLSA provenance, and deploy-time signature verification. - Structured Audit Report: Produces a standardized hardening report table mapping each control to its status and evidence, plus a target SLSA level and blocking gap count. - Use Case: A team migrating from stored AZURE_CLIENT_SECRET credentials to OIDC federation can invoke this Skill to audit every workflow, pin floating action tags, and produce a gap report toward SLSA Level 2. ## Quick Start Audit our GitHub Actions workflows for security gaps and produce a hardening report targeting SLSA Level 2.
