securing-github-actions-workflows

To secure GitHub Actions workflows against supply chain attacks, you must audit and harden them by pinning actions to SHA digests, minimizing GITHUB_TOKEN permissions, and protecting secrets from exfiltration. This skill automates that auditing process using Python and YAML parsing.

Action pinning in GitHub Actions is the practice of referencing third-party actions by their commit SHA digest rather than a mutable tag. It is needed to prevent supply chain attacks by ensuring the executed code remains immutable and cannot be maliciously updated by a compromised repository.

Preventing script injection in GitHub Actions requires treating untrusted input from pull requests as unsafe variables. This skill provides guidelines and scripts to audit workflow expressions, ensuring event payloads are not directly interpolated into shell scripts to block privilege escalation.

Yes, you can audit existing GitHub Actions YAML files for credential theft risks by running the provided Python script. It parses your workflows to identify overprivileged GITHUB_TOKEN permissions and unprotected secrets, recommending permission minimization to reduce exposure.

Yes, you need Python to run the workflow hardening scripts, as the auditing logic relies on Python YAML parsing capabilities and standard libraries like re, json, and pathlib to evaluate your pipeline configurations for security vulnerabilities.

Automated GitHub Actions security audits focus on static configuration vulnerabilities like action pinning, permissions, and script injection. They cannot detect runtime credential exfiltration dynamically, so implementing required reviewers for workflow changes is recommended to maintain a complete audit trail.