gh-actions-validator

What problem does it solve?

This Skill addresses security vulnerabilities in GitHub Actions workflows, particularly those deploying to Google Cloud, by enforcing best practices like Workload Identity Federation (WIF) and least privilege IAM.

Core Features & Use Cases

• Workflow Auditing: Scans existing GitHub Actions workflows for security issues.
• WIF Enforcement: Validates the use of Workload Identity Federation and flags the use of insecure service account keys.
• IAM Role Review: Checks for adherence to the principle of least privilege for service accounts.
• Use Case: Automatically audit your CI/CD pipelines to ensure they are not exposing sensitive credentials and are configured for secure deployments to Google Cloud.

Quick Start

Validate the security of your GitHub Actions workflows in the '.github/workflows/' directory.