secure-github-action

What problem does it solve?

This skill secures GitHub Actions workflows by pinning all action references to full commit SHAs and enforcing safer configurations.

Core Features & Use Cases

• Pin all actions to full commit SHAs to prevent drift and supply-chain risks.
• Enforce minimal permissions at workflow and job levels to limit blast radius.
• Harden checkout and prevent unsafe script injection by safe env usage and controlled run contexts.
• Use cases: teams migrating sensitive CI pipelines to enforce security standards across multiple repos.

Quick Start

Apply core security steps to your workflows: pin SHAs, set permissions, and avoid pull_request_target for privileged operations. Then update your workflow files against these guidelines.