GitHub Actions Hardening
Reviews workflow YAML for the ways CI specifically gets compromised.
Install
gh skills install github/awesome-copilot github-actions-hardening
.github/workflows altına yeni bir dosya yazarken ya da mevcut birini gözden geçirirken; pull_request_target, workflow_run, issue_comment tetikleyicileri veya GITHUB_TOKEN izinleri söz konusuysa
- Author
- Amir
- License
- MIT
The trust boundaries in a GitHub Actions workflow live in the YAML, not in the application code a language linter reads. This skill goes after that surface: expressions that paste an issue title or branch name into a shell before it runs, pull_request_target and workflow_run triggers that hand fork code a privileged token, actions bound to a mutable tag instead of a commit SHA, and GITHUB_TOKEN scopes wider than the job needs. Five reference files split the work into injection, triggers and privilege, permissions and tokens, supply chain, and the shape of the report.
Similar skills
CI/CD Pipeline Builder
SkillDetects the stack from the repository, then writes a pipeline that matches it.
CodeRabbit Code Review
SkillRuns CodeRabbit's reviewer from inside the agent and applies its PR feedback change by change.
GitHub Actions Templates
SkillWorking workflow files instead of a blank .github directory.
Comments(0)
Sign in to comment