GitHub Actions Hardening
Reviews workflow YAML for the ways CI specifically gets compromised.
Install
gh skills install github/awesome-copilot github-actions-hardening
.github/workflows altına yeni bir dosya yazarken ya da mevcut birini gözden geçirirken; pull_request_target, workflow_run, issue_comment tetikleyicileri veya GITHUB_TOKEN izinleri söz konusuysa
- Author
- Amir
- License
- MIT
The trust boundaries in a GitHub Actions workflow live in the YAML, not in the application code a language linter reads. This skill goes after that surface: expressions that paste an issue title or branch name into a shell before it runs, pull_request_target and workflow_run triggers that hand fork code a privileged token, actions bound to a mutable tag instead of a commit SHA, and GITHUB_TOKEN scopes wider than the job needs. Five reference files split the work into injection, triggers and privilege, permissions and tokens, supply chain, and the shape of the report.
Similar skills
GitHub Actions Templates
SkillWorking workflow files instead of a blank .github directory.
Git & PR Workflows
SkillDrives review to pull request as ordered steps that write state to disk, not to the context window.
CI/CD Pipeline Builder
SkillDetects the stack from the repository, then writes a pipeline that matches it.
Comments(0)
Sign in to comment