harden-github-actions

# Harden GitHub Actions Harden GitHub Actions CI/CD workflows against supply-chain attack: pin what runs, minimise what it can do, and verify what it fetches. > **GitHub-specific by design.** Unlike most orchestration skills, this one is deliberately bound to > one forge. The hardening controls below are not portable concepts wearing GitHub syntax — they are > properties of the GitHub Actions execution model itself: third-party actions resolved by mutable > git ref, an ambient `GITHUB_TOKEN` with **repository-wide default scopes**, and OIDC-backed SLSA > provenance. It has a **sibling**, `harden-gitlab-ci`, which is not a translation of this skill: > GitLab's risks sit in different places (`include:`/CI-Catalog components, and a `CI_JOB_TOKEN` that > defaults to *own-project-only* — so there the work is keeping it scoped, the opposite posture from > here). Forgejo Actions is Actions-compatible in shape but resolves actions against its instance's > configured registry, so pinning guidance does not transfer unchanged (roadmap H9). ## When to Use - When adding GitHub Actions workflows to a project (after `setup-git-hooks`) - When auditing existing `.github/workflows/` before making a repository public - When a supply-chain review (or the `supply-chain` skill) flags CI hardening gaps - When standardising CI hardening across GitHub projects **Not for:** GitLab CI — use `harden-gitlab-ci`. Not for Forgejo/Gitea Actions — the controls do not carry over unchanged. Say so rather ...