# GitHub Actions Workflow Hardening

`github-actions/workflow-hardening` · Skill · v1.0.0

Secure GitHub Actions workflows as they work in late 2026, from script injection and pwn requests to SHA pins and tokenless npm publishing.

Teaches an agent to write and fix GitHub Actions workflows that hold credentials safely: no untrusted text expanded into shell or github-script code, no pull request code in pull_request_target or workflow_run jobs (including the right fix when actions/checkout v7 refuses fork checkouts), least-privilege GITHUB_TOKEN permissions, actions pinned to real commit SHAs on current majors, and OIDC instead of stored secrets, including npm trusted publishing with its npm 11.5.1, runner and repository.url requirements. Includes the platform changes of 2025-2026 that models trained earlier get wrong.

## Verdict

- level: **submitted** — In the catalog, not yet checked for this digest.
- uplift: **untested** — No runs exist for this digest.
- digest: `sha256:d6ba5f8e1c111d67930f51512aacdcb2822f2b19ba4fbe87347ed905c8ff6118`

## Uplift runs

None for this digest. Untested is not the same as useless: nobody has measured it yet.

## Security

No checks recorded for this digest.

## Compatibility

| agent | targeted | compiled | evaluated |
| --- | --- | --- | --- |
| Claude Code | yes | no record | no record |
| Codex | yes | no record | no record |
| Cursor | yes | no record | no record |
| GitHub Copilot | yes | no record | no record |
| Gemini CLI | yes | no record | no record |
| OpenCode | yes | no record | no record |

## Permissions

- network: github.com, api.github.com
- shell: git ls-remote, gh api, zizmor, actionlint
- filesystem: write
- env: none

## Files

- `SKILL.md` 17498 B sha256:9acb8090820c735c432adf7ed7e1cee65c2ecf7a6202f9a14882e7f056a5dbcd
- `references/injection.md` 4345 B sha256:171e948c30bcf887b118d107a9772abd0282ef631082a66baf4d09b992251213
- `references/npm-trusted-publishing.md` 5278 B sha256:ddbd0878560b3e3832d62d87b47ab0837cbc1f94e0791a64908edbe9e64a49dd
- `references/oidc-clouds.md` 2581 B sha256:35f41af7caf30cb105b7e5d64d4d816debd07b6d9aaabab3e050c6513f6dfd42
- `references/pinning.md` 3467 B sha256:47b9bcb8751494e273d0c7c722cc88120980163c5492a1347b76abe47b92a0ea
- `references/privileged-triggers.md` 6609 B sha256:3771358a4f2d27b3c0556919484655c0c8056af184199928705edb0615511f85
- `references/sources.md` 3152 B sha256:9dc042087056e131ada0f52cbae1bf3baa390c3bec06b15dd1ff89bb5faa7ccc

## Limitations

- Written for github.com as of November 2026. GitHub Enterprise Server lags behind (artifact actions v4+, checkout v7 and workflow lockfiles may be missing).
- Commit SHAs in the references were resolved on 2026-11-01. Pinning newer releases needs network access to github.com, or an existing pin in the repo.
- It does not audit the code inside third-party or composite actions; a pinned malicious action is still malicious.
- Cloud OIDC guidance covers the AWS, Google Cloud and Azure login actions, not the design of the cloud-side IAM policies.
- The proof suite measures script injection, fork pull request checkouts and npm trusted publishing. Cloud OIDC, caching and reusable workflows are not measured.

## Install

```sh
npx sigil add github-actions/workflow-hardening --agent claude-code,codex,cursor
```

Source: https://github.com/dgesteves/sigil/tree/5cb851d5b2f2f14446ddf631ef5e91bf9d3263dd/catalog/skills/github-actions/workflow-hardening