domains / families / security / securing-github-actions-workflows

securing-github-actions-workflows

separate

'Hardens GitHub Actions workflows against supply chain attacks, credential

When to use

• When GitHub Actions is the CI/CD platform and workflows need hardening against supply chain attacks
• When workflows handle secrets, deploy to production, or have elevated permissions
• When preventing script injection via untrusted PR titles, branch names, or commit messages
• When requiring audit trails and approval gates for workflow modifications
• When third-party actions pose supply chain risk through mutable version tags

When not to use

• securing other CI/CD platforms
• application vulnerability scanning
• secret detection in code

Skill page

Source