GitHub Actions 安全加固

原名：github-actions-hardening

检查工作流权限、第三方 Action 固定版本、秘密使用和不可信输入。

中文 Skills 技能说明

适合 CI/CD 上线或依赖升级前的防御性审查。默认只读分析 YAML 与依赖，建议最小权限和固定提交；修改工作流、轮换密钥或发布前必须人工确认，不提供攻击利用。

上游能力依据

上游原始适用说明：Security hardening reviewer for GitHub Actions workflow files (.github/workflows/.yml). Reasons about the Actions threat model that pattern matchers and general code linters miss — untrusted-input script injection, privileged triggers running fork code, mutable action references, and over-scoped tokens. Use this skill when asked to review, audit, harden, or secure a GitHub Actions workflow, when writing a new workflow, or for any request like "is this workflow safe?", "review my CI for security issues", "why is pullrequesttarget dangerous here?", "pin my actions", or "lock down GITHUBTOKEN permissions". Covers script injection via ${{ }} interpolation, pullrequesttarget / workflowrun privilege escalation, SHA-pinning of third-party actions, least-privilege permissions, GITHUBENV/GITHUBOUTPUT injection, secret exposure, OIDC over long-lived credentials, and self-hosted runner exposure on public repositories.

上游 SKILL.md 主要章节（保留原文标题）：

• When to Use This Skill
• The Core Insight
• Execution Workflow
• Step 1 — Map the Triggers and Trust Level
• Step 2 — Hunt for Script Injection
• Step 3 — Check Privileged Triggers Don't Execute Untrusted Code
• Step 4 — Audit permissions
• Step 5 — Audit Action References (Supply Chain)
• Step 6 — Check Secret and Output Handling
• Step 7 — Produce the Report

使用边界

先确认授权范围、资产边界和证据来源。输出用于防御性检查与人工决策，不自动执行攻击、绕过或破坏性操作。

作者、翻译与许可证

原作者

GitHub, Inc. 与 awesome-copilot contributors

中文翻译

CEOFans翻译

许可证

MIT

上游来源

https://github.com/github/awesome-copilot/tree/3f0bba475ec40b9680e1d0311b9caffeec5ad4c3/skills/github-actions-hardening

适用范围

平台：linux、macos、windows；标签：安全与合规、GitHub Actions 安全加固

安全提示

基础静态扫描不等于绝对安全。技能可能调用命令、浏览器、云服务或本地文件，请在最小权限环境中使用，高风险操作必须人工确认。

如发现侵权、许可证或安全问题，可在本页前台提交投诉，管理员复核后可立即下架。