How does this skill help eliminate long-lived secrets?

The hub provides implementation patterns for OIDC federation, which allows GitHub Actions to authenticate with cloud providers like AWS or Azure using short-lived tokens rather than stored passwords or keys.

What are the risks associated with the pull_request_target trigger?

The pull_request_target trigger runs in the context of the base repository and has access to secrets. Without strict input validation, it can be exploited by malicious PRs from forks to exfiltrate data or modify code.

Why should I use SHA pinning instead of version tags?

Version tags are mutable and can be repointed to malicious code by an attacker. SHA pinning uses immutable identifiers to ensure you only run the exact code that has been audited and approved.

Can these patterns be applied to self-hosted runners?

Yes, the skill includes specific guidance on runner hardening, including the use of ephemeral environments, network isolation, and runner group restrictions to prevent persistent compromise.

GitHub Actions Security Hub

Name: GitHub Actions Security Hub
Author: adaptive-enforcement-lab

byadaptive-enforcement-lab

Security & Testing

Implements hardened security patterns for GitHub Actions workflows, including SHA pinning, least-privilege permissions, and OIDC federation.

About

The GitHub Actions Security Patterns Hub provides a consolidated, authoritative set of production-ready security patterns to protect your CI/CD pipelines from common supply chain and infrastructure attacks. It streamlines the implementation of complex security controls by providing guidance on action pinning, GITHUB_TOKEN permission minimization, OIDC-based secret management, and secure workflow trigger configurations. This skill is essential for DevSecOps teams and developers who need to move beyond basic vendor checklists to implement robust, enterprise-grade security in their GitHub automation.

Key Features

Runner hardening checklists and ephemeral environment patterns
Least-privilege GITHUB_TOKEN permission templates
SHA-based action pinning for supply chain integrity
Secure trigger configuration to prevent fork-based attacks
0 GitHub stars
OIDC federation patterns for secret-less cloud access

Use Cases

Hardening existing CI/CD workflows against supply chain attacks
Implementing organizational security standards for public and private repositories
Eliminating long-lived secrets using OIDC for AWS, GCP, and Azure

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add adaptive-enforcement-lab/claude-skills github-actions-security-patterns-hub

For use in Claude.ai and ChatGPT

Download Skill

GitHub