Why should I pin GitHub Actions to a commit SHA?

Using tags like @v4 is insecure because tags are mutable; a contributor or attacker could force-push a change to that tag. Pinning to a SHA ensures the code you run is immutable and verified.

How do I update pinned actions to a newer version?

You can use the 'gh actions-versions upgrade' command through the skill to automatically fetch the latest SHA for a specific action or all actions in your workflow.

Will I still know which version I am using if I pin to a SHA?

Yes, the skill follows a best practice of appending the version as a comment (e.g., # v4.1.1) next to the SHA for human readability.

Does this skill require additional tools?

Yes, this skill utilizes the 'gh-actions-versions' GitHub CLI extension to automate the process of fetching SHAs and updating workflow files.

GitHub Actions Security Manager

Name: GitHub Actions Security Manager
Author: jclem

byjclem

0•

部署与 DevOps

Secures GitHub Actions workflows by automatically pinning action references to immutable commit SHAs to prevent supply chain attacks.

The GitHub Actions security skill provides a robust framework for managing CI/CD dependencies by enforcing the use of immutable commit SHAs instead of mutable tags. By integrating with the gh-actions-versions CLI extension, this skill enables developers to automatically audit workflow files, fix insecure references, and perform verified upgrades. It is particularly useful for teams looking to harden their software supply chain and ensure that their automation pipelines remain consistent and protected against force-pushed or compromised tags.

主要功能

01Bulk verification of GitHub Action reference validity

02Automated pinning of mutable tags to immutable commit SHAs

03Streamlined workflow for updating and upgrading action versions

040 GitHub stars

05Integration with gh-actions-versions GitHub CLI extension

06Maintains version visibility through automated version comments

使用场景

01Hardening CI/CD pipelines against supply chain attacks and tag manipulation

02Automating dependency maintenance across complex GitHub Action workflows

03Auditing existing repositories for insecure or floating action references

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add jclem/work-old-2 github-actions

For use in Claude.ai and ChatGPT