Self-hosted alternatives to github-actions-hardening

G

github-actions-hardening

Security hardening reviewer for GitHub Actions workflow files

github-actions-hardening is an agent skill from the github/awesome-copilot collection that reviews GitHub Actions workflow files for security weaknesses. It focuses on the threat model specific to Actions rather than the application code a general scanner checks. Its premise is that most workflow risks are invisible to language linters, because the dangerous part is the YAML itself and the way GitHub expands expressions into a shell before a script runs. The review looks at where trust boundaries sit in the different trigger types, what permissions the workflow token has and whether they are scoped down, and whether untrusted input, such as a pull request title or branch name, is interpolated into a shell command where it could inject commands. It applies to workflow files under .github/workflows and to requests about securing CI. The output points to the specific lines and explains how each risk could be exploited, along with a hardened alternative. It is useful for maintainers of repositories that accept contributions from outside, because workflows triggered by outside pull requests are a common route to leaked secrets. A review is not a guarantee, so the team should test the changed workflows and rotate any secret that may have been exposed. The skill is installed with the skills CLI from the github/awesome-copilot repository. Its skills.sh page showed about 1.9K installs and passing results from three security audits at the time of the scan.