Secure GitHub Actions

Enforces supply chain hardening rules for GitHub Actions workflows. Every rule below addresses a real vulnerability class found in security audits of production workflows.

When to Use

• Writing a new .github/workflows/*.yml file
• Modifying an existing workflow
• Reviewing a PR that touches workflow files
• Adding a secret, action reference, or reusable workflow call
• Configuring claude-code-action or claude-code-base-action

When NOT to Use This Skill

This skill is specifically for GitHub Actions workflow YAML files. If you reach it but the actual task is one of the below, step aside: say in a single line that the rules here only apply to .github/workflows/*.yml edits and continue with the real task. Do not run the audit grep commands or the pre-PR checklist on unrelated code.