Github actions security hardening

Skill chf3198/megingjord-harness/skills/github-actions-security-hardening

AI agent governance harness: baton workflow, fleet LLM routing (Ollama/Claude/OpenRouter), and CI gates for Copilot, Claude Code, and Codex.

Install

npx -y skills add chf3198/megingjord-harness --skill github-actions-security-hardening

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Enforce secure GitHub Actions posture with least-privilege tokens, pinned dependencies, runner risk controls, and workflow supply-chain checks.

SKILL.md

2.4 KB, as published. Nobody here has run it

GitHub Actions Security Hardening

Purpose

Reduce CI/CD and workflow supply-chain risk while preserving delivery velocity.

Core controls

GITHUB_TOKEN least privilege (default read, elevate per-job only when required).
Third-party actions pinned to full commit SHA where policy requires.
Secrets hygiene (least privilege, rotation, masking, no plaintext leakage).
OIDC preferred over long-lived cloud credentials.
CODEOWNERS coverage for .github/workflows/.
Dependency and vulnerability monitoring for Actions dependencies.
Runner strategy hardening (hosted preferred for untrusted PRs; strict controls for self-hosted).
Optional: block or limit Actions ability to create/approve PRs where policy requires.

Hard constraints

No auto-remediation that broadens permissions.
No direct write changes to production deployment workflows without explicit approval trail.
If workflow trust boundaries are unclear, return NO_CHANGE.

Output contract

ACTIONS_SECURITY_REPORT
mode: <audit|plan|remediate|verify>
scope: <repo|org>
runner: <hosted|self-hosted|mixed>
policy_profile: <strict|standard|light>

checks:
- id: A1
  control: <token-permissions|pinning|oidc|...>
  result: <pass|fail|partial>
  evidence: <file/setting/observation>
  risk: <low|medium|high>

actions:
1) priority: <P1|P2|P3>
   change: <specific remediation>
   verification: <objective check>

decision:
- <apply|defer|NO_CHANGE>

missing_evidence:
- <none or required artifacts>

Invocation policy

Run in pre-merge for workflow/security-sensitive changes and in periodic governance audits.

Repo workflow inventory

Workflow	Trigger	Permissions	Status
`.github/workflows/lint.yml`	PR/push to main	default read	✅ active
`.github/workflows/label-lint.yml`	issues events	`issues:write`, `contents:read`	✅ active (ADR-010)

label-lint.yml enforces ADR-010 rules 1–4 on every issue event. Any violation posts an explanatory comment and fails the check. See research/adr/010-ticket-status-role-model.md.