cicd-security

仓库创建 2026年7月1日最近提交 23 天前SkillHot 收录 22 天前

▸ 精选理由

适合自动化检测与修复流水线安全配置的场景

这个 Skill 做什么

加强 GitHub Actions/GitLab CI 等流水线的安全，防止供应链与密钥泄露。

把 GitHub Actions、GitLab CI 等流水线的安全细节补齐，防止第三方 action 被篡改或密钥被窃取。在搭建、审查或合并外部 workflow、上线 CI/CD 流程时用。会建议给第三方动作打 SHA pin、限制权限与变量、隔离 runner，并着重防范供应链攻击和 pwn-request 式滥用。

▸ 展开 SKILL.md 英文原文

Harden GitHub Actions, GitLab CI, and similar pipelines against supply-chain attacks, secret exfiltration, and pwn-request style abuses

开发编程CI/CD安全供应链通用

Stars

Forks

仓库内 Skill

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/ShieldNet-360/secure-vibe/main/skills/cicd-security/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/ShieldNet-360/secure-vibe/main/skills/cicd-security/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

# CI/CD Pipeline Security

## Rules (for AI agents)

### ALWAYS
- Pin every third-party GitHub Action by **commit SHA** (full 40-char),
  not by tag — tags can be re-pushed. Same applies to GitLab CI `include:`
  references and reusable workflows. Renovate / Dependabot can keep the
  SHA pins fresh.
  <!-- pattern: { id: gha-pin-actions-by-sha, severity: high, check: deterministic } -->
- Declare `permissions:` at the workflow or job level and default to
  `contents: read` only. Grant additional scopes (`id-token: write`,
  `packages: write`, etc.) job-by-job, never workflow-wide.
  <!-- pattern: { id: gha-default-permissions-read, severity: high, check: deterministic } -->
- Use **OIDC** (`

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有