Category Hub · 15 Guides
Harden your CI/CD pipelines from repository settings down to individual shell steps. Each guide cites official GitHub documentation and OpenSSF guidance inline so maintainers can verify behavior before changing workflow YAML or org policies.
.github/workflows.
Control which events, actors, bots, and shared workflow_call files can start jobs across your organization.
See whether GitHub's November 2, 2026 default block affects your public repository, inspect Policy Insights, and check SHA-pinned PR checkouts before runs stop.
Put actor and event allow-lists in front of workflow execution, measure real run impact in evaluate mode, and enforce policies without breaking releases.
Start a fast repository audit in priority order: unpinned third-party tags, overbroad GITHUB_TOKEN access, pull_request_target, shell input, and missing timeouts.
Understand how Dependabot PRs handle secrets and token scopes, review workflow-file bumps manually, and guard automerge rules.
Pin shared workflow_call references, replace blanket secrets: inherit with explicit inputs, and audit both caller and callee permissions.
Scope credentials to the exact job and ref that needs them, pin third-party actions to full SHAs, and verify build provenance.
Lock workflows to read-only defaults, scope write grants to individual jobs, and resolve organization greyed-out pull-request creation errors.
Replace mutable version tags with full 40-character commit SHAs, turn on repository SHA-pinning policy, and pair pins with automated update PRs.
Eliminate wildcard subject claims in AWS, Azure, and GCP roles by filtering OIDC tokens to exact repositories, refs, environments, and deploy jobs.
Bind release binaries and packages to verifiable workflow provenance and enforce signer checks before deployment or installation.
Drop long-lived npm publish tokens in favor of OIDC trusted publishing, provenance attestations, and isolated release job permissions.
Keep untrusted fork inputs, job summaries, restored caches, and self-hosted runner machines from leaking secrets or tampering with builds.
Automatic secret masking inside GITHUB_STEP_SUMMARY is best-effort. Replace raw command output with fixed templates and validated summary fields.
Keep base-repository secrets and write tokens away from untrusted fork code by separating metadata labeling from build execution.
Keep PR titles, branch names, and issue comments out of inline ${{ }} shell interpolation by passing untrusted context through environment variables.
Scope restore keys to lockfiles, understand branch cache inheritance, and stop release jobs from trusting dependencies restored from lower-trust runs.
Keep public pull requests off persistent hosts, segment capacity with runner groups, and provision ephemeral clean machines per job.