Copy-paste hardened CI/CD workflows with SHA-pinned actions, minimal GITHUB_TOKEN permissions, OIDC authentication, and comprehensive security scanning for GitHub Actions.
Provides copy-paste ready, hardened GitHub Actions workflows with SHA-pinned actions, minimal permissions, and OIDC authentication for CI, releases, and deployments. Use when you need production-ready workflow templates that integrate multiple security controls.
/plugin marketplace add adaptive-enforcement-lab/claude-skills/plugin install secure@ael-skillsThis skill inherits all available tools. When active, it can use any tool Claude has access to.
Ready-to-Deploy Templates
These examples integrate multiple security controls into production-ready workflows. Each template includes inline security comments, permission scoping, and cross-references to detailed pattern documentation.
Copy-paste ready workflows demonstrating all security patterns from this hub.
Each example integrates multiple security controls from across the hub: action pinning, minimal permissions, secret management, safe triggers, and more. All examples are complete and production-ready.
Ready-to-Deploy Templates
These examples integrate multiple security controls into production-ready workflows. Each template includes inline security comments, permission scoping, and cross-references to detailed pattern documentation.
Copy-paste ready workflows demonstrating all security patterns from this hub.
Each example integrates multiple security controls from across the hub: action pinning, minimal permissions, secret management, safe triggers, and more. All examples are complete and production-ready.
Hardened continuous integration with comprehensive security controls.
Key Patterns:
Use Cases: Test automation, PR validation, pre-merge quality gates
Signed releases with SLSA provenance and artifact attestations.
Key Patterns:
id-token: write and attestations: writeUse Cases: GitHub releases, container publishing, NPM publishing, signed artifacts
OIDC-based cloud deployment with environment protection and automated rollback.
Key Patterns:
Use Cases: Cloud Run deployment, Kubernetes/Helm deployment, multi-environment pipelines, canary releases
Comprehensive SAST, dependency scanning, container scanning, and SARIF upload.
Key Patterns:
Use Cases: Security validation, compliance scanning, vulnerability detection, scheduled audits
All examples use:
# SECURITY: comments explaining security decisionsEach example includes:
# SECURITY: comments explaining security decisionsThese examples reference patterns from:
.github/workflows/act or a draft PRFor additional guidance, see the Quick Reference Cheat Sheet.
Hardened continuous integration with comprehensive security controls.
Key Patterns:
Use Cases: Test automation, PR validation, pre-merge quality gates
Signed releases with SLSA provenance and artifact attestations.
Key Patterns:
id-token: write and attestations: writeUse Cases: GitHub releases, container publishing, NPM publishing, signed artifacts
OIDC-based cloud deployment with environment protection and automated rollback.
Key Patterns:
Use Cases: Cloud Run deployment, Kubernetes/Helm deployment, multi-environment pipelines, canary releases
Comprehensive SAST, dependency scanning, container scanning, and SARIF upload.
Key Patterns:
Use Cases: Security validation, compliance scanning, vulnerability detection, scheduled audits
All examples use:
# SECURITY: comments explaining security decisionsEach example includes:
# SECURITY: comments explaining security decisionsThese examples reference patterns from:
.github/workflows/act or a draft PRFor additional guidance, see the Quick Reference Cheat Sheet.
Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.