GitHub Actions security
Harden release workflows before one permissive YAML file becomes a supply-chain problem.
GHA Guard Pro Kit is a paid Node source kit for local GitHub Actions review: workflow risk checks, conservative auto-fixes, markdown PR reports, and secure templates buyers can adapt inside their own repos.
Checks Covered
Flags missing top-level permissions, broad write grants, write-all, and checkout credential persistence.
Finds unsafe pull_request_target patterns and direct shell interpolation from untrusted contexts.
Looks for mutable action references, missing job timeouts, and broad runner labels on sensitive jobs.
Delivered Source
Run local scans with text, JSON, or markdown output for CI comments and PR review.
Applies mechanical defaults like least-privilege permissions and timeouts without pretending to pin third-party SHAs for you.
Includes secure workflow examples, a composite action template, remediation docs, tests, and buyer smoke checks.
Why teams buy it
| Workflow drift | What the kit checks | Buyer outcome |
|---|---|---|
| Release jobs gain broad default token rights. | Top-level and job-level permissions, write-all, and broad write scopes. | Reviewers get a repeatable least-privilege baseline before tags or packages ship. |
| Forked PR workflows can run dangerous contexts. | pull_request_target patterns, untrusted interpolation, and risky shell usage. | Maintainers can block unsafe YAML changes without manually reading every expression. |
| Third-party actions and runners stay too loose. | Mutable action refs, broad runner labels, missing timeouts, and checkout credential persistence. | Teams get specific remediation notes and templates they can adapt locally. |
Buyer Verification
The paid zip includes runnable checks: npm run verify:manifest,
npm test, and npm run smoke:buyer. Gumroad currently
serves the attached paid file for the live checkout.