← All work
Freelance demo
GitHub Actions Hardening kit
Live on GitHub · real repository
Before/after workflows, an audit tool that scores a repository's GitHub Actions security, an incident-exposure check for the 2025-26 supply-chain attacks, a secrets-history scan that produces a rotation plan, reusable hardened workflows and an OIDC Terraform module.
Highlights
- 16 rules: unpinned actions, token permissions, pull_request_target, script injection...
- "Were we affected?": references, git history and workflow runs inside the tj-actions, reviewdog, Trivy and Checkmarx windows
- Secrets in history turned into a rotation plan - values never shown or tested
- AWS access with zero stored keys
Built with
More detail
The README in the repository has the architecture diagram, the exact commands, the costs and the design trade-offs.