ci-cd-security

name	ci-cd-security
description	Security best practices for GitHub Actions workflows, supply chain security, and secure CI/CD pipelines
license	Apache-2.0

CI/CD Security Skill

🔴 AI FIRST Quality Principle

Apply the AI FIRST principle: never accept first-pass quality. Minimum 2 iterations. Read all output, improve every section. No shortcuts.

Purpose

Implement security-hardened CI/CD pipelines using GitHub Actions with least privilege, supply chain security, and comprehensive monitoring.

Core Principles

1. Least Privilege Permissions

Always grant minimum necessary permissions:

permissions:
  contents: read       # Read repo content
  pull-requests: write # Only if managing PRs
  issues: write        # Only if managing issues
  # Deny everything else by default

2. Pin Actions to SHA

Never use tags - always pin to commit SHA:

# ❌ Bad: Using tag (can be moved)
- uses: actions/checkout@v4

# ✅ Good: Pinned to SHA (immutable)