GitHub Actions Security
GitHub Actions runs code with access to your secrets, your code, and increasingly your cloud accounts. Most teams ship workflows with the defaults, which are convenient but expose more than necessary. This skill is the working baseline for production-grade Actions usage.
When to invoke
- Adding a new workflow
- Introducing a third-party action (
uses: someone/some-action@v1) - A workflow leaked a secret (cleanup + prevention)
- Migrating from long-lived cloud cre
[Description truncada. Veja o README completo no GitHub.]