OpenAgentSkill Registry Manifest
Skill: harden-github-actions
Slug: jrjsmrtn-harden-github-actions
Category: security
Description: Harden GitHub Actions CI/CD workflows for supply-chain security — SHA-pin actions, least-privilege token permissions, verified toolchain installs, OpenSSF Scorecard, and SLSA provenance. Use when adding or auditing GitHub Actions workflows, before making a repository public, when a supply-chain review flags CI gaps, or when standardizing CI hardening across GitHub projects. GitHub-specific by design — GitLab CI and Forgejo Actions are out of scope.

Agent fit:
- Decision: 57/100 Needs manual review
- Primary fit: GitHub automation
- Role: Needs validation

Supply profile:
- Track: Coding and developer agents
- Scenario: GitHub automation
- Applicable agents: Claude Code, CLI, Codex, Cursor
- Maintenance: 1d since push
- Risk: Needs review

Trust:
- Trust score: 67/100 Manual review
- Audit: 73/100 Needs review

Attribution:
- Status: Registry indexed
- Source: recursive skill source sync
- Creator: jrjsmrtn
- Claim URL: https://www.openagentskill.com/skills/jrjsmrtn-harden-github-actions#claim-this-skill

Install:
npx skills add jrjsmrtn/project-orchestration-skills --skill harden-github-actions

URLs:
- Web: https://www.openagentskill.com/skills/jrjsmrtn-harden-github-actions
- API: https://www.openagentskill.com/api/agent/skills/jrjsmrtn-harden-github-actions
- Install API: https://www.openagentskill.com/api/skills/jrjsmrtn-harden-github-actions/install
- Repository: https://github.com/jrjsmrtn/project-orchestration-skills/tree/main/skills/harden-github-actions