OpenAgentSkill Registry Manifest
Skill: harden-gitlab-ci
Slug: jrjsmrtn-harden-gitlab-ci
Category: security
Description: Harden GitLab CI/CD pipelines for supply-chain security — SHA-pin `include:` and CI/CD components, scope the `CI_JOB_TOKEN` allowlist, protect and mask variables, pin job image digests, and use `id_tokens`/OIDC instead of long-lived secrets. Use when adding or auditing a `.gitlab-ci.yml`, before making a GitLab project public, when a supply-chain review flags CI gaps, or when standardizing pipeline hardening across GitLab projects (gitlab.com or self-hosted). GitLab-specific by design — for GitHub Actions use `harden-github-actions`; Forgejo/Gitea Actions are out of scope.

Agent fit:
- Decision: 57/100 Needs manual review
- Primary fit: GitHub automation
- Role: Needs validation

Supply profile:
- Track: Coding and developer agents
- Scenario: GitHub automation
- Applicable agents: Claude Code, CLI, Codex, Cursor
- Maintenance: 1d since push
- Risk: Needs review

Trust:
- Trust score: 66/100 Manual review
- Audit: 72/100 Needs review

Attribution:
- Status: Registry indexed
- Source: recursive skill source sync
- Creator: jrjsmrtn
- Claim URL: https://www.openagentskill.com/skills/jrjsmrtn-harden-gitlab-ci#claim-this-skill

Install:
npx skills add jrjsmrtn/project-orchestration-skills --skill harden-gitlab-ci

URLs:
- Web: https://www.openagentskill.com/skills/jrjsmrtn-harden-gitlab-ci
- API: https://www.openagentskill.com/api/agent/skills/jrjsmrtn-harden-gitlab-ci
- Install API: https://www.openagentskill.com/api/skills/jrjsmrtn-harden-gitlab-ci/install
- Repository: https://github.com/jrjsmrtn/project-orchestration-skills/tree/main/skills/harden-gitlab-ci