Securing Your GitHub Actions: A Hands-On Guide to gh-workflow-hardener

Securing Your GitHub Actions: A Hands-On Guide to gh-workflow-hardener If you read my previous piece on the tj-actions supply chain attack — hitting 23,000 repos in March 2025 — you might be wondering: what do I actually do about it? Running grep -r "tj-actions" .github/workflows/ isn't enough. Even if you patch that one action, you're still vulnerable to the next attack. Your workflows need a security layer . This is why I built gh-workflow-hardener — a fast, zero-dependency GitHub Actions security scanner that detects the patterns that enable supply chain attacks, not just the exploits themselves. The Problem: Actions Are a Trust Surface Most developers don't realize this: # .github/workflows/ci.yml - uses : some-action@v1 # Who controls this tag? - uses : some-action@main # This ALWAYS pulls the latest commit - uses : some-org/some-action@refs/heads/main # Explicit branch = mutable All three are dangerous. Tags can be force-pushed. Branches move. Even pinned SHAs can be rewritten if