Security Baseline

Security Baseline Skill

Purpose

Audit and implement security best practices for GitHub repositories, including secret scanning, dependency audits, and security hardening.

Triggers

• "audit repository security"
• "add secret scanning"
• "check for vulnerabilities"
• "security hardening"
• "add pre-commit hooks"
• "configure dependabot"

Usage

Run a security audit on any repository to identify gaps, then use the provided checklists and commands to implement security controls systematically.

Security Audit Checklist

GitHub Actions Security

• All actions SHA-pinned
• Minimal permissions: declared
• No secrets in logs
• OIDC instead of static credentials
• Untrusted input sanitized

Repository Security

• Branch protection enabled
• Required reviews
• Status checks required
• Force pushes blocked
• CODEOWNERS defined

Secret Management

• No hardcoded secrets
• .env files ignored
• Gitleaks configured
• GitHub secret scanning enabled
• Pre-commit hooks installed

Dependency Security

• Dependabot enabled
• Lock files committed
• No critical CVEs
• Regular audits scheduled

SHA Pinning Validation

# Check for unpinned actions
grep -rn "uses:.*@v[0-9]" .github/workflows/
grep -rn "uses:.*@main" .github/workflows/

# Validate all workflows
./scripts/validate-sha-pinning.sh .github/workflows/

Safe Permission Patterns

# Minimal (default)
permissions:
  contents: read

# For PR comments
permissions:
  contents: read
  pull-requests: write

# For releases
permissions:
  contents: write
  packages: write

OIDC Authentication

# AWS
permissions:
  id-token: write
  contents: read

steps:
  - uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
    with:
      role-to-assume: arn:aws:iam::123456789:role/github-actions
      aws-region: us-east-1

Secret Scanning Setup

Gitleaks Configuration

# gitleaks.toml
[allowlist]
paths = [
  '''\.example$''',
  '''test/fixtures''',
]

Pre-commit Hook

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks

Dependency Audit Commands

# Python
uv pip audit

# Node.js
pnpm audit

# Go
go list -json -m all | nancy sleuth

# Rust
cargo deny check advisories

Required Security Files

Vulnerability Response

Quick Security Commands

# Run gitleaks
gitleaks detect --source . --verbose

# Check git history
gitleaks detect --source . --log-opts="--all"

# Find workflows without permissions
for f in .github/workflows/*.yml; do
  grep -q "^permissions:" "$f" || echo "Missing: $f"
done

Source: zircote/.github — distributed by TomeVault.