GitHub Actions hardening

ActionPin

Install one GitHub App to scan workflows, explain security risks, open deterministic remediation PRs, and block unsafe workflow changes before merge.

High-signal rules

Reviewable fix PRs

PR guardrails

Org posture

Acme Labs

score 62

low

medium

high

critical

Third-party action is not pinned to a full commit SHA

.github/workflows/release.yml

pull_request_target combines privileged context with untrusted code

.github/workflows/triage.yml

acme-labs/app

repo score

acme-labs/api

repo score

acme-labs/docs

repo score