Securing CI/CD: A Multi-Layered Toolkit for GitHub Actions Integrity

I Built a Complete GitHub Actions Security Toolkit in One Day

Developer Olivier Buitelaar released a suite of five tools designed to prevent GitHub Actions workflows from breaking silently. The toolkit addresses the high-risk reality where workflow issues often remain undetected until they reach production environments.

Why This Matters

The technical reality of CI/CD often diverges from ideal security models due to complex configurations like path filter bugs and unpinned actions. While idealistic models assume perfect manual review, the scale of modern development requires automated linting at the editor, CLI, and CI levels to prevent security footguns and production surprises.

Key Insights

• workflow-guardian (2026) lints workflows during CI to detect unpinned actions and deprecated commands.
• Workflow Linter provides editor-time feedback via a VS Code extension to catch issues before the commit stage.
• ghact allows for terminal-based linting of workflows in any repository via an npm CLI.
• test-results-reporter aggregates JUnit/Jest/pytest results into a single PR comment with flaky test detection.
• pr-size-labeler automatically categorizes PRs by diff size (XS to XL) while excluding lock files to improve review quality.

Working Examples

Implementation of workflow-guardian in CI

- uses: ollieb89/workflow-guardian@v1

Installing and running the ghact CLI

npm install -g ghact
ghact

Aggregating test results in a GitHub Action

- uses: ollieb89/test-results-reporter@v1

Automated PR size labeling

- uses: ollieb89/pr-size-labeler@v1

Practical Applications

• Use Case: Engineering teams using workflow-guardian to enforce security standards like action pinning during the PR process. Pitfall: Ignoring CI-time linting leads to insecure third-party action dependencies.
• Use Case: Individual developers using the Workflow Linter VS Code extension to reduce the ‘push-and-pray’ cycle. Pitfall: Relying only on remote CI runs for syntax validation wastes compute resources and time.

References:

• https://dev.to/ollieb89/i-built-a-complete-github-actions-security-toolkit-in-one-day-4a84