Code
Harden your CI pipeline
Unpinned actions, over-broad secrets, and what an attacker would do with them.
Fill it in
Where the workflow files are.
Third-party actions, pinning, and what they can reach.
As a diff.
Your prompt
Audit the pipeline in [the pipeline]. The threat model is that CI has the credentials and runs code from a pull request. Everything follows from that: which triggers run untrusted code, what secrets are in scope when they do, and whether a fork can reach them. Check every third-party action. Unpinned to a tag means the maintainer, or anyone who takes their account, can change what runs with your secrets tomorrow. Pin to a commit SHA and say which ones you could not verify. Look for secrets passed more broadly than needed, artifacts uploaded with more than intended, and caches that a pull request can poison. Write the fixes as a diff. Rank by what an attacker gets, not by how unusual the pattern is.
Use Harden your CI pipelineOpens with everything above already filled in.
Why this works
CI has the credentials and runs code from a pull request, and everything follows from that. This checks which triggers run untrusted code with secrets in scope, and pins third-party actions, since an unpinned tag lets a maintainer change what runs with your keys tomorrow.