CI Security and Compliance Skill
SkillSecurityYour AI can review third-party GitHub Actions, pin them safely, set minimal permissions, and handle secrets when working on CI workflows in the Camunda repository. The skill enforces GitHub Actions security and compliance for that repository, so changes follow its rules. It is meant to be used when adding third-party actions, handling secrets, or defining permissions.
Available today. Use it from your connected AI after setup.
No other account needed.
After adding the skill, ask your AI to review a workflow change or a third-party action you want to add. It will check the change against the repository's security and compliance rules.
Then ask your AI: use the CI Security and Compliance Skill skill
What your AI can do with it
- Review third-party GitHub Actions before they are added
- Pin third-party actions to a fixed version
- Set minimal permissions for CI workflows
- Handle secrets safely in CI workflows
- Weigh security trade-offs when CI changes are proposed
What this skill tells your AI
The instructions your AI receives, as published by camunda/camunda in .claude/skills/ci-security-compliance/SKILL.md and read by ahel’s review.
Consult docs/monorepo-docs/ci.md before decisions.
Third-Party Action Review Flow
- Verify necessity and alternatives.
- Check allowlist in
docs/monorepo-docs/ci.md(CI Security section). - Present both options:
- Option A: approved actions only
- Option B: unapproved candidate with security assessment
- If unapproved action is accepted:
- Add to allowlist in alphabetical order
- Pin commit SHA in workflow
- Request DRI review if trustworthiness is unclear
Never silently drop unapproved but relevant options.
Permissions Rules
Start with:
permissions: {}
Add only required scopes.
Secret Management
Vault is mandatory. GitHub Secrets are only for Vault bootstrap values:
VAULT_ADDRVAULT_ROLE_IDVAULT_SECRET_ID
Boundaries
- Always: least privilege, SHA pinning, Vault usage, explicit trade-offs
- Ask first: OIDC trust boundaries, new deployment targets
- Never: embedded credentials, broad permissions, untrusted
curl | bash
Reference
- Allowed action guidance:
references/approved-actions.md
Signals
- GitHub stars
- 4k
- Forks
- 818
- Last commit
- Sep 2026
Advanced
- Catalog kind
- skill
- Gateway key
ci-security-compliance- Source
- github.com/camunda/camunda