> For the complete documentation index, see [llms.txt](https://docs.stepsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stepsecurity.io/github/orchestrate-security/secure-workflow.md). # Secure Workflow The Secure Workflow feature in StepSecurity helps improve the security of GitHub Actions workflows by applying industry best practices. With a single click, users can harden their workflow configurations, restrict unnecessary permissions, and enhance security without manually modifying YAML files. ### Key Features * Restrict permissions for GITHUB\_TOKEN to follow the principle of least privilege. * Add StepSecurity's Harden-Runner security agent for monitoring and controlling the GitHub-hosted runner. * Pin all GitHub Actions to full-length commit SHAs to prevent supply chain attacks. ### How to Secure Your GitHub Actions Workflow #### Step 1: Access the StepSecurity Dashboard * Visit [StepSecurity Secure Workflow](https://app.stepsecurity.io/secure-workflow) or navigate to “Secure Workflow” under the Orchestrate Security section in your StepSecurity dashboard. #### **Step 2: Paste Your Workflow File** * Copy your GitHub Actions workflow file and paste it into the editor on the StepSecurity tool interface.

#### **Step 3: Click on the “Secure Workflow” Button** * Click the **“Secure Workflow”** button. * The tool will automatically enhance the security of your workflow by applying recommended settings: * Restrict permissions for \[\[GITHUB\_TOKEN]]. * Add [Harden-Runner](/github-actions/harden-runner.md) for the GitHub-hosted runner. * Pin actions to full-length commit SHAs.

#### **Step 4: Review and Apply the Suggested Changes** * The tool will show a diff view of your original workflow versus the secure version. * Key enhancements include: * Adjusted permissions to follow the principle of least privilege. * Integration of the StepSecurity Harden Runner with an audit egress policy. * Pinning all GitHub Actions to specific commit SHAs for better security

#### **Step 5: Save and Commit the Changes** * After reviewing the updates, copy the secure workflow provided by the platform. * Apply the updated workflow manually to your repository by pasting it into the appropriate file in your project. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.stepsecurity.io/github/orchestrate-security/secure-workflow.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.