Template pack · $29
Hardened CI templates for the edge cases that keep biting teams.
A compact set of GitHub Actions and GitLab CI starting points with dated known-failure notes. Buy it when you want the boring guardrails in place before a full human teardown.
What's inside
Twelve small templates, written for the failure modes that survive copy-paste.
SHA-pinned action starter
Checkout, cache, lint, and release steps pinned to full commit SHAs with version comments for maintainers.
Secret-safe intake gate
A paste-only CI input pattern that rejects obvious credentials before a job ever stores or forwards them.
Runner-cost trim pass
Matrix and cache examples that keep coverage meaningful without paying for redundant green checks.
GitLab parity notes
Equivalent GitLab CI fragments for the same controls, with the places GitLab's semantics differ called out.
Template preview
A control with the date baked into the note.
Each template includes the hardening move and the reason it exists, so future maintainers can tell whether the advice is still current.
github-actions/checkout-sha-pinned.yml
permissions:
contents: read
steps:
- name: Checkout source
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
# v4.2.2, checked 2026-06-09.
# Avoid moving tags on critical workflow steps.One-off download
Start from the guarded version.
The pack is separate from a review: no entitlement, no custom verdict, no claim that your exact pipeline is safe. It is the public starter kit. Purchase includes occasional dated Countersign advisories, each with a one-click unsubscribe.