Skip to main content
The Secure Workflow Hardener at pipefort.com/harden is a free, no-sign-in tool: paste a GitHub Actions workflow, choose which fixes to apply, and get the hardened YAML back to copy into your repo. It runs the same in-memory auto-fixer as the app’s Open fix PR button — Pipefort scans the pasted content, then rewrites it deterministically. The workflow you paste is never stored: the transform happens on the request and the result is returned inline.

​
How it works

  1. Paste your .github/workflows/*.yml into the editor (or load the example).
  2. Harden — Pipefort scans the YAML and applies every available fix, then shows the result as a line-by-line diff so you can see every change before taking any of it.
  3. Tick the fixes you want — the applicable fixes sit in a rail beside the diff. Unticking one re-hardens without it and its lines revert in place; hovering one dims every change that is not its own. Then Copy the result.
Both of those behaviours need to know which lines belong to which fix, and the response says so directly: every fix carries the hunks it produced (see the API reference). If a change somehow belongs to no fix, the rail says so rather than presenting the checkboxes as if they covered the whole diff.

​
What it fixes

The hardener applies the auto-fixable subset of Pipefort’s rules, grouped into selectable fixes: The exact set reflects Pipefort’s auto-fixable rules and grows as more fixers land. Only the fixes that actually apply to your workflow are shown.
Pinning to a SHA resolves the tag over the public GitHub API. That step needs network access, so a very large workflow with many unpinned actions can take a few seconds — or you can uncheck Pin actions to a commit SHA to skip it. Every other fix is a purely local text transform.

​
When there is nothing to fix

A workflow that already passes all five controls gets a result, not a shrug: what held, the file itself with a 5 / 5 controls mark, and two things to do next — copy a README badge, or check another file. It also says what a clean file does not prove. One clean workflow is not a clean repo: the SHAs pinned in it go stale, and the next person to edit it will not know these rules exist. That is the part a scanner in CI does and a paste box cannot.

​
The README badge

Copy a README badge gives you the markdown for GET /api/badge/{owner}/{repo}.svg — the embeddable status badge, which is also documented as part of the public scan surface.
The badge reports the latest public scan of a whole repository, which is a different claim from the one the hardener just made about one pasted file. So the hardener copies the snippet with OWNER/REPO left for you to fill in, and says so — a badge asserting “secured” on the strength of a single clean file would be wrong in the most damaging way: true-looking, in a README, for years. On a shared public-scan page, where the repository is known, the snippet is filled in for you.

​
Relationship to scanning

The hardener is a quick, anonymous way to clean up a single file. For ongoing coverage — every workflow in every repo, with history, trends, and one-click fix PRs — connect the repository and let Pipefort scan it. Same fixer, applied continuously.