Skip to main content
The Secure Workflow Hardener at pipefort.com/harden is a free, no-sign-in tool: paste a GitHub Actions workflow, choose which fixes to apply, and get the hardened YAML back to copy into your repo. It runs the same in-memory auto-fixer as the app’s Open fix PR button — Pipefort scans the pasted content, then rewrites it deterministically. The workflow you paste is never stored: the transform happens on the request and the result is returned inline.

​
How it works

  1. Paste your .github/workflows/*.yml into the editor (or load the example).
  2. Harden — Pipefort scans the YAML and applies every available fix, showing the result immediately.
  3. Tick the fixes you want — each applicable fix is a checkbox. Toggle any of them to re-harden with just the changes you want, then Copy the result.

​
What it fixes

The hardener applies the auto-fixable subset of Pipefort’s rules, grouped into selectable fixes: The exact set reflects Pipefort’s auto-fixable rules and grows as more fixers land. Only the fixes that actually apply to your workflow are shown.
Pinning to a SHA resolves the tag over the public GitHub API. That step needs network access, so a very large workflow with many unpinned actions can take a few seconds — or you can uncheck Pin actions to a commit SHA to skip it. Every other fix is a purely local text transform.

​
Relationship to scanning

The hardener is a quick, anonymous way to clean up a single file. For ongoing coverage — every workflow in every repo, with history, trends, and one-click fix PRs — connect the repository and let Pipefort scan it. Same fixer, applied continuously.