Writing GitHub Actions Workflows With LLMs in October 2026: Pin Actions to Commit SHAs, Lock Down Token Permissions, and Lint Before You Merge
Ask an LLM for a GitHub Actions workflow and you will get something that looks right in a few seconds: a trigger, a job, a checkout step, a build command. Most of the time it even runs. The problem is that CI configuration is one of the places where "it runs" and "it is safe" are very different things. A workflow holds secrets, can push code, can publish packages, and often runs on input from strangers who opened a pull request. Generated YAML tends to copy the patterns that are most common in public repositories, and a lot of those patterns are outdated or risky. This guide covers a practical way to use LLMs for writing workflows without inheriting those problems. The short version: pin every third-party action to a full commit SHA, set explicit and minimal GITHUB_TOKEN permissions, keep untrusted input out of shell scripts, and run a linter on every generated file before it merges. A CI pipeline is an assembly line: every step runs automatically, so every ste...