github-actions-author
Author, review, and harden GitHub Actions workflows using current official documentation, secure trigger patterns, least-privilege permissions, current action versions, and CI/CD validation. Use when creating, editing, debugging, or security-reviewing workflow YAML.
What this skill does
# GitHub Actions Author
Create and review GitHub Actions workflows with current docs and secure
defaults.
## Contract
Inputs:
- Repository root or target workflow file
- Desired workflow behavior, triggers, runtimes, and deployment target
- Optional secrets, environments, runner constraints, and matrix strategy
Outputs:
- Workflow YAML or patch summary
- Documentation-backed rationale for non-obvious choices
- Security and validation checklist
Creates/Modifies:
- May create or edit `.github/workflows/*.yml`
- Does not add secrets or deploy without approval
External Side Effects:
- Reads official GitHub documentation when syntax, permissions, or product
behavior may have changed
- May query workflow metadata with GitHub CLI
- Does not dispatch, rerun, or cancel workflows without approval
Confirmation Required:
- Before writing workflow files when requirements are unclear
- Before adding deployment, release, publish, or secret-consuming behavior
- Before dispatching or rerunning workflows
Delegates To:
- `testing-cicd-init` for first-pass TypeScript test infrastructure
- `gh-fix-ci` when a workflow is failing on a PR
- `git-safety` when workflows touch credentials, tokens, or publish steps
## Workflow
1. Discover existing CI shape:
```bash
find .github/workflows -maxdepth 1 -type f 2>/dev/null
gh workflow list
git status -sb
```
2. Read relevant local context:
- Existing workflow files
- `package.json`, lockfiles, workspace config, test scripts
- Deployment docs or release conventions
3. Ground version-sensitive choices in official GitHub docs:
- Workflow syntax, triggers, contexts, expressions
- `GITHUB_TOKEN` permissions
- `pull_request` vs `pull_request_target`
- OIDC, environments, deployment protection rules
- Cache, artifacts, reusable workflows, matrices, concurrency
4. Check action versions before adding or bumping common actions:
```bash
gh release view --repo actions/checkout --json tagName --jq '.tagName'
gh release view --repo actions/setup-node --json tagName --jq '.tagName'
gh release view --repo oven-sh/setup-bun --json tagName --jq '.tagName'
```
5. Author with safe defaults:
- Pin permissions at workflow or job level; default to `contents: read`.
- Use `pull_request` for untrusted code. Use `pull_request_target` only for
metadata/comment workflows that do not check out or execute fork code.
- Pass untrusted event data through environment variables before shell use.
- Use `concurrency` for expensive or deploy workflows.
- Use cache keys that include lockfile hashes.
- Avoid printing secrets or full tokens.
- Separate CI, release, and deployment workflows when permissions differ.
6. Validate locally when possible:
```bash
git diff -- .github/workflows
gh workflow view <workflow-name-or-id> --yaml
```
Run `actionlint` if already installed. Do not install new global tools unless
the user asks.
7. Final output:
- Files changed
- Trigger behavior
- Permissions and secret boundaries
- Validation performed
- Remaining manual setup such as secrets or environments
## Security Review Checklist
- No hardcoded secrets, tokens, credentials, or private URLs.
- Job permissions are minimal and explicit.
- Fork PRs cannot access secrets or execute trusted-token publish paths.
- Shell steps quote variables and avoid direct interpolation of issue/PR text.
- Third-party actions are current and reputable; pin to SHA for sensitive
workflows or untrusted supply-chain surfaces.
- Deployment jobs use environments when human approval or environment-scoped
secrets are needed.
- Release/publish jobs run only on trusted refs or signed/manual dispatch paths.
Related in Cloud & DevOps
appbuilder-action-scaffolder
IncludedCreate, implement, deploy, and debug Adobe Runtime actions with consistent layout, validation, and error handling. Use this skill whenever the user needs to add actions to an App Builder project, understand action structure (params, response format, web/raw actions), configure actions in the manifest, use App Builder SDKs (State, Files, Events, database), deploy and invoke actions via CLI, debug action issues, or implement patterns such as webhook receivers, custom event providers, journaling consumers, large payload redirects, action sequence pipelines, and Asset Compute workers. Also trigger when users mention serverless functions in Adobe context, action logging, IMS authentication for actions, or cron-style scheduled actions.
orchestrating-datacloud
IncludedSalesforce Data Cloud product orchestrator for connect→prepare→harmonize→segment→act workflows. Use this skill when the user needs a multi-step Data Cloud pipeline, cross-phase troubleshooting, or data space and data kit management. TRIGGER when: user needs a multi-step Data Cloud pipeline, asks to set up or troubleshoot Data Cloud across phases, manages data spaces or data kits, or wants a cross-phase sf data360 workflow. DO NOT TRIGGER when: work is isolated to a single phase (use the matching phase-specific skill), the task is STDM/session tracing/parquet telemetry (use observing-agentforce), standard CRM SOQL (use querying-soql), or Apex implementation (use generating-apex).
github-project-automation
IncludedAutomate GitHub repository setup with CI/CD workflows, issue templates, Dependabot, and CodeQL security scanning. Includes 12 production-tested workflows and prevents 18 errors: YAML syntax, action pinning, and configuration. Use when: setting up GitHub Actions CI/CD, creating issue/PR templates, enabling Dependabot or CodeQL scanning, deploying to Cloudflare Workers, implementing matrix testing, or troubleshooting YAML indentation, action version pinning, secrets syntax, runner versions, or CodeQL configuration. Keywords: github actions, github workflow, ci/cd, issue templates, pull request templates, dependabot, codeql, security scanning, yaml syntax, github automation, repository setup, workflow templates, github actions matrix, secrets management, branch protection, codeowners, github projects, continuous integration, continuous deployment, workflow syntax error, action version pinning, runner version, github context, yaml indentation error
sf-datacloud
IncludedSalesforce Data Cloud product orchestrator for connect→prepare→harmonize→segment→act workflows. TRIGGER when: user needs a multi-step Data Cloud pipeline, asks to set up or troubleshoot Data Cloud across phases, manages data spaces or data kits, or wants a cross-phase `sf data360` workflow. DO NOT TRIGGER when: work is isolated to a single phase (use the matching sf-datacloud-* skill), the task is STDM/session tracing/parquet telemetry (use sf-ai-agentforce-observability), standard CRM SOQL (use sf-soql), or Apex implementation (use sf-apex).
fabric-cli
IncludedUse this skill for Fabric.so CLI workflows with the `fabric` terminal command: diagnose/install/login, search or browse a Fabric library, save notes/links/files, create folders, ask the Fabric AI assistant, manage tasks/workspaces, generate shell completion, check subscription usage, produce JSON output, and use Fabric as persistent agent memory. Do not use for Microsoft Fabric/Azure/Power BI `fab`, Daniel Miessler's Fabric framework, Python Fabric SSH, Fabric.js, or textile/fashion fabric.
lark
IncludedLark/Feishu CLI skills: lark-cli operations for docs, markdown, sheets, base, calendar, im, mail, task, okr, drive, wiki, slides, whiteboard, apps, approval, attendance, contact, vc, minutes, event. Use when the user needs to operate Lark/Feishu resources via lark-cli, send messages, manage documents, spreadsheets, calendars, tasks, OKRs, deploy web pages, or any Feishu/Lark workspace operations.