Agent skill · software engineering · sickn33
github-actions-advanced
Design, debug, and harden GitHub Actions CI/CD workflows, including reusable workflows, matrix builds, self-hosted runners, OIDC authentication, caching, environments, secrets, and release automation.
Why this skill is useful
Adds advanced patterns and security practices for GitHub Actions workflows that the AI wouldn't reliably generate on its own.
What it needs
About 2k tokens when loaded. Last updated 2026-08-07. 44,571 stars on the source repository.
What this skill does
GitHub Actions Advanced Skill Expert guidance for designing, writing, debugging, and securing production-grade GitHub Actions workflows. --- Detailed Guide Read the detailed guide before executing this skill. It retains the complete procedure and reference material. Treat its safety, prerequisites, and validation requirements as mandatory. For focused work, load the relevant sections; for end-to-end work, read the guide completely. When to Use This Skill User mentions GitHub Actions, .github/workflows, CI/CD pipelines, runners, jobs, steps, or actions User wants to automate builds, tests, deployments, or releases via GitHub User asks about matrix builds, reusable workflows, composite actions, or self-hosted runners User needs help with OIDC authentication, caching strategies, or secrets management User says "my GitHub pipeline is failing" or "set up CI for my repo" User asks about workflow security, hardening, or environment protection rules When NOT to Use This Skill The user is working with GitLab CI/CD → recommend gitlab-ci-patterns The user is working with CircleCI, Jenkins, or other CI platforms The task is purely about Docker image building without GitHub context → recommend docker-expert The task is about Kubernetes deployment configuration → recommend kubernetes-architect --- Security Hardening 1. Always Declare Permissions (Least Privilege) 2. Pin Third-Party Actions to Full Commit SHA 3. Prevent Script Injection Never place ${{ ... }} directly inside run: when the value can come from PR metadata, workflow inputs, repository files, matrix JSON, or earlier job outputs. Put it in env: first, validate allowlisted values where possible, and reference the shell variable with quotes. 4. Restrict pullrequesttarget Usage 5. Harden with StepSecurity --- Limitations Use this skill only when the task clearly matches the scope described above. Do not treat the output as a substitute for environment-specific validation, testing, or expert review. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sickn33/github-actions-advanced--de0131