# github-actions

A skill that steers the agent through GitHub Actions authoring: vendor actions over shell scripts, verified versions, minimal job permissions.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · ★ 62
- Author: wendylabsinc
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/wendylabsinc/claude-skills/tree/HEAD/github-actions/SKILL.md
- Updated: 2026-10-22
- HTML: https://affpapa.org/en/nevibecode/skills/wendylabsinc-github-actions

## What it does

The skill fires on anything inside `.github/workflows/`: a test job, a release pipeline, a deploy. Its first rule is to reach for an existing action rather than write shell in `run:`. Checkout, image build and push, artifact upload, releases are all covered by vendor actions under `actions/*` and `docker/*`. A hand-rolled step needs a stated reason in the pull request.

Versions are the part it refuses to do from memory. Before pinning, the agent runs `gh api repos/actions/checkout/releases/latest --jq .tag_name` for every action in the file and uses what comes back. The normal pin is a major tag. A commit SHA goes in when the job carries production credentials. If `gh` is not logged in, only the releases page is left to check by hand.

Access is scoped tight. Each job gets an explicit `permissions:` block, starting at `contents: read` with `id-token: write` added where OIDC is in play. Cloud login runs through OIDC federation. Long-lived cloud keys sitting in secrets are out. The checklist also asks for a `concurrency:` group on deploys and split triggers: default branch to dev, `v*` tags to production.

## Requirements
- Works with: GitHub

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add wendylabsinc/claude-skills --skill github-actions -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/github-actions/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/github-actions/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add wendylabsinc/claude-skills --skill github-actions -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/github-actions/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add wendylabsinc/claude-skills --skill github-actions -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/github-actions/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install wendylabsinc/claude-skills github-actions
```

2. **Manually: put the files in place**
- File: `.github/skills/github-actions/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add wendylabsinc/claude-skills --skill github-actions -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/wendylabsinc/claude-skills --path github-actions
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/github-actions/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add wendylabsinc/claude-skills --skill github-actions -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/wendylabsinc/claude-skills/tree/HEAD/github-actions/SKILL.md

## When to use it
- write a deploy workflow in `.github/workflows/` without shell workarounds
- check the latest major of an action before pinning it
- trim job permissions to what the job actually uses
- move cloud auth off stored keys onto OIDC
- split deploy triggers between branch and tag

## Example prompts
- Draft `.github/workflows/ci.yml` with tests on pull requests and a release on `v*` tags.
- Review this workflow PR: are the action versions current and the permissions minimal?
- Switch the GCP auth step to OIDC and drop `credentials_json`.

## Similar
- [github-actions-generator](https://affpapa.org/en/nevibecode/skills/github-actions-generator.md) — skill · 643 installs
- [github-actions-hardening](https://affpapa.org/en/nevibecode/skills/github-actions-hardening.md) — skill · 2200 installs
- [GitHub Actions Expert](https://affpapa.org/en/nevibecode/agents/github-actions-expert.md) — subagent · ★ 40451
- [github-actions-validator](https://affpapa.org/en/nevibecode/skills/github-actions-validator.md) — skill · 638 installs
- [agentic-actions-auditor](https://affpapa.org/en/nevibecode/skills/agentic-actions-auditor.md) — skill · 6700 installs
- [github-actions-workflow](https://affpapa.org/en/nevibecode/skills/github-actions-workflow.md) — skill · 620 installs

## Other versions with the same name
- [github-actions · callstackincubator](https://affpapa.org/en/nevibecode/skills/github-actions.md) — 10900 installs
- [github-actions · bagelhole](https://affpapa.org/en/nevibecode/skills/devops-skills-github-actions.md) — 388 installs
- [github-actions · bobmatnyc](https://affpapa.org/en/nevibecode/skills/bobmatnyc-github-actions.md) — 758 installs
- [github-actions · tartinerlabs](https://affpapa.org/en/nevibecode/skills/tartinerlabs-github-actions.md) — 403 installs

From the same set: [wendylabsinc/claude-skills](https://affpapa.org/en/nevibecode/by/wendylabsinc/claude-skills.md) — 7 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md