skills.rest
Fidasek009
Fidasek009COMMUNITY
Explore all skills by this author →
WebsiteGitHub

github-actions

Applies security and efficiency best practices to GitHub Actions CI/CD workflow configurations.

1|Updated Dec 30, 2025
Search Tags:#workflow#ci/cd#deployment#security#permissions#github actions#oidc
One-click install
npx skills add https://github.com/Fidasek009/agents --skill github-actions-fidasek009
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: github-actions
Source: https://github.com/Fidasek009/agents/tree/main/.kilo/skills/github-actions
Command: npx skills add https://github.com/Fidasek009/agents --skill github-actions-fidasek009

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? GitHub Actions workflows often ship with overly broad permissions, unpinned action versions, leaked secrets in logs, and inefficient caching, creating security and reliability risks in CI/CD pipelines. ## Core Features & Use Cases - Secure Defaults: Enforces least-privilege permissions, OIDC federation over long-lived credentials, and safe handling of pull_request_target triggers. - Build Quality Standards: Guides lockfile-based cache keys, pinned toolchain versions, focused matrix jobs, and shallow checkouts with fetch-depth: 1. - Deployment Governance: Structures protected environment deployments, job dependencies, and progressive rollout with rollback commands. - Use Case: When writing or reviewing a new workflow file, apply these standards to pin actions to commit SHAs, scope permissions per job, and validate triggers before merging. ## Quick Start Review my GitHub Actions workflow file and apply security and efficiency best practices to it.

Frequently Asked Questions about github-actions

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure GitHub Actions workflows?▼

Set top-level permissions to contents: read and grant extra permissions only per job. Pin actions to commit SHAs for sensitive workflows, use OIDC federation instead of long-lived cloud credentials, and keep secrets out of logs.

How to cache dependencies in GitHub Actions?▼

Use cache keys derived from lockfiles and relevant platform inputs so caches invalidate correctly when dependencies change. Pin toolchain versions alongside caching to keep builds reproducible across runners.

Should I pin GitHub Actions to versions or commit SHAs?▼

Pin actions to major versions at minimum for general workflows. Use full commit SHAs for high-risk or security-sensitive workflows, since tags can be moved while SHAs are immutable.

Is pull_request_target safe to use with forked repositories?▼

pull_request_target runs with privileged credentials on fork code, so it is risky. Keep fork checkout and script execution separated from privileged credentials to prevent secret exposure through malicious pull requests.

When should I use fetch-depth 0 instead of shallow checkout?▼

Use fetch-depth: 1 by default for faster checkouts. Use full history only for release, changelog, versioning, or git describe workflows that need complete commit history to compute versions or generate changelogs.

Related Skills

Explore More Software Engineering Skills→
vietlinhh02vietlinhh02

GitHub Actions

Automate CI/CD pipelines with GitHub Actions workflows in YAML files.

Community
Intermediate
fartybobofartybobo
4

resolve-ci-failures

Investigate CI/CD failures and coordinate approved fixes for GitHub Actions pipelines.

Official
Advanced
martinholovskymartinholovsky
45

CI/CD Pipeline Security Expert

Automate CI/CD pipeline security hardening with GitHub Actions.

Community
Advanced
maschadmaschad
6

ci-validation

Validate CI/CD configurations across multiple platforms and run local checks.

Community
Advanced