What problem does it solve? Writing GitHub Actions workflows by hand is error-prone: unpinned actions, overly broad permissions, and unsafe fork-PR handling create security risks, while syntax mistakes break pipelines. This Skill scaffolds workflows, custom actions, and reusable workflows following current security and naming standards, then validates every generated file. ## Core Features & Use Cases - Workflow Generation: Create CI/CD pipelines with pinned action SHAs, minimal permissions, concurrency controls, caching, and matrix strategies. - Custom Action Scaffolding: Generate composite, Docker, or JavaScript actions from templates with proper metadata, branding, and versioning. - Reusable Workflows & Security Scanning: Build workflow_call pipelines with typed inputs and explicit secrets, plus dependency review, SBOM attestation, and CodeQL configurations. - Use Case: A developer needs a Node.js CI pipeline that runs tests on pull requests without exposing secrets to forked repos. The Skill generates a workflow with read-only baseline permissions, an untrusted-PR guardrail, SHA-pinned actions, and validates the result before delivery. ## Quick Start Ask the assistant to create a GitHub Actions CI workflow for your repository that runs tests on push and pull requests with secure default permissions.
