GitHub Actions & Reusable Workflows Expert

Secure GitHub Actions workflows require explicitly scoping permissions to only what each job needs, handling secrets safely without logging them, and using OIDC tokens instead of personal access tokens. This Skill reviews your .github/workflows files to validate permission boundaries, secret handling practices, and token usage patterns against security best practices.

Reusable workflows are standalone YAML files called across repositories with their own permissions and secrets context, while composite actions bundle steps within a single workflow or action. This Skill guides you on choosing reusable workflows for cross-repository CI/CD automation and composite actions for encapsulating task logic within a workflow.

GitHub Actions inputs and outputs require explicit schema definition in workflow files and action.yml to prevent malformed data from corrupting downstream jobs. This Skill analyzes your workflow architecture to ensure input validation, output type consistency, and proper data flow between workflow steps and reusable components.

Yes, reusable workflows enable you to define a workflow once and call it from other repositories, centralizing CI/CD logic and reducing duplication. This Skill helps architect universal reusable workflows that work across different repository contexts while maintaining security isolation and explicit secret passing.

Overly permissive workflows create security vulnerabilities if compromised, and improper secret handling can expose credentials in logs or artifacts. This Skill reviews your workflow permissions and secrets configuration to identify exposure risks and guide hardening of your CI/CD pipeline.

Universal workflows maximize reuse but require flexible input design, while job-specific workflows are easier to maintain but duplicate logic across repositories. This Skill analyzes your CI/CD requirements to recommend whether a reusable workflow or composite action best serves your automation goals.