skills.rest
yldgio
yldgioCOMMUNITY
Explore all skills by this author →
Website𝕏@yldgioGitHub

github-actions

Review and harden GitHub Actions workflows for security and reliability.

Updated Jan 29, 2026
Search Tags:#automation#workflow#security#best-practices#github-actions#ci-cd
One-click install
npx skills add https://github.com/yldgio/codereview-skills --skill github-actions-yldgio
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: github-actions
Source: https://github.com/yldgio/codereview-skills/tree/main/skills/github-actions
Command: npx skills add https://github.com/yldgio/codereview-skills --skill github-actions-yldgio

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps reviewers apply GitHub Actions best practices to ensure secure, fast, and maintainable workflows across projects, reducing risk and manual review effort.

Core Features & Use Cases

  • Security-first guidelines: pin actions with full SHAs, minimize permissions, and avoid leaking secrets.
  • Performance and reliability: enable caching, run jobs in parallel, and use concurrency controls.
  • Workflow structure and governance: recommend reusable workflows, clear triggers, and monitoring.

Quick Start

Use this skill to review and harden your repository's GitHub Actions workflows, for example by pinning an action, limiting permissions, and validating secrets handling before merging.

Frequently Asked Questions about github-actions

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure GitHub Actions workflows against insecure patterns and misconfigurations?▼

Securing GitHub Actions workflows involves pinning actions to full commit SHAs, minimizing default permissions, and validating secrets handling. This prevents insecure patterns and misconfigurations across CI/CD pipelines in both private and public repositories.

What is the best way to improve GitHub Actions CI/CD performance and reliability?▼

Improving GitHub Actions performance requires enabling caching, running jobs in parallel, and applying concurrency controls. These optimizations ensure fast, reliable CI/CD pipelines while reducing manual review effort during workflow execution.

Does my repository need reusable workflows for consistent GitHub Actions governance?▼

Reusable workflows are recommended for GitHub Actions governance to ensure pattern consistency. They standardize triggers, monitoring, and security policies like SHA pinning and minimized permissions across multiple repositories.

How do I review and harden GitHub Actions workflows before merging pull requests?▼

Reviewing GitHub Actions workflows before merging involves checking for pinned action SHAs, restricted permissions, and secure secrets handling. This hardening process validates push, pull request, and deployment workflows against security best practices.

Can I apply GitHub Actions security best practices to both private and public repositories?▼

Yes, GitHub Actions security best practices apply to both private and public repositories. Pinning actions to full SHAs, minimizing permissions, and securing secrets handling protect CI/CD pipelines regardless of repository visibility.

Related Skills

Explore More Software Engineering Skills→
batFormatbatFormat

aif-ci

Generate and enhance GitHub Actions and GitLab CI pipeline configurations.

Community
Advanced
KrismithReddy12KrismithReddy12

land-and-deploy

Merge pull requests, trigger CI/CD pipelines, and validate production health.

Community
Advanced
zerAdazerAda

supply_chain_security

Sign Docker images with Cosign and generate SBOMs for supply chain security.

Community
Advanced
JonathanMitchell1234JonathanMitchell1234

cicd-expert

Design CI/CD pipelines with GitHub Actions, Jenkins, and GitLab CI.

Community
Advanced