github-actions

Review and harden GitHub Actions workflows for security and reliability.

Updated Jan 29, 2026

Search Tags:#automation #workflow #security #best-practices #github-actions #ci-cd

Ready to run

npx skills add https://github.com/yldgio/codereview-skills --skill github-actions-yldgio

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: github-actions
Source: https://github.com/yldgio/codereview-skills/tree/main/skills/github-actions
Command: npx skills add https://github.com/yldgio/codereview-skills --skill github-actions-yldgio

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps reviewers apply GitHub Actions best practices to ensure secure, fast, and maintainable workflows across projects, reducing risk and manual review effort.

Core Features & Use Cases

Security-first guidelines: pin actions with full SHAs, minimize permissions, and avoid leaking secrets.
Performance and reliability: enable caching, run jobs in parallel, and use concurrency controls.
Workflow structure and governance: recommend reusable workflows, clear triggers, and monitoring.

Quick Start

Use this skill to review and harden your repository's GitHub Actions workflows, for example by pinning an action, limiting permissions, and validating secrets handling before merging.

Frequently Asked Questions about github-actions

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I secure GitHub Actions workflows against insecure patterns and misconfigurations?▼

Securing GitHub Actions workflows involves pinning actions to full commit SHAs, minimizing default permissions, and validating secrets handling. This prevents insecure patterns and misconfigurations across CI/CD pipelines in both private and public repositories.

What is the best way to improve GitHub Actions CI/CD performance and reliability?▼

Improving GitHub Actions performance requires enabling caching, running jobs in parallel, and applying concurrency controls. These optimizations ensure fast, reliable CI/CD pipelines while reducing manual review effort during workflow execution.

Does my repository need reusable workflows for consistent GitHub Actions governance?▼

Reusable workflows are recommended for GitHub Actions governance to ensure pattern consistency. They standardize triggers, monitoring, and security policies like SHA pinning and minimized permissions across multiple repositories.

How do I review and harden GitHub Actions workflows before merging pull requests?▼

Reviewing GitHub Actions workflows before merging involves checking for pinned action SHAs, restricted permissions, and secure secrets handling. This hardening process validates push, pull request, and deployment workflows against security best practices.

Can I apply GitHub Actions security best practices to both private and public repositories?▼

Yes, GitHub Actions security best practices apply to both private and public repositories. Pinning actions to full SHAs, minimizing permissions, and securing secrets handling protect CI/CD pipelines regardless of repository visibility.