workflow-builder

Generate GitHub Actions workflows with OIDC authentication and least privilege permissions.

Updated Feb 4, 2026

Search Tags:#ci/cd #deployment #security #github actions #oidc #aws cdk

Ready to run

npx skills add https://github.com/andrewwint/spec-driven-ai-dev-05-devops --skill workflow-builder-andrewwint

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: workflow-builder
Source: https://github.com/andrewwint/spec-driven-ai-dev-05-devops/tree/main/code/module-7-complete/skills/workflow-builder
Command: npx skills add https://github.com/andrewwint/spec-driven-ai-dev-05-devops --skill workflow-builder-andrewwint

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill automates the creation of secure GitHub Actions workflows, eliminating the need for stored credentials by leveraging OIDC for safe deployment automation.

Core Features & Use Cases

CI/CD Pipeline Creation: Generates workflows for various environments (development, staging, production).
OIDC Authentication: Configures secure, credential-free access to cloud resources.
Security Best Practices: Enforces principles like least privilege and planning before deployment.
Use Case: Set up a new CI/CD pipeline for a Python application that deploys to AWS using CDK, ensuring all credentials are managed via OIDC.

Quick Start

Create a GitHub Actions workflow that deploys to production using OIDC.

Frequently Asked Questions about workflow-builder

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I configure GitHub Actions to deploy to AWS without storing credentials?▼

To deploy to AWS without storing credentials, you configure GitHub Actions workflows using OIDC authentication. This eliminates static secrets by issuing short-lived tokens for safe deployment automation to your cloud environments.

What is the best way to structure a secure CI/CD pipeline for AWS CDK?▼

The best way to structure a secure CI/CD pipeline for AWS CDK is to enforce progressive disclosure across verification, planning, and deployment stages. This ensures least privilege permissions are applied at each step of the workflow.

Does GitHub Actions support OIDC for cloud deployment automation?▼

Yes, GitHub Actions supports OIDC for cloud deployment automation. By generating workflows that adhere to OIDC security patterns, you achieve credential-free access and enforce security best practices across your environments.

How do I enforce least privilege permissions in GitHub Actions workflows?▼

You enforce least privilege permissions in GitHub Actions workflows by implementing progressive disclosure for verification, planning, and deployment stages. This approach ensures jobs only have the minimum access required to execute.

Can I use this approach to set up pipelines for multiple environments like staging and production?▼

Yes, you can use this approach to set up pipelines for multiple environments like staging and production. The generated workflows support CI/CD pipeline creation across development, staging, and production environments using secure OIDC.

Why should I eliminate stored credentials in my CI/CD deployment automation?▼

You should eliminate stored credentials in your CI/CD deployment automation to prevent secret leakage and unauthorized access. By leveraging OIDC patterns, you replace long-lived static secrets with short-lived tokens for safer deployments.