Heldinhow/github-actions-ci
github-actions-ci/SKILL.md
Set up continuous integration workflows using GitHub Actions.
$ install --global
skillsauthnpx skillsauth add Heldinhow/awesome-opencode-dev-skills github-actions-ciInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 22, 2026, 7:32 AM136.8s2 files scanned
SKILL.md
- name:
- github-actions-ci
- description:
- Set up continuous integration workflows using GitHub Actions.
GitHub Actions CI
Overview
GitHub Actions enables automated build, test, and deployment workflows directly in your GitHub repository. This skill should be invoked when setting up CI/CD pipelines for automated testing, code quality checks, and build verification on pull requests and commits.
Core Principles
- Workflow as Code: Define CI/CD pipelines in YAML files stored in the repository
- Trigger Selection: Choose appropriate triggers (push, pull_request, schedule) to balance coverage and speed
- Matrix Strategy: Use matrix builds to test across multiple versions/configurations efficiently
- Artifact Management: Properly configure artifact retention and caching
Preparation Checklist
- [ ] Identify the workflows needed (CI, CD, security scans)
- [ ] Ensure build and test scripts exist and work locally
- [ ] Determine required runtime versions (Node, Python, .NET, etc.)
- [ ] Plan secret management for deployment workflows
Step-by-Step Process
- Create Directory: Create
.github/workflows/directory - Define YAML: Write workflow YAML with name, on triggers
- Configure Jobs: Set up jobs with steps for checkout, setup, build, test
- Add Matrix: Configure matrix strategy for multi-version testing
- Add Artifacts: Configure artifact upload for build outputs
- Set Permissions: Ensure appropriate GitHub token permissions
Do's and Don'ts
- ✅ Do use concurrency groups to cancel outdated runs on new pushes
- ✅ Do cache dependencies to speed up workflow execution
- ✅ Do use paths filter to only run workflows when relevant files change
- ❌ Don't commit secrets directly - use GitHub Secrets
- ❌ Don't run workflows on every push to main without concurrency control
- ❌ Don't skip failure notifications - configure status checks properly
Anti-Patterns
- The Slow Workflow: Not caching dependencies, causing minutes-long builds
- Secret Exposure: Hardcoding secrets in workflow files
- No Timeout: Workflows that can run indefinitely without limits
- All Triggers: Running expensive workflows on every minor event
Related Skills
Heldinhow/websocket-real-time
tools
VerifiedTrustedCommunity
Implement WebSocket communication for real-time bidirectional client-server communication.
2SKILL.mdUpdated Apr 24, 2026
Heldinhow/webhook-handler
development
VerifiedTrustedCommunity
Implement webhook handlers for processing incoming events from external services.
2SKILL.mdUpdated Apr 24, 2026
Heldinhow/webapp-testing
development
VerifiedTrustedCommunity
Test web applications using Playwright for end-to-end browser testing.
2SKILL.mdUpdated Apr 24, 2026
Heldinhow/web-artifacts-builder
development
VerifiedTrustedCommunity
Build production-quality HTML artifacts using React, Tailwind CSS, and shadcn/ui.
2SKILL.mdUpdated Apr 24, 2026