adaptive-enforcement-lab/actions-integration
plugins/patterns/skills/actions-integration/SKILL.md
Integrate GitHub Core Apps with Actions workflows for org-scoped automation. Generate tokens, access APIs, and implement cross-repository operations patterns.
tools
Updated Mar 27, 2026
$ install --global
skillsauthnpx skillsauth add adaptive-enforcement-lab/claude-skills actions-integrationInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Mar 29, 2026, 10:47 AM38.1s1 file scanned
SKILL.md
- name:
- actions-integration
- description:
- >-
Actions Integration
When to Use This Skill
This guide explains how to integrate your GitHub Core App with GitHub Actions workflows for organization-level automation.
What You'll Learn
Generate short-lived tokens, use them with GitHub CLI and APIs, implement common workflow patterns, and handle errors gracefully.
Prerequisites
Before integrating, ensure you have:
- Core App created and installed - See GitHub App Setup
- Secrets configured -
CORE_APP_IDandCORE_APP_PRIVATE_KEYstored in GitHub - Required permissions - App has permissions for your automation tasks
Implementation
See the full implementation guide in the source documentation.
Techniques
Authentication Methods
GitHub Apps support three authentication methods, each serving different use cases:
| Method | Scope | Expiration | Primary Use Case | |--------|-------|------------|------------------| | JWT | App-level | 10 minutes | Installation discovery, app metadata, bootstrapping | | Installation Tokens | Repository/Org | 1 hour | Repository operations, API access, automation | | OAuth | User context | Configurable | User-specific operations, web flows |
Which authentication method should I use?
- Most workflows → Installation Tokens (via
actions/create-github-app-token)- App management → JWT (list installations, app configuration)
- User operations → OAuth (actions on behalf of a user)
See the Authentication Decision Guide for detailed selection criteria.
References
- Source Documentation
- AEL Patterns
Related Skills
adaptive-enforcement-lab/workload-identity-federation-implementation
documentation
VerifiedTrustedCommunity
Workload Identity Federation implementation guide. GKE setup, IAM bindings, ServiceAccount configuration, migration from service account keys, and troubleshooting patterns.
SKILL.mdUpdated Mar 27, 2026
adaptive-enforcement-lab/workflow-trigger-security
development
VerifiedTrustedCommunity
Secure GitHub Actions trigger patterns for pull requests, forks, and reusable workflows. Preventing privilege escalation and code injection through trigger misconfiguration.
SKILL.mdUpdated Mar 27, 2026
adaptive-enforcement-lab/third-party-action-risk-assessment
development
VerifiedTrustedCommunity
Structured framework for evaluating GitHub Actions security before adoption. Trust tiers, risk assessment checklist, and decision tree for action evaluation.
SKILL.mdUpdated Mar 27, 2026
adaptive-enforcement-lab/storing-credentials
testing
VerifiedTrustedCommunity
Securely store GitHub App credentials across different environments. GitHub Actions secrets, external CI, Kubernetes, and automated rotation patterns.
SKILL.mdUpdated Mar 27, 2026