openhands/github-actions
skills/github-actions/SKILL.md
Create, debug, and test GitHub Actions workflows and custom actions. Use when building CI/CD pipelines, automating workflows, or troubleshooting GitHub Actions.
$ install --global
skillsauthnpx skillsauth add openhands/skills github-actionsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 9, 2026, 6:20 AM44.0s2 files scanned
SKILL.md
- name:
- github-actions
- description:
- Create, debug, and test GitHub Actions workflows and custom actions. Use when building CI/CD pipelines, automating workflows, or troubleshooting GitHub Actions.
GitHub Actions Guide
Critical Rules
Custom Action Deployment:
- New custom actions MUST be merged to the main branch before they can be used
- After the initial merge, they should be tested from feature branches
Debug Steps: Add debug steps that print non-secret parameters when:
- Creating a new action, OR
- Troubleshooting a particularly tricky issue
(Not required for every workflow - use when needed)
Effectiveness Principles
Actions cost CI minutes. Be deliberate, not iterative:
- Monitor, don't poll - use
gh run watch/gh pr checks --watchto follow runs live - Read logs, don't guess - fetch the failed job's log before changing code
- Print actual values - debug steps reveal the real
inputs/githubcontext, not your assumptions - Test locally first -
actruns workflows on your machine and avoids burning CI minutes - Plan the smallest reproduction - one job, minimal matrix, narrow trigger before scaling up
See README.md for the full debugging workflow, gh commands, and YAML debug-step examples.
Key Gotchas
- Secrets unavailable in fork PRs -
pull_requesthas no secrets for forks;pull_request_targetdoes but never check out or execute fork PR code inside it (RCE with write permissions) - Pin action versions - Use
@v4or SHA, not@main(prevents breaking changes) - Explicit permissions - Set
permissions:block for GITHUB_TOKEN operations - Artifacts for job-to-job data - Files don't persist between jobs without
upload-artifact/download-artifact
Related Skills
openhands/iterate
tools
VerifiedTrustedCommunity
Iterate on a GitHub pull request — drive it through CI, code review, and QA until it is merge-ready. Poll verification layers with `gh` CLI, diagnose and fix CI failures, address review feedback, retry flaky checks, push fixes, and repeat. The agent is the orchestration loop.
125SKILL.mdUpdated Apr 18, 2026
openhands/technical-writing
development
VerifiedTrustedCommunity
Guides technical explanations toward flowing, direct, conversational prose. This skill should be used for engineering chat, design discussion, architecture analysis, code-review explanations, and technical recommendations that should be concise without becoming fragmented or vague.
124SKILL.mdUpdated Jul 13, 2026
openhands/jira-issue-to-pr
tools
VerifiedTrustedCommunity
This skill should be used when the user asks to "set up a Jira automation to create pull requests", "poll Jira for create-pr issues", "automatically create GitHub PRs from Jira tickets", "deploy a Jira issue-to-PR automation", "create a Jira to GitHub PR workflow", or mentions automating GitHub PR creation from a Jira label. Deploys a cron-based OpenHands automation that watches a Jira Cloud project for issues labeled with a configurable label (default: "create-pr") and spawns an agent conversation to create a GitHub pull request for each new issue found. The target GitHub repository is read from the body of the Jira ticket - no repo parameter is required at deploy time.
123SKILL.mdUpdated Jul 7, 2026
openhands/openhands-automation
tools
VerifiedTrustedCommunity
This skill should be used when the user asks to "create an automation", "schedule a task", "set up a cron job", "webhook integration", "event-triggered automation", or mentions automations, scheduled tasks, cron scheduling, or webhook events in OpenHands Cloud.
123SKILL.mdUpdated Apr 24, 2026