tddworks/github-actions
.claude/skills/github-actions/SKILL.md
Manage ClaudeBar's GitHub Actions CI/CD pipelines: build, test, and release workflows. Use this skill when: (1) Setting up secrets for CI/CD (certificate, API key, Sparkle key, Codecov) (2) Creating a new release — tag-based or manual workflow_dispatch (3) Triggering or explaining the build.yml, tests.yml, or release.yml workflows (4) Debugging release failures (signing, notarization, appcast) (5) Managing beta vs stable channels for Sparkle auto-updates (6) User says "release a new version", "push a tag", "set up CI secrets", "why did the release fail"
$ install --global
skillsauthnpx skillsauth add tddworks/claudebar github-actionsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 15, 2026, 5:15 AM19.9s3 files scanned
SKILL.md
- name:
- github-actions
- description:
- |
- Manage ClaudeBar's GitHub Actions CI/CD pipelines:
- build, test, and release workflows.
ClaudeBar GitHub Actions
Three workflows live in .github/workflows/. See reference files for setup and troubleshooting.
Workflows at a Glance
| Workflow | Trigger | Runner | Purpose |
|----------|---------|--------|---------|
| build.yml | push/PR to main, develop | macos-15 | Debug + release build verification |
| tests.yml | push/PR to main, develop | macos-26 | Unit tests + Codecov coverage upload |
| release.yml | v* tag push OR manual | macos-15 | Sign → notarize → DMG → GitHub release → appcast |
Create a Release
Option A — Tag (recommended):
# 1. Update CHANGELOG.md with release notes for this version
# 2. Commit and push
git add CHANGELOG.md
git commit -m "docs: add release notes for v1.2.0"
git push origin main
# 3. Tag and push — this triggers release.yml automatically
git tag v1.2.0 && git push origin v1.2.0
# Beta / pre-release (automatically flagged on GitHub)
git tag v1.2.0-beta.1 && git push origin v1.2.0-beta.1
Option B — Manual dispatch:
- Go to Actions → Release → Run workflow
- Enter version (e.g.
1.2.0or1.2.0-beta.1) - Optionally toggle
publish_appcastanddebug
Supported version formats: X.Y.Z, X.Y.Z-beta, X.Y.Z-beta.N, X.Y.Z-alpha.N, X.Y.Z-rc.N
Secrets Required
| Secret | Required For | See |
|--------|-------------|-----|
| APPLE_CERTIFICATE_P12 | Code signing | secrets-setup.md |
| APPLE_CERTIFICATE_PASSWORD | Code signing | secrets-setup.md |
| APP_STORE_CONNECT_API_KEY_P8 | Notarization | secrets-setup.md |
| APP_STORE_CONNECT_KEY_ID | Notarization | secrets-setup.md |
| APP_STORE_CONNECT_ISSUER_ID | Notarization | secrets-setup.md |
| SPARKLE_EDDSA_PRIVATE_KEY | In-app auto-updates | secrets-setup.md |
| CODECOV_TOKEN | Coverage upload | secrets-setup.md |
| APP_IDENTITY | Optional signing override | secrets-setup.md |
What the Release Pipeline Does
git tag v1.2.0
│
▼
release.yml
1. Extract + validate version (SemVer)
2. Update Info.plist (CFBundleShortVersionString + CFBundleVersion = run_number)
3. tuist install → tuist generate
4. xcodebuild archive (arm64 + x86_64, unsigned)
5. Import Developer ID cert into temp keychain
6. codesign with entitlements
7. notarytool submit + staple
8. Create ZIP + DMG (signed), SHA256 checksums
9. Extract release notes from CHANGELOG.md
10. Publish GitHub Release (draft: false)
11. Generate Sparkle appcast with EdDSA signature
12. Deploy appcast to GitHub Pages
Debugging Failures
Enable verbose output via manual dispatch → debug: true. This prints:
- P12 certificate details and contents
- All identities in the signing keychain
- Certificate subject and expiry dates
For detailed troubleshooting: troubleshooting.md
Beta Channel
Pre-release tags (v1.2.0-beta.1) automatically:
- Set GitHub release as
prerelease: true - Add
<sparkle:channel>beta</sparkle:channel>to the appcast entry - Are only offered to users with Beta Updates enabled in Settings
Stable releases always win over betas of the same version (stable gets higher build number).
See release-workflow.md for the full beta channel matrix.
Related Skills
tddworks/improvement
development
VerifiedTrustedCommunity
Guide for making improvements to existing ClaudeBar functionality using TDD. Use this skill when: (1) Enhancing existing features (not adding new ones) (2) Improving UX, performance, or code quality (3) User asks "improve X", "make Y better", or "enhance Z" (4) Small enhancements that don't require full architecture design For NEW features, use implement-feature skill instead.
946SKILL.mdUpdated Apr 15, 2026
tddworks/implement-feature
development
VerifiedTrustedCommunity
Guide for implementing features in ClaudeBar following architecture-first design, TDD, rich domain models, and Swift 6.2 patterns. Use this skill when: (1) Adding new functionality to the app (2) Creating domain models that follow user's mental model (3) Building SwiftUI views that consume domain models directly (4) User asks "how do I implement X" or "add feature Y" (5) Implementing any feature that spans Domain, Infrastructure, and App layers
946SKILL.mdUpdated Apr 15, 2026
tddworks/fix-bug
development
VerifiedTrustedCommunity
Guide for fixing bugs in ClaudeBar following Chicago School TDD and rich domain design. Use this skill when: (1) User reports a bug or unexpected behavior (2) Fixing a defect in existing functionality (3) User asks "fix this bug" or "this doesn't work correctly" (4) Correcting behavior that violates the user's mental model
946SKILL.mdUpdated Apr 15, 2026
tddworks/add-report
development
VerifiedTrustedCommunity
Guide for adding new report cards to ClaudeBar that analyze local data sources and display metrics with comparison deltas. Use this skill when: (1) Adding a new report/analytics card (e.g., weekly summary, model breakdown, session stats) (2) Creating data analysis features that read local files and display aggregated metrics (3) Adding comparison cards that show "today vs previous" style deltas (4) Building any feature that follows the DailyUsage pattern (parse → aggregate → report → card)
946SKILL.mdUpdated Apr 15, 2026