github-actions
This skill guides you through building GitHub Actions workflows with emphasis on security, proper versioning, and avoiding common pitfalls. It covers workflow structure, permissions, events, and recommended actions while highlighting anti-patterns like hardcoded secrets and injection vulnerabilities.
GitHub Actions skill helps you create secure, properly-versioned workflows following CI/CD best practices.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-04-07
GitHub Actions skill helps you create secure, properly-versioned workflows following CI/CD best practices. This skill guides you through building GitHub Actions workflows with emphasis on security, proper versioning, and avoiding common pitfalls. It covers workflow structure, permissions, events, and recommended actions while highlighting anti-patterns like hardcoded secrets and injection vulnerabilities.
Use it when
- github-actions security best practices include: pin action versions to specific commits (not `latest` or branches).
- github-actions script injection occurs when untrusted input reaches shell commands.
Verify before relying
Read SKILL.md below before installing (1 file). Open directory: indexed for reading, not audited.
Install
DaleStudy/skills/github-actions · repository language: TypeScript
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How do I create a GitHub Actions workflow file?
github-actions workflows are defined in YAML files stored in `.github/workflows/` directory. Start with a workflow name, specify trigger events (like `push` or `pull_request`), and define jobs containing steps. Each step runs commands or uses actions. Use `name:`, `on:`, and `jobs:` as top-level keys. Reference the workflow structure template in documentation for a complete example with proper indentation and syntax.
What are github-actions security best practices I should follow?
github-actions security best practices include: pin action versions to specific commits (not `latest` or branches), use least privilege permissions via `permissions:` blocks, store secrets in GitHub Secrets and reference them as `${{ secrets.NAME }}`, avoid hardcoding credentials, validate untrusted inputs to prevent injection attacks, and review third-party actions before use. Never pass secrets as command-line arguments or log them.
How do I prevent script injection vulnerabilities in github-actions?
github-actions script injection occurs when untrusted input reaches shell commands. Prevent it by: avoiding `run:` with direct variable interpolation from pull requests, using action inputs instead of `github.event.pull_request.body`, setting `GITHUB_OUTPUT` safely, and using contexts like `github.event.pull_request` only in trusted contexts. For `pull_request_target`, apply extra caution since it runs with write permissions on the base branch.
What permissions should I set up in github-actions workflows?
github-actions permissions should follow least privilege: explicitly declare what your workflow needs via the `permissions:` key at job or workflow level. Common permissions include `contents: read` for checkout, `pull-requests: write` for comments, and `id-token: write` for OIDC. Default to minimal access and grant only required scopes. Avoid `permissions: write-all` unless absolutely necessary, and never grant `admin` without strong justification.
How do I manage and update github-actions action versions securely?
github-actions version management requires pinning actions to specific commit SHAs rather than tags or branches, which can be reassigned. Use `actions/checkout@abc123def456` format. Regularly audit and update versions using dependabot or manual reviews. Check release notes for security patches. Avoid `@latest` or `@main` in production workflows. For preinstalled tools like Node, Python, or Docker, verify version compatibility in workflow documentation.
How should I handle secrets and sensitive data in github-actions?
github-actions secrets handling: store credentials in GitHub repository or organization Secrets, never commit them to code. Reference secrets as `${{ secrets.SECRET_NAME }}`. Avoid logging secrets by using `::add-mask::` for sensitive output. Don't pass secrets to third-party actions unless necessary. Use environment variables to inject secrets into steps. For external systems, consider short-lived tokens via OIDC instead of long-lived credentials.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
GitHub Actions
> 참고: GitHub Actions 워크플로우 실행 및 결과 조회, 이슈/PR 관리 등 gh CLI 관련 작업은 github 스킬을 함께 로드하여 참조한다.
주의 사항 (Anti-patterns)
1. 오래된 버전 사용
# ❌ 오래된 버전 - 가장 흔한 실수
uses: actions/checkout@v4 # v6가 최신인 경우
# ✅ 최신 메이저 버전 (gh release view로 확인 후 사용)
uses: actions/checkout@v6
최신 버전에서 제공하는 성능 개선과 보안 패치를 놓치지 않도록 합니다.
버전 확인 명령어:
gh release view --repo {owner}/{repo} --json tagName --jq '.tagName'
# 예시
gh release view --repo actions/checkout --json tagName --jq '.tagName'
gh release view --repo oven-sh/setup-bun --json tagName --jq '.tagName'
> 참고: 보안 민감 환경이나 신뢰도 낮은 서드파티 액션은 SHA 피닝(@a1b2c3...)을 고려.
2. 민감정보 하드코딩
```yaml
❌ 하드코딩 - 보안 위험
env: API_KEY: "sk-1234567890"
(truncated - see the full file via the links below)
File tree — 1 file
skills/github-actions/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Create and configure GitHub Actions workflows with security best practices”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Workflow Audit systematically reviews `.github/workflows/*.yml` files against security hardening, action version currency, and reliability standards. It discovers all workflow files, validates YAML syntax, runs a comprehensive checklist covering permissions, script injection, timeouts, and cross-workflow consistency, then reports findings sorted by severity with concrete fixes for each issue.
Configure production-ready deployment pipelines for Cloudflare Workers using GitHub Actions or GitLab CI. This skill covers automated testing on every commit, multi-environment deployments, preview URLs per pull request, secrets management, and deployment verification to prevent failures and enforce safe release practices.
This skill streamlines GitHub Actions workflow creation by generating or updating CI/CD configurations tailored to your project's needs. Whether you're setting up automated testing, building containers, or deploying applications, it handles the boilerplate and best practices so you can focus on your pipeline logic.
This skill guides you through GitHub-driven agile setup and troubleshooting, from CLI installation through backlog management and pull request discipline. It helps you establish healthy practices around issues, branches, and context preservation—ensuring your work stays traceable and your team stays aligned.
Release Workflow orchestrates the complete publication cycle for GitHub projects, from version synchronization through CI validation and artifact generation. It enforces cost-conscious practices to prevent misusing release pipelines as testing mechanisms, includes monorepo support for batch publishing multiple components, and provides recovery procedures for hotfixes.
Cp combines staging, committing, and pushing into a single streamlined action. It auto-generates conventional commit messages based on your changes, protects against accidental pushes to main branches, and scans for leaked secrets before committing.