github-actions

This skill guides you through building GitHub Actions workflows with emphasis on security, proper versioning, and avoiding common pitfalls. It covers workflow structure, permissions, events, and recommended actions while highlighting anti-patterns like hardcoded secrets and injection vulnerabilities.

GitHub Actions skill helps you create secure, properly-versioned workflows following CI/CD best practices.

AI-generated summary based on this skill's SKILL.md

★ 4 ⁮ 0 MIT updated 2026-04-07 by DaleStudy

Install

DaleStudy/skills/github-actions · repository language: TypeScript

Manual (git clone) CLI (skillfed)

git clone https://github.com/DaleStudy/skills
cp -r skills/skills/github-actions ~/.claude/skills/github-actions

npx skillfed install DaleStudy/skills/github-actions

Frequently asked questions

AI-generated answers based on this skill's SKILL.md and metadata

How do I create a GitHub Actions workflow file?

github-actions workflows are defined in YAML files stored in `.github/workflows/` directory. Start with a workflow name, specify trigger events (like `push` or `pull_request`), and define jobs containing steps. Each step runs commands or uses actions. Use `name:`, `on:`, and `jobs:` as top-level keys. Reference the workflow structure template in documentation for a complete example with proper indentation and syntax.

What are github-actions security best practices I should follow?

github-actions security best practices include: pin action versions to specific commits (not `latest` or branches), use least privilege permissions via `permissions:` blocks, store secrets in GitHub Secrets and reference them as `${{ secrets.NAME }}`, avoid hardcoding credentials, validate untrusted inputs to prevent injection attacks, and review third-party actions before use. Never pass secrets as command-line arguments or log them.

How do I prevent script injection vulnerabilities in github-actions?

github-actions script injection occurs when untrusted input reaches shell commands. Prevent it by: avoiding `run:` with direct variable interpolation from pull requests, using action inputs instead of `github.event.pull_request.body`, setting `GITHUB_OUTPUT` safely, and using contexts like `github.event.pull_request` only in trusted contexts. For `pull_request_target`, apply extra caution since it runs with write permissions on the base branch.

What permissions should I set up in github-actions workflows?

github-actions permissions should follow least privilege: explicitly declare what your workflow needs via the `permissions:` key at job or workflow level. Common permissions include `contents: read` for checkout, `pull-requests: write` for comments, and `id-token: write` for OIDC. Default to minimal access and grant only required scopes. Avoid `permissions: write-all` unless absolutely necessary, and never grant `admin` without strong justification.

How do I manage and update github-actions action versions securely?

github-actions version management requires pinning actions to specific commit SHAs rather than tags or branches, which can be reassigned. Use `actions/checkout@abc123def456` format. Regularly audit and update versions using dependabot or manual reviews. Check release notes for security patches. Avoid `@latest` or `@main` in production workflows. For preinstalled tools like Node, Python, or Docker, verify version compatibility in workflow documentation.

How should I handle secrets and sensitive data in github-actions?

github-actions secrets handling: store credentials in GitHub repository or organization Secrets, never commit them to code. Reference secrets as `${{ secrets.SECRET_NAME }}`. Avoid logging secrets by using `::add-mask::` for sensitive output. Don't pass secrets to third-party actions unless necessary. Use environment variables to inject secrets into steps. For external systems, consider short-lived tokens via OIDC instead of long-lived credentials.

SKILL.md

rendered from the published skill — quoted content, verbatim

GitHub Actions

> 참고: GitHub Actions 워크플로우 실행 및 결과 조회, 이슈/PR 관리 등 gh CLI 관련 작업은 github 스킬을 함께 로드하여 참조한다.

주의 사항 (Anti-patterns)

1. 오래된 버전 사용

# ❌ 오래된 버전 - 가장 흔한 실수
uses: actions/checkout@v4 # v6가 최신인 경우

# ✅ 최신 메이저 버전 (gh release view로 확인 후 사용)
uses: actions/checkout@v6

최신 버전에서 제공하는 성능 개선과 보안 패치를 놓치지 않도록 합니다.

버전 확인 명령어:

gh release view --repo {owner}/{repo} --json tagName --jq '.tagName'

# 예시
gh release view --repo actions/checkout --json tagName --jq '.tagName'
gh release view --repo oven-sh/setup-bun --json tagName --jq '.tagName'

> 참고: 보안 민감 환경이나 신뢰도 낮은 서드파티 액션은 SHA 피닝(@a1b2c3...)을 고려.

2. 민감정보 하드코딩

```yaml

❌ 하드코딩 - 보안 위험

env: API_KEY: "sk-1234567890"

(truncated - see the full file via the links below)

Read as markdown · JSON record · Browse the source repository

File tree — 1 file

skills/github-actions/SKILL.md

All skills by DaleStudy →