{"id":"39f5da49-7e5e-47cb-bd04-1c804928e459","slug":"gha-skills","kind":"skill","name":"gha-skills","summary":"Agent skills for writing GitHub Actions that work and stay secure: security, caching, matrices, OIDC, releases, debugging","owner":"Abdalkaderdev","repoUrl":"https://github.com/Abdalkaderdev/gha-skills","license":"MIT","licenseTier":"permissive","trust":"community","stars":0,"match":null,"fewStars":true,"format":"skill","createdAt":"2026-10-08T00:02:01.000Z","addedAt":"2026-10-21T11:45:07.668Z","logoUrl":"https://avatars.githubusercontent.com/u/134341501?u=ee930eae2e0463aadf3c7c96c27e5271fd8b5767&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["developer-tools","writing"],"tags":["ci-cd","claude-code","codex","cursor","devsecops","gemini-cli","github-actions"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-22T17:42:13.330Z","sample":false,"url":"https://conduits.dev/tools/gha-skills","language":"JavaScript","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# gha-skills\n\nAgent Skills that make coding agents write GitHub Actions workflows that trigger when intended, stay fast, and do not leak secrets.\n\n[![CI](https://github.com/Abdalkaderdev/gha-skills/actions/workflows/ci.yml/badge.svg)](https://github.com/Abdalkaderdev/gha-skills/actions/workflows/ci.yml)\n[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)\n\nWorks with Claude Code, Codex, Gemini CLI and Cursor. Each skill is a plain `SKILL.md` folder following the [Agent Skills specification](https://agentskills.io/specification).\n\n## Skills\n\n| Skill | What it covers |\n| - | - |\n| [gha-workflow-authoring](skills/gha-workflow-authoring/SKILL.md) | Triggers, filters, shells, expressions, outputs and the defaults that silently break workflows |\n| [gha-security-hardening](skills/gha-security-hardening/SKILL.md) | Script injection, `pull_request_target`/`workflow_run`, token scopes, SHA pinning, cache poisoning |\n| [gha-caching](skills/gha-caching/SKILL.md) | Cache keys that hit, branch scoping, restore-only PRs, per-ecosystem paths, the 10 GB limit |\n| [gha-matrix-builds](skills/gha-matrix-builds/SKILL.md) | `include`/`exclude` resolution, dynamic matrices, required checks for matrix jobs, cross-OS legs |\n| [gha-reusable-workflows](skills/gha-reusable-workflows/SKILL.md) | `workflow_call` versus composite actions, secrets, permissions, outputs, nesting limits, versioning |\n| [gha-oidc-cloud-auth](skills/gha-oidc-cloud-auth/SKILL.md) | OIDC to AWS, Google Cloud and Azure, exact `sub` claims including the 2026 immutable-ID format |\n| [gha-release-publishing](skills/gha-release-publishing/SKILL.md) | Release triggers that actually fire, npm and PyPI trusted publishing, GHCR, immutable releases |\n| [gha-debugging](skills/gha-debugging/SKILL.md) | Runs that never started, stuck queues, error-message lookup, re-run semantics, `gh run` workflow |\n\n## Why this pack\n\nAgents write a lot of workflow YAML, and most of it lints clean and is still wrong. Recurring failures:\n\n- `${{ github.event.pull_request.title }}` pasted into `run:`, which is a shell injection.\n- `pull_request_target` workflows that build fork code with a write token.\n- Release workflows that never fire because the tag was pushed with `GITHUB_TOKEN`.\n- `if: ${{ x }} && y`, which is always true.\n- Required checks on matrix legs that pass when every leg was skipped.\n- OIDC trust policies written for `ref:refs/heads/main` on a job that uses `environment:`.\n- Caches saved from PRs that no other branch can read, filling the quota.\n\nExisting skill collections cover CI only as one generic \"devops\" skill, if at all. This pack goes deep on one platform and states the current behavior of GitHub Actions as of 2026: `actions/checkout` v7 refusing fork checkouts in `pull_request_target`, immutable OIDC subject claims, npm trusted publishing, Node 24 action runtime, reusable workflow limits of 10 levels and 50 workflows.\n\n## Install\n\n### Claude Code\n\nAs a plugin:\n\n```text\n/plugin marketplace add Abdalkaderdev/gha-skills\n/plugin install gha-skills@gha-skills\n```\n\nSkills are then namespaced, e.g. `gha-skills:gha-caching`.\n\nManually, for all projects:\n\n```bash\ngit clone https://github.com/Abdalkaderdev/gha-skills.git\ncp -r gha-skills/skills/* ~/.claude/skills/\n```\n\nFor a single project, copy into `.claude/skills/` in that repository instead.\n\n### Codex\n\n```bash\ngit clone https://github.com/Abdalkaderdev/gha-skills.git\nmkdir -p ~/.agents/skills\ncp -r gha-skills/skills/* ~/.agents/skills/\n```\n\nProject scope: `.agents/skills/` at the repository root. Restart Codex if the skills do not appear.\n\n### Gemini CLI\n\n```bash\ngemini skills install https://github.com/Abdalkaderdev/gha-skills.git --path skills\n```\n\nOr from a clone: `gemini skills install ./gha-skills/skills`. Add `--scope workspace` to install into the current project only. Check with `gemini skills list`.\n\n### Cursor\n\n```bash\ngit clone https://github.com/Abdalkaderdev/gha-skills.git\nmkdir -p ~/.cursor/skills\ncp -r gha-skills/skills/* ~/.cursor/skills/\n```\n\nProject scope: `.cursor/skills/`. Cursor also reads `~/.claude/skills` and `~/.agents/skills`, so one copy there serves both agents.\n\nOn Windows PowerShell, replace `cp -r` with `Copy-Item -Recurse` and `~` with `$HOME`.\n\n## Example\n\nPrompt: \"Add a workflow that posts a comment on every PR with the test results.\"\n\nWithout the pack, agents commonly produce:\n\n```yaml\non: pull_request_target\npermissions: write-all\njobs:\n  test:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          ref: ${{ github.event.pull_request.head.sha }}\n      - run: npm ci && npm test\n      - run: gh pr comment ${{ github.event.number }} --body \"Tests passed for ${{ github.event.pull_request.title }}\"\n```\n\nThat runs fork code with a write token and secrets, and the PR title is executed as shell. With `gha-security-hardening` loaded, the agent splits it into an unprivileged `pull_request` job that uploads results and a `workflow_run` job that only reads the artifact as data, validates the PR number, scopes `pull-requests: write` to that one job, and passes every event field through `env:`. The full rewrite is in [untrusted-triggers.md](skills/gha-security-hardening/references/untrusted-triggers.md).\n\n## Contributing\n\nIssues and PRs welcome. A change should fix something an agent gets wrong in practice; general GitHub Actions documentation does not belong here.\n\n- One skill per folder under `skills/`. Folder name equals the `name` field: lowercase letters, digits, single hyphens.\n- Frontmatter keys allowed by the spec only: `name`, `description`, `license`, `compatibility`, `metadata`, `allowed-tools`.\n- `description` says what the skill does and when to use it, at most 1024 characters.\n- Keep `SKILL.md` under 500 lines. Move long examples into `references/` and link them from `SKILL.md`.\n- Claims about GitHub behavior should be checkable against GitHub docs or changelog; link the source in the PR.\n- Run `npm test` before opening a PR. CI runs the same check.\n- Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/).\n\n## License\n\n[MIT](LICENSE)\n\n## Author\n\nAbdalkader Alhamoud · [abdalkader.dev](https://abdalkader.dev) · [github.com/Abdalkaderdev](https://github.com/Abdalkaderdev)\n"}