gha-skills

gha-skills

Agent Skills that make coding agents write GitHub Actions workflows that trigger when intended, stay fast, and do not leak secrets.

Works with Claude Code, Codex, Gemini CLI and Cursor. Each skill is a plain SKILL.md folder following the Agent Skills specification.

Skills

Why this pack

Agents write a lot of workflow YAML, and most of it lints clean and is still wrong. Recurring failures:

• ${{ github.event.pull_request.title }} pasted into run:, which is a shell injection.
• pull_request_target workflows that build fork code with a write token.
• Release workflows that never fire because the tag was pushed with GITHUB_TOKEN.
• if: ${{ x }} && y, which is always true.
• Required checks on matrix legs that pass when every leg was skipped.
• OIDC trust policies written for ref:refs/heads/main on a job that uses environment:.
• Caches saved from PRs that no other branch can read, filling the quota.

Existing skill collections cover CI only as one generic "devops" skill, if at all. This pack goes deep on one platform and states the current behavior of GitHub Actions as of 2026: actions/checkout v7 refusing fork checkouts in pull_request_target, immutable OIDC subject claims, npm trusted publishing, Node 24 action runtime, reusable workflow limits of 10 levels and 50 workflows.

Install

Claude Code

As a plugin:

/plugin marketplace add Abdalkaderdev/gha-skills
/plugin install gha-skills@gha-skills

Skills are then namespaced, e.g. gha-skills:gha-caching.

Manually, for all projects:

git clone https://github.com/Abdalkaderdev/gha-skills.git
cp -r gha-skills/skills/* ~/.claude/skills/

For a single project, copy into .claude/skills/ in that repository instead.

Codex

git clone https://github.com/Abdalkaderdev/gha-skills.git
mkdir -p ~/.agents/skills
cp -r gha-skills/skills/* ~/.agents/skills/

Project scope: .agents/skills/ at the repository root. Restart Codex if the skills do not appear.

Gemini CLI

gemini skills install https://github.com/Abdalkaderdev/gha-skills.git --path skills

Or from a clone: gemini skills install ./gha-skills/skills. Add --scope workspace to install into the current project only. Check with gemini skills list.

Cursor

git clone https://github.com/Abdalkaderdev/gha-skills.git
mkdir -p ~/.cursor/skills
cp -r gha-skills/skills/* ~/.cursor/skills/

Project scope: .cursor/skills/. Cursor also reads ~/.claude/skills and ~/.agents/skills, so one copy there serves both agents.

On Windows PowerShell, replace cp -r with Copy-Item -Recurse and ~ with $HOME.

Example

Prompt: "Add a workflow that posts a comment on every PR with the test results."

Without the pack, agents commonly produce:

on: pull_request_target
permissions: write-all
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      - run: npm ci && npm test
      - run: gh pr comment ${{ github.event.number }} --body "Tests passed for ${{ github.event.pull_request.title }}"

That runs fork code with a write token and secrets, and the PR title is executed as shell. With gha-security-hardening loaded, the agent splits it into an unprivileged pull_request job that uploads results and a workflow_run job that only reads the artifact as data, validates the PR number, scopes pull-requests: write to that one job, and passes every event field through env:. The full rewrite is in untrusted-triggers.md.

Contributing

Issues and PRs welcome. A change should fix something an agent gets wrong in practice; general GitHub Actions documentation does not belong here.

• One skill per folder under skills/. Folder name equals the name field: lowercase letters, digits, single hyphens.
• Frontmatter keys allowed by the spec only: name, description, license, compatibility, metadata, allowed-tools.
• description says what the skill does and when to use it, at most 1024 characters.
• Keep SKILL.md under 500 lines. Move long examples into references/ and link them from SKILL.md.
• Claims about GitHub behavior should be checkable against GitHub docs or changelog; link the source in the PR.
• Run npm test before opening a PR. CI runs the same check.
• Commit messages follow Conventional Commits.

License

MIT

Author

Abdalkader Alhamoud · abdalkader.dev · github.com/Abdalkaderdev