github-actions

Generates and validates GitHub Actions workflows and custom actions (composite/Docker/JavaScript) with SHA-pinned supply chain security, SLSA attestation, OIDC federation, and harden-runner enforcement. Use when creating, editing, reviewing, or validating CI/CD pipelines, reusable workflows, monorepo CI patterns, container build/deploy orchestration, or advanced triggers (workflow_run, dispatch, ChatOps).

Jump to install

Repository: bsamiee/Maghz
Last source activity: July 19, 2026 at 01:46
Detected SKILL.md language: English
Stars: 0
Forks: 0

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/bsamiee/Maghz --skill github-actions

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

27 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

docgen

Owns all prose, markdown files and the comments inside source files and fences through a register law, an anti-anchoring rule against rosters, counts, and freezes, a named defect catalog, file-kind templates, and a deterministic gate and fixer. Use when authoring, editing, reviewing, or markdown files of any kind, and comments in source files; when designing a document schema or marker vocabulary; when pruning code comments; or on "clean up this doc", "tighten the prose", "this doc is stale".

2026-07-23

agent-dispatch

Owns work placement and delegation craft across Claude Code's execution surfaces — main turn, `/btw`, fork, subagent, background task, nested subagent, agent team, dynamic workflow — with the selection economics that pick one, the delegation contract that makes a worker prompt self-contained (objective, territory, output contract, receipt), the communication topologies (star, pipeline, panel, tournament, generate-filter, loop), depth and fan-out budgeting, and the runtime mechanics of background permission surfacing, `SendMessage` resume, and worker memory. Use when parallelizing work, delegating a task to a subagent or teammate, choosing between a subagent, fork, team, or workflow, writing a `.claude/agents/` definition, designing a fan-out or review pipeline, or when a delegation stalls, over-prompts for permission, or returns weak results. Authoring runnable workflow scripts belongs to workflow-creator; gpt-5.6 offload belongs to the codex skill and Gemini offload to agy; harness configuration belongs to h

2026-07-19

agy

Bounded one-shot Gemini sub-calls through the Antigravity CLI (`agy`): multimodal judgment over screenshots, generated images, UI states, and diagrams, read-only adversarial review lanes that return typed falsifiable findings as a second-model perspective, Nano Banana image generation and edit iteration feeding html-studio and mermaid work, broad synthesis across competing designs, ambiguity reduction into crisp constraints, alternate approaches and counterexample hunts, and redacted log or dataset distillation. Use when a task gains from an external second model, a critique or red-team stage wants an independent Gemini lens, or the request names Gemini, Antigravity, Google Ultra, or Nano Banana. gpt-5.6 offload belongs to the codex skill; delegation across Claude's own surfaces belongs to agent-dispatch.

2026-07-19

View all from this repository

name

github-actions

description

[GITHUB_ACTIONS]

Generate and validate production-ready GitHub Actions workflows and custom actions.

[TASKS]:

Gather requirements — triggers, runners, dependencies, environments, security posture.
Read best-practices.md.
Read version-discovery.md.
Read expressions-and-contexts.md.
(advanced triggers) Read advanced-triggers.md.
(custom actions) Read custom-actions.md.
Resolve action versions — git ls-remote, Context7 MCP, or WebSearch for latest SHA.
Generate — SHA-pinned actions, minimal permissions, concurrency, caching, timeouts, harden-runner.
Validate — gha check <files> gates actionlint, zizmor, and ratchet as one typed envelope; apply the best-practice checks.
Prove locally — gha run [-j JOB] [-e EVENT.json] runs Linux jobs in containers; gha pin freezes mutable refs; hosted CI rules merges.
Fix and re-validate until passing (max 3 iterations).

[SCOPE]:

Workflow files (.github/workflows/*.yml).
Custom actions — composite, Docker, JavaScript (.github/actions/*/action.yml).
Reusable workflows (workflow_call).
Supply chain — SLSA attestation, SBOM, Cosign signing.
Monorepo CI — Nx affected detection, sparse checkout, pnpm workspace caching.

[01]-[ROUTING]

[REFERENCES]:

[01]-BEST_PRACTICES: security hardening, supply chain, performance, anti-patterns
[02]-VERSION_DISCOVERY: SHA resolution protocol, common actions index, permissions
[03]-EXPRESSIONS: contexts, functions, injection prevention
[04]-ADVANCED_TRIGGERS: workflow_run, dispatch, ChatOps, merge queue
[05]-CUSTOM_ACTIONS: composite, Docker, JavaScript action authoring
[06]-COMMON_ERRORS: syntax, expressions, deprecated commands
[07]-SUPPLY_CHAIN: SHA pinning, OIDC, SBOM, harden-runner
[08]-MODERN_FEATURES: reusable workflows, concurrency, matrix, node runtime
[09]-RUNNERS: runner labels, deprecations
[10]-ACT_USAGE: actionlint rules, act limitations

[TEMPLATES]:

[01]-BASIC_WORKFLOW: lint, test, build, deploy CI pipeline with parameterized runtime
[02]-REUSABLE_WORKFLOW: workflow_call with typed inputs, secrets, version extraction
[03]-COMPOSITE_ACTION: multi-step action with parameterized runtime and error handling
[04]-DOCKER_ACTION: container action with distroless multi-stage Dockerfile pattern
[05]-JAVASCRIPT_ACTION: Node 24 action with pre/post lifecycle, typed error handling

[EXAMPLES]:

[01]-NODEJS_CI: matrix testing, caching, artifact upload, coverage, summaries
[02]-DOCKER_BUILD_PUSH: multi-platform builds, GHCR, BuildKit caching, SLSA provenance
[03]-MONOREPO_CI: Nx affected detection, pnpm workspace, sparse checkout
[04]-DEPENDENCY_REVIEW: multi-job security with dep review, CodeQL, Gitleaks, triage
[05]-SBOM_ATTESTATION: SBOM, Trivy severity gating, Cosign, gh attestation verify
[06]-SETUP_NODE_CACHED: smart caching, corepack detection, cache-dir resolution
[07]-CHATOPS_DISPATCH: slash commands, injection guard, App token, env indirection
[08]-OIDC_CLOUD_AUTH: AWS/GCP/Azure OIDC, output normalization
[09]-RELEASE_DEPLOY: environment promotion, reusable workflow, concurrency groups
[10]-DOCKER_LINT_SCAN: Trivy scan, hadolint, SARIF output
[11]-PR_CHANGE_ROUTER: paths-filter, dynamic matrix, label sync

[02]-[STANDARDS]

Every generated workflow enforces defense-in-depth: supply chain integrity prevents compromised actions from executing, minimal permissions limit blast radius if a job is compromised, and harden-runner detects anomalous behavior at runtime. These layers are independent — failure of one leaves others intact.

[CRITICAL]:

[ALWAYS]: SHA-pin every uses: reference — CVE-2025-30066 retargeted tj-actions mutable tags (@v1, @main) to compromise consuming repos.
[ALWAYS]: step-security/harden-runner as first step in every job — detected the tj-actions breach.
[ALWAYS]: Top-level permissions: {} (deny-all default); grant minimal per-job permissions.
[ALWAYS]: timeout-minutes: on every job — prevents runaway billing on stuck workflows.

[IMPORTANT]:

[ALWAYS]: OIDC federation (id-token: write) for cloud auth — eliminates static credentials entirely.
[ALWAYS]: actions/create-github-app-token for cross-repo ops — scoped, 1-hour expiry, survives offboarding.
[ALWAYS]: >> $GITHUB_OUTPUT for step outputs; >> $GITHUB_STEP_SUMMARY for job summaries.
[NEVER]: Direct ${{ }} interpolation of untrusted input in run: blocks — route through env: indirection.

[REFERENCE] best-practices.md — Security checklist, supply chain controls, anti-patterns.

[03]-[TEMPLATES]

Templates use [PLACEHOLDER] syntax for generation-time substitution. SHA resolution happens at generation time via the discovery protocol — templates contain placeholder SHAs, not static pins.

[03.1]-[PLACEHOLDER_CONVENTION]

All templates use a unified [UPPER_SNAKE_CASE] placeholder convention:

[INDEX]	[CATEGORY]	[PLACEHOLDERS]
[01]	Identity	`[ACTION_NAME]`, `[WORKFLOW_NAME]`, `[DESCRIPTION]`, `[AUTHOR_NAME]`
[02]	Runtime	`[RUNTIME_VERSION]`, `[RUNTIME_ENV_KEY]`, `[ENABLE_CMD]`
[03]	Package Mgr	`[PACKAGE_MANAGER]`, `[INSTALL_CMD]`
[04]	Build/Test	`[BUILD_CMD]`, `[LINT_CMD]`, `[TEST_CMD]`, `[BUILD_PATH]`, `[RESULTS_PATH]`
[05]	Deploy	`[ENV_NAME]`, `[ENV_URL]`, `[DEPLOY_CMD]`, `[VERIFY_CMD]`
[06]	Secrets	`[SECRET_KEY]`, `[SECRET_NAME]`, `[REGISTRY_TOKEN]`
[07]	Docker	`[BASE_IMAGE]`, `[BUILDER_IMAGE]`, `[ENTRYPOINT]`

[03.2]-[HARDEN_RUNNER_SCOPE]

harden-runner is included as the first step in every workflow job template (basic, reusable). Action templates (composite, Docker, JavaScript) do NOT include harden-runner — the calling workflow is responsible for adding it as the first step in the job that invokes the action. Actions are steps, not jobs.

[REFERENCE] custom-actions.md — Action type selection, metadata, runtime deprecation.

[04]-[EXAMPLES]

Load the relevant examples before generation to match the target scenario.

[05]-[ACTION_DISCOVERY]

Static SHA catalogs decay — actions release frequently and stale pins miss security patches. Resolve versions at generation time. Never embed hardcoded SHAs in reference docs or templates.

[RESOLUTION_PROTOCOL]:

git ls-remote --tags https://github.com/{owner}/{repo} — verify tag exists.
gh api repos/{owner}/{repo}/git/ref/tags/{tag} --jq '.object.sha' — resolve tag to full SHA.
Format: owner/repo@<40-char-SHA> # vX.Y.Z.

[FALLBACK_METHODS]:

Context7 MCP: resolve-library-id then query-docs for action documentation.
WebSearch: "[owner/repo] [version] github action" for release notes.

[IMPORTANT]:

[ALWAYS]: Verify the tag exists before pinning — deleted tags return empty results.
[ALWAYS]: Include version comment suffix (# vX.Y.Z) — Dependabot parses it for automated updates.
[NEVER]: Embed static SHAs in reference files — they decay within weeks.

[REFERENCE] version-discovery.md — Discovery protocol, SHA pinning format, common actions index, automated maintenance.

[06]-[VALIDATION]

[VALIDATION_PIPELINE]: gha check folds the first three stages into one typed envelope.

[INDEX]	[STAGE]	[TOOL]	[VALIDATES]
[01]	Static Analysis	actionlint	YAML syntax, expressions, runner labels, action inputs, CRON, globs.
[02]	Security Audit	zizmor	Injection, credential persistence, unpinned uses, permission excess.
[03]	Ref Pinning	ratchet	Mutable `uses:` references; `gha pin` rewrites them to SHAs.
[04]	Best Practices	custom checks	SHA pinning, permissions, injection, timeouts, harden-runner.
[05]	Local Execution	act	`gha run` executes jobs in containers; dry-run via `gha run --dryrun`.

[BEST_PRACTICE_CHECKS]:

[INDEX]	[CHECK]	[TAG]	[DETECTS]
[01]	Deprecated commands	`[DEPRECATED-CMD]`	`::set-output`, `::save-state`, `::set-env`, `::add-path`.
[02]	Missing permissions	`[PERMISSIONS]`	No top-level `permissions: {}` deny-all default.
[03]	Unpinned actions	`[UNPINNED]`	Mutable tags (`@v1`, `@main`), abbreviated SHAs.
[04]	SHA without comment	`[SHA-NO-COMMENT]`	SHA-pinned but missing `# vX.Y.Z` version comment.
[05]	Missing timeout	`[TIMEOUT]`	Jobs without `timeout-minutes:` (default is 6 hours).
[06]	Deprecated runners	`[RUNNER]`	`ubuntu-20.04`, `macos-12`, `macos-13`, `windows-2019`.
[07]	Missing concurrency	`[CONCURRENCY]`	No `concurrency:` group or missing `cancel-in-progress`.
[08]	PAT usage	`[APP-TOKEN]`	PATs for cross-repo ops (use `create-github-app-token`).
[09]	No harden-runner

[ERROR_ROUTING]: Match error patterns to reference files — common_errors.md (syntax, expressions, deprecated), runners.md (labels, deprecations), supply_chain.md (SHA, OIDC, SBOM, harden-runner), modern_features.md (reusable workflows, concurrency, matrix, node runtime), act_usage.md (actionlint rules, act limitations).

[TROUBLESHOOTING]:

[INDEX]	[ISSUE]	[SOLUTION]
[01]	Tools not found	`gha` runtimeInputs unresolved — `forge-redeploy --switch`.
[02]	Docker not running	Start the runtime; `gha check` needs no Docker.
[03]	act fails, GitHub works	See act_usage.md — Limitations.
[04]	ARM Mac arch mismatch	Add `--container-architecture linux/amd64`.
[05]	Custom runner labels	Declare in `.github/actionlint.yaml`.

[REFERENCE] best-practices.md — Anti-patterns with specific remediations.

github-actions

Source facts

Install options

Review the source files

More from this repository

More from this repository

[GITHUB_ACTIONS]

[01]-[ROUTING]

[02]-[STANDARDS]

[03]-[TEMPLATES]

[03.1]-[PLACEHOLDER_CONVENTION]

[03.2]-[HARDEN_RUNNER_SCOPE]

[04]-[EXAMPLES]

[05]-[ACTION_DISCOVERY]

[06]-[VALIDATION]

[GITHUB_ACTIONS]

[01]-[ROUTING]

[02]-[STANDARDS]

[03]-[TEMPLATES]

[03.1]-[PLACEHOLDER_CONVENTION]

[03.2]-[HARDEN_RUNNER_SCOPE]

[04]-[EXAMPLES]

[05]-[ACTION_DISCOVERY]

[06]-[VALIDATION]