github-agentic-workflows

Comprehensive expertise in GitHub Agentic Workflows (v0.68.1) — AI-powered repository automation with five-layer security, safe outputs, MCP tools, and Continuous AI patterns

Jump to install

Repository: Hack23/riksdagsmonitor
Last source activity: May 31, 2026 at 09:42
Detected SKILL.md language: English
Stars: 9
Forks: 3

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/Hack23/riksdagsmonitor --skill github-agentic-workflows

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

if: contains(github.event.issue.labels.*.name, 'bug')
run: echo "Bug detected"

Analyze this issue and provide helpful context based on the content and situation.

---
# YAML Frontmatter - Configuration
on: issues
permissions: read-all
tools:
  github:
engine: copilot
---

# Markdown Body - Natural Language Instructions

Analyze this issue and provide helpful triage information.

Consider:
- Issue content and context
- Related issues and PRs  
- Historical patterns
- Repository conventions

Provide actionable recommendations.

.github/
├── workflows/
│   ├── issue-triage.md         # Source markdown workflow
│   └── issue-triage.lock.yml   # Compiled GitHub Actions YAML
└── agents/
    └── agentic-workflows.agent.md  # Copilot Chat agent for workflow authoring

tools:
  github:
    toolsets:
      - repos       # Repository operations
      - issues      # Issue management
      - pull_requests  # PR operations
      - projects    # GitHub Projects v2

tools:
  edit:     # Edit existing files
  view:     # Read file contents
  create:   # Create new files

tools:
  web-fetch:   # Fetch URLs
  web-search:  # Search the web

tools:
  playwright:
    headless: true

tools:
  bash:
    allowed-commands:
      - npm
      - git

tools:
  custom-mcp:
    url: https://your-mcp-server.com
    headers:
      Authorization: Bearer ${{ secrets.API_TOKEN }}

flowchart TD
    A["📝 Input"] --> B["🔍 Compile-Time Validation"]
    B --> C["🏃 Runtime Isolation"]
    C --> D["🔐 Permission Separation"]
    D --> E["🌐 Network Controls"]
    E --> F["🧹 Output Sanitization"]
    F --> G["✅ Safe Actions"]
    
    style A fill:#e1f5ff
    style B fill:#fff3cd
    style C fill:#f8d7da
    style D fill:#d4edda
    style E fill:#d1ecf1
    style F fill:#f8d7da
    style G fill:#d4edda

permissions:
  contents: read        # Read code
  issues: read         # Read issues
  pull-requests: read  # Read PRs
  # No write permissions for AI job

safe-outputs:
  create-issue:
    max: 5           # Limit: 5 issues per run
  create-comment:
    max: 10
  create-pull-request:
    max: 1

tools:
  github:
    toolsets: [issues]  # Only issue operations
  edit:                 # Only file editing, no creation
  # web-fetch excluded - no web access

network:
  defaults: true  # Common development infrastructure
  # Or custom allowlist:
  allow:
    - github.com
    - api.github.com

threat-detection:
  enabled: true
  block-on-threat: true
  sarif-report: true

safe-inputs:
  analyze_issue:
    description: "Analyze issue content"
    input:
      issue_number:
        type: number
        required: true
      analysis_depth:
        type: string
        enum: [basic, detailed, comprehensive]
        default: detailed
    script: |
      # JavaScript to process input
      const issue = await fetch(`/repos/$owner/$repo/issues/${issue_number}`);
      return { analysis: processIssue(issue, analysis_depth) };

safe-outputs:
  create-issue:
    max: 5                # Max 5 issues per run
    labels: [automated]   # Automatically add label
    require-approval: false

safe-outputs:
  create-comment:
    max: 10
    target-repo: owner/repo  # Allow cross-repo comments

safe-outputs:
  create-pull-request:
    max: 1
    require-approval: true  # Human approval required
    draft: true             # Create as draft

safe-outputs:
  update-project:
    github-token: ${{ secrets.GH_AW_PROJECT_GITHUB_TOKEN }}
    # Requires organization-level Projects permissions

safe-outputs:
  upload-asset:
    branch: "assets/workflow-outputs"
    max-size: 10240  # 10 MB
    allowed-exts: [.png, .jpg, .svg, .json]

safe-outputs:
  minimize-comment:
    max: 5
    target-repo: owner/repo
    # Hides comments by marking as SPAM

safe-outputs:
  create-code-scanning-alert:
    max: 1
    # Upload SARIF for security findings

safe-outputs:
  messages:
    run-started: "🤖 Analysis starting! [{workflow_name}]({run_url})"
    run-success: "✅ Analysis complete!"
    run-failure: "❌ Analysis failed - check logs"
    footer: "> *Generated by [{workflow_name}]({run_url})*"

on:
  issues:
    types: [opened, edited, labeled]

on:
  pull_request:
    types: [opened, synchronize, reopened]

# Recommended: Natural language (auto-scattered time)
on: daily

# Or: Specific time (cron)
on:
  schedule:
    - cron: "0 9 * * 1"  # Monday 9 AM UTC

on:
  workflow_dispatch:
    inputs:
      organization:
        description: "GitHub organization to scan"
        required: true
        type: string
        default: github

on:
  slash_command:
    command: review
    # Triggered by "/review" in issue/PR comments

on:
  issues:
    types: [labeled]
  pull_request:
    types: [labeled]

# In workflow body, reference: ${{ github.event.label.name }}

---
on:
  slash_command:
    command: review
tools:
  github:
    toolsets: [pull_requests]
---

Review this pull request and provide feedback.

Check:
- Code quality and style
- Test coverage
- Security concerns
- Documentation updates

---
on: daily
safe-outputs:
  create-pull-request:
    max: 1
    draft: true
tools:
  edit:
---

Make one small, focused improvement to code quality.

Focus areas:
- Remove unused imports
- Improve variable names
- Add missing docstrings
- Simplify complex functions

Create a draft PR with the change.

---
on: workflow_dispatch
tools:
  github:
steps:
  - name: Gather Data
    run: |
      gh api /repos/$REPO/issues > issues.json
---

Analyze the collected issue data and generate insights:

- Identify trends
- Detect patterns
- Suggest improvements
- Create summary report

---
on:
  workflow_dispatch:
    inputs:
      scope:
        type: choice
        options: [full, incremental]
---

Perform maintenance tasks based on scope: ${{ inputs.scope }}

---
on:
  issues:
    types: [opened]
permissions:
  issues: read
safe-outputs:
  create-comment:
    max: 1
tools:
  github:
---

Analyze this issue and provide helpful triage information.

Check for:
- Duplicate issues
- Related PRs
- Missing information
- Suggested labels

Add a comment with your analysis.

---
on:
  issues:
    types: [labeled]
  pull_request:
    types: [labeled]
---

The label "${{ github.event.label.name }}" was added.

Take appropriate action based on the label:
- priority:critical → Notify team immediately
- needs-review → Request reviewers
- breaking-change → Update changelog

---
on: daily
tools:
  github:
  cache-memory:
    id: metrics-tracking
---

Track metrics over time using memory:

1. Load previous metrics from memory
2. Collect current metrics
3. Calculate trends and changes
4. Store updated metrics
5. Generate trend report

---
on: workflow_dispatch
tools:
  github:
safe-outputs:
  create-issue:
    target-repo: other-org/other-repo
permissions:
  issues: read
---

Analyze issues in this repository and create tracking issues
in the centralized tracking repository.

---
on:
  issues:
    types: [opened]
tools:
  github:
    toolsets: [projects, issues]
safe-outputs:
  update-project:
    github-token: ${{ secrets.GH_AW_PROJECT_GITHUB_TOKEN }}
---

Analyze this issue and update the project board:

1. Determine appropriate project
2. Set status field (Backlog/Todo/In Progress)
3. Set priority field (Critical/High/Medium/Low)
4. Set team field based on content
5. Add custom field values

automation-repo/
└── .github/workflows/
    └── main-repo-triage.md  # Targets main-repo

main-repo/
└── (production code)

---
on:
  push:
    paths: [specs/**.md]
tools:
  github:
  edit:
---

Update specifications and sync to implementations:

1. Validate RFC 2119 keywords (MUST, SHALL, SHOULD, MAY)
2. Check for breaking changes
3. Update consuming implementations
4. Create synchronization PRs

# Phase 1: Research Agent
---
on: workflow_dispatch
---
Investigate the codebase and report findings.

# Phase 2: Planner Agent (developer-invoked)
---
on: slash_command
  command: plan
safe-outputs:
  create-issue:
    max: 10
---
Create actionable issues from research findings.

# Phase 3: Implementation (developer assigns to Copilot)
# Developer assigns approved issues to @copilot

---
on: workflow_dispatch
tools:
  github:
---

Create a trial repository and test the workflow:

1. Create temporary private repo
2. Run workflow safely
3. Capture results
4. Report findings
5. Delete trial repo

# orchestrator.md - Dispatcher
---
on: weekly
tools:
  github:
---

Decide what work needs to be done and dispatch workers:

1. Analyze repository state
2. Identify tasks
3. Dispatch worker workflows with tracker ID
4. Monitor progress
5. Aggregate results

# worker.md - Focused Task
---
tracker-id: cleanup-project-v1
tools:
  edit:
safe-outputs:
  create-pull-request:
    max: 1
---

Perform focused cleanup task.

tools:
  cache-memory:
    id: my-workflow-data

Load previous data from cache-memory.
Update calculations.
Store results back to cache-memory.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

timeout-minutes: 45  # Fail faster than default 360 minutes

env:
  ORGANIZATION: ${{ github.event.inputs.organization || 'github' }}
  API_VERSION: v3
  NODE_ENV: production

imports:
  - security-guidelines.md
  - code-style-rules.md

labels: [automation, ci, diagnostics]

gh aw status --label automation

strict: true  # Enforce additional security checks

engine: copilot

gh auth token  # Requires PAT with copilot access

engine: claude

gh secret set ANTHROPIC_API_KEY

engine: codex

gh secret set OPENAI_API_KEY

gh extension install github/gh-aw

# Compile workflow (generate .lock.yml)
gh aw compile

# Watch for changes and auto-compile
gh aw compile --watch

# Compile with strict validation
gh aw compile --strict

# Validate without compiling
gh aw compile --validate-only

# Trigger workflow run
gh aw run issue-triage

# With inputs
gh aw run my-workflow --input organization=github

# Dry run (simulate without making changes)
gh aw run my-workflow --dry-run

# Check workflow status
gh aw status

# Filter by label
gh aw status --label automation

# Download and analyze logs
gh aw logs issue-triage --latest

# Check costs
gh aw logs --costs

# Interactive wizard
gh aw add-wizard github/repo/workflow.md

# Short form (for workflows/ directory)
gh aw add-wizard org/repo/workflow-name

# Direct add
gh aw add https://github.com/org/repo/blob/main/workflows/daily-status.md

# Initialize repository for agentic workflows
gh aw init

# Adds:
# - VSCode settings and prompts
# - Copilot agent files
# - Workflow management helpers

# Create GitHub Projects v2
gh aw project create "My Project"

# Add field
gh aw project field add --name Priority --type single-select

# List projects
gh aw project list

Create a workflow for GitHub Agentic Workflows using 
https://raw.githubusercontent.com/github/gh-aw/main/create.md

The purpose of the workflow is to triage issues.

# 1. Create workflow file
vim .github/workflows/my-workflow.md

# 2. Compile to YAML
gh aw compile

# 3. Commit both files
git add .github/workflows/my-workflow.md
git add .github/workflows/my-workflow.lock.yml
git commit -m "Add my-workflow"
git push

Create a workflow for GitHub Agentic Workflows using 
https://raw.githubusercontent.com/github/gh-aw/main/create.md

Remix the issue-triage.md workflow from github/gh-aw to add 
automatic labeling based on issue content and priority.

Start with Minimal Permissions

permissions:
  contents: read
  issues: read

Use Safe Outputs for Write Operations

safe-outputs:
  create-comment:
    max: 5

Enable Threat Detection

threat-detection:
  enabled: true
  block-on-threat: true

Limit Tool Access

tools:
  github:
    toolsets: [issues]  # Only what's needed

Control Network Access

network:
  allow:
    - github.com
    - api.github.com

Use Secrets for Sensitive Data
```
env:
  API_KEY: ${{ secrets.API_KEY }}
```

Require Approval for Critical Actions

safe-outputs:
  create-pull-request:
    require-approval: true

Test in Dry Run Mode
```
gh aw run my-workflow --dry-run
```
Monitor Logs and Costs
```
gh aw logs --costs
```
Validate Before Committing
```
gh aw compile --strict --validate-only
```

Don't Grant Excessive Permissions

# ❌ Bad
permissions: write-all

# ✅ Good
permissions:
  contents: read

Don't Skip Compilation
- Always commit both .md and .lock.yml
- Lock file contains security hardening

Don't Hardcode Secrets

# ❌ Bad
env:
  TOKEN: ghp_hardcoded

# ✅ Good
env:
  TOKEN: ${{ secrets.GITHUB_TOKEN }}

Don't Disable Security Features

# ❌ Bad
threat-detection:
  enabled: false

Don't Grant Unlimited Safe Outputs

# ❌ Bad
safe-outputs:
  create-issue:
    max: 999

# ✅ Good
safe-outputs:
  create-issue:
    max: 5

Don't Skip Testing
- Always test with dry run first
- Validate in trial repository
- Monitor initial runs closely
Don't Trust External Workflows Blindly
- Review workflow content before adding
- Understand what it does
- Check source is trusted
Don't Ignore Costs
- Monitor AI engine usage
- Set appropriate limits
- Review logs regularly

# Check costs for specific workflow
gh aw logs my-workflow --costs

# View aggregated costs
gh aw logs --costs --all

---
on:
  issues:
    types: [opened]
permissions:
  issues: read
safe-outputs:
  create-comment:
    max: 1
tools:
  github:
    toolsets: [issues, repos]
labels: [automation, triage]
---

Triage this newly created issue:

1. **Check for duplicates**: Search for similar issues
2. **Assess completeness**: Does it have enough information?
3. **Suggest labels**: Based on content and category
4. **Recommend team**: Which team should handle this?
5. **Estimate priority**: Critical, High, Medium, or Low

Add a comment with your analysis and recommendations.
Be helpful and constructive.

---
on: daily
safe-outputs:
  create-pull-request:
    max: 1
    draft: true
tools:
  edit:
  view:
  github:
labels: [automation, code-quality]
---

Make one small, focused code quality improvement:

**Focus areas:**
- Remove unused imports
- Improve variable names for clarity
- Add missing docstrings
- Simplify overly complex functions
- Fix code style issues

**Requirements:**
- Change only 1-2 files
- Keep changes minimal and focused
- Include clear commit message
- Create draft PR with explanation

**Avoid:**
- Large refactorings
- Breaking changes
- Multiple unrelated changes

---
on:
  slash_command:
    command: review
tools:
  github:
    toolsets: [pull_requests, repos]
safe-outputs:
  create-comment:
    max: 1
---

Review this pull request: #${{ github.event.issue.number }}

**Check:**
1. **Code Quality**: Style, readability, maintainability
2. **Tests**: Are there adequate tests?
3. **Documentation**: Are docs updated?
4. **Security**: Any security concerns?
5. **Performance**: Any performance implications?

**Provide:**
- Constructive feedback
- Specific suggestions
- Praise for good practices
- Questions about unclear code

Add your review as a comment.

---
on: weekly on monday
tools:
  github:
    toolsets: [issues, pull_requests, repos]
  cache-memory:
    id: weekly-status
safe-outputs:
  create-issue:
    max: 1
    labels: [report, weekly]
---

Generate weekly repository status report:

**Analyze:**
- Issues opened/closed this week
- PRs merged and pending
- Top contributors
- Notable changes
- Trends compared to previous week

**Format:**
- Executive summary
- Key metrics with changes
- Highlights and achievements
- Action items and concerns

Store metrics in cache-memory for next week's comparison.
Create issue with report titled "Weekly Status - [Date]".

---
on:
  push:
    branches: [main]
tools:
  github:
    toolsets: [repos]
  bash:
    allowed-commands: [npm, git]
safe-outputs:
  create-code-scanning-alert:
    max: 1
steps:
  - name: Run Security Scanners
    run: |
      npm audit --json > audit.json
      npm outdated --json > outdated.json
---

Analyze security scan results and generate SARIF report:

1. Parse npm audit findings
2. Check outdated dependencies for CVEs
3. Assess severity and exploitability
4. Generate SARIF format report
5. Include remediation guidance

Upload findings to GitHub Code Scanning.

// scripts/data-transformers.js
const titleHtml = (report.titel && !report.title)
  ? `<span data-translate="true" lang="sv">${escapeHtml(report.titel)}</span>`
  : escapeHtml(report.title || report.titel);

Agentic Workflow translates marked content:

Step 5: Translate Swedish Content (CRITICAL - MANDATORY)

🚨 THIS STEP IS ABSOLUTELY MANDATORY. DO NOT SKIP. 🚨

For EACH non-Swedish article:

Identify articles needing translation:

for article in news/*-{en,da,no,fi,de,fr,es,nl,ar,he,ja,ko,zh}.html; do
  if [ -f "$article" ] && grep -q 'data-translate="true"' "$article"; then
    echo "NEEDS TRANSLATION: $article"
  fi
done

Translate EACH file:
- Read the article file
- Find all <span data-translate="true" lang="sv">Swedish text</span>
- Translate the Swedish text to the article's target language
- Replace the span with plain translated text
- Consult TRANSLATION_GUIDE.md for correct terminology
- Write the updated file back

Validation (MANDATORY):

UNTRANSLATED=0
for article in news/*-{en,da,no,fi,de,fr,es,nl,ar,he,ja,ko,zh}.html; do
  if [ -f "$article" ] && grep -q 'data-translate="true"' "$article"; then
    echo "❌ UNTRANSLATED: $(basename $article)"
    UNTRANSLATED=$((UNTRANSLATED + 1))
  fi
done

if [ $UNTRANSLATED -gt 0 ]; then
  echo "❌ $UNTRANSLATED articles contain untranslated Swedish content!"
  exit 1
else
  echo "✅ All articles fully translated"
fi

Validation Script catches missed translations:

// scripts/validate-news-translations.js
function checkFileForUntranslatedContent(filepath) {
  const content = readFileSync(filepath, 'utf-8');
  const markers = content.match(/data-translate="true"/g);
  return markers ? { passed: false, markerCount: markers.length } : { passed: true };
}

name	github-agentic-workflows
description	Comprehensive expertise in GitHub Agentic Workflows (v0.68.1) — AI-powered repository automation with five-layer security, safe outputs, MCP tools, and Continuous AI patterns
license	Apache-2.0
version	2.0.1
last_updated	"2026-04-13T00:00:00.000Z"
tags	["automation","ai","github-actions","mcp","security","continuous-ai","gh-aw"]

name	github-agentic-workflows
description	Comprehensive expertise in GitHub Agentic Workflows (v0.68.1) — AI-powered repository automation with five-layer security, safe outputs, MCP tools, and Continuous AI patterns
license	Apache-2.0
version	2.0.1
last_updated	"2026-04-13T00:00:00.000Z"
tags	["automation","ai","github-actions","mcp","security","continuous-ai","gh-aw"]

github-agentic-workflows

Source facts

Install options

Review the source files

🤖 GitHub Agentic Workflows Skill

🔴 AI FIRST Quality Principle

📋 Purpose

🎯 Core Concepts

🤖 GitHub Agentic Workflows Skill

🔴 AI FIRST Quality Principle

📋 Purpose

🎯 Core Concepts

What Are Agentic Workflows?

Continuous AI Pattern

🏗️ Workflow Structure

Anatomy of an Agentic Workflow

File Organization

🔧 Tools and Model Context Protocol (MCP)

What is MCP?

Available Tools

1. GitHub Tools (github:)

2. File Operations

3. Web Access

4. Browser Automation

5. Shell Commands

6. Custom MCP Servers

MCP Gateway

��️ Security Architecture

Defense-in-Depth Layers

Security Principles

1. Minimal Permissions (Least Privilege)

2. Safe Outputs (Pre-Approved Actions)

3. Tool Allowlists

4. Network Restrictions

5. Threat Detection

Prompt Injection Protection

🔒 Safe Inputs and Safe Outputs

Safe Inputs - Custom Tools

Safe Outputs - Pre-Approved Actions

Create Issue

Create Comment

Create Pull Request

Update Project Board

Upload Assets

Minimize Comment

Create Code Scanning Alert (SARIF)

Safe Output Messages

🎯 Triggers (When Workflows Run)

Issue Events

Pull Request Events

Scheduled Runs

Manual Dispatch

Slash Commands (ChatOps)

Label Changes

🎭 Operational Patterns

1. ChatOps - Interactive Automation

2. DailyOps - Incremental Improvements

3. DataOps - Extract + Analyze

4. DispatchOps - On-Demand Tasks

5. IssueOps - Automated Triage

6. LabelOps - Label-Based Triggers

7. MemoryOps - Stateful Workflows

8. MultiRepoOps - Cross-Repository

9. ProjectOps - Board Automation

10. SideRepoOps - Separate Automation

11. SpecOps - Specification Maintenance

12. TaskOps - Scaffolded Improvements

13. TrialOps - Isolated Testing

🔄 Orchestration Patterns

Orchestrator/Worker Design

🧰 Advanced Features

Memory Systems

Cache Memory (7-day retention)

Concurrency Control

Timeout Settings

Environment Variables

Imports (Reusable Components)

Labels (Organization)

Strict Mode (Enhanced Validation)

🎨 AI Engines

1. GitHub Tools (`github:`)