Menu
Enforce secure and reproducible GitHub Actions workflows by pinning every action to an immutable commit SHA with an explicit version comment.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Use git-cz or Commitizen to create semantic git commits and configure repositories for guided commit message generation. Use when the user asks to run `git cz`, `git-cz`, set up Commitizen, customize changelog.config.js, or produce non-interactive conventional commits.
Docker and Docker Compose best practices for reliable local/dev deployments and multi-arch image publishing. Use when writing or reviewing Dockerfiles, Compose files, or CI publish workflows.
Elixir and Phoenix best practices for interactive development, debugging, testing, and routine code changes. Use when writing, reviewing, or troubleshooting Elixir application code, Mix tasks, Ecto code, or Phoenix features.
Create, update, and review Architecture Decision Records using the MADR minimal template.
Prepare any git worktree by copying shared files from the main checkout using git common-dir metadata.
Maintain CHANGELOG entries following Keep a Changelog 1.1.0 with project-aligned versioning. Use when creating, updating, or reviewing changelog content for releases.
| name | github-actions |
| description | Enforce secure and reproducible GitHub Actions workflows by pinning every action to an immutable commit SHA with an explicit version comment. |
| license | MIT |
| metadata | {"author":"amami","version":"1.0.0"} |
Create and review GitHub Actions workflows with strict action pinning rules.
Use this skill when tasks include:
.github/workflows/*.ymluses: reference in workflows must pin to a full commit SHA.actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1uses: entries in workflow files.@v4) with full commit SHAs.# vX.Y.Z.uses: entries are pinned to full commit SHAs.@main, @master, or floating tag-only action references remain.When a Pull Request exists but no pull_request workflow run appears, push an empty commit to emit a synchronize event:
git checkout <pr-branch>
git commit --allow-empty -m "chore: trigger GitHub Actions for PR #<number>"
git push origin <pr-branch>
Then verify checks:
gh pr checks <pr-number> --repo <owner>/<repo>