Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
# Use yamllint or GitHub's workflow validator
yamllint .github/workflows/*.yml
✅ Test workflows on feature branch first
git checkout -b test/github-actions
# Push and verify CI runs before merging to main
Never Do
❌ Don't use @latest for action versions
Breaks without warning when actions update
Security risk (unvetted versions auto-adopted)
❌ Don't hardcode secrets in workflows
# ❌ NEVER DO THISenv:API_TOKEN:"sk_live_abc123..."# Secret exposed in repo!
❌ Don't skip build steps for compiled languages (CodeQL)
# ❌ WRONG - CodeQL fails for Java without build-name:PerformCodeQLAnalysis# No .class files to analyze# ✅ CORRECT - Include build-name:Buildprojectrun:./mvnwcleaninstall-name:PerformCodeQLAnalysis# Now has .class files
❌ Don't ignore devDependencies in Dependabot
DevDependencies run during build, can execute malicious code
Include both prod and dev dependencies
❌ Don't use single ISSUE_TEMPLATE.md file
# ❌ OLD WAY
.github/ISSUE_TEMPLATE.md
# ✅ NEW WAY
.github/ISSUE_TEMPLATE/
bug_report.yml
feature_request.yml
Known Issues Prevention (Top 5)
This skill prevents 18 documented issues. Here are the top 5 most critical:
Issue #1: YAML Indentation Errors ⚠️ MOST COMMON
Error: workflow file is invalid. mapping values are not allowed in this contextSource: Stack Overflow (most common GitHub Actions error)
Why It Happens: Spaces vs tabs, missing spaces after colons, inconsistent indentation
Prevention: Use skill templates with validated 2-space indentation
Impact: Workflow fails to parse, CI doesn't run
Issue #2: Action Version Pinning Issues 🔒 SECURITY
Error: Workflow breaks unexpectedly after action updates
Source: GitHub Security Best Practices 2025
Why It Happens: Using @latest or @v4 instead of specific SHA
Prevention: All templates pin to SHA with version comment
Impact: Unexpected breaking changes, security vulnerabilities
Issue #3: Secrets Not Available 🔑
Error: Secret not found or empty variable
Source: GitHub Actions Debugging Guides
Why It Happens: Wrong syntax ($secrets.NAME instead of ${{ secrets.NAME }})
Prevention: Templates demonstrate correct context syntax
Impact: Deployment failures, broken CI/CD pipelines
Issue #4: CodeQL Not Running on Dependabot PRs 🛡️
Error: Security scans skipped on dependency updates
Source: GitHub Community Discussion #121836
Why It Happens: Default trigger limitations
Prevention: Templates include push: branches: [dependabot/**]Impact: Vulnerable dependencies merged without scanning
Issue #5: Missing Required Fields in Issue Templates 📋
Error: Incomplete issues, missing critical info
Source: Community Feedback
Why It Happens: Markdown templates don't validate
Prevention: YAML templates with required: true validation
Impact: Can't reproduce bugs, wasted triage time
For complete error documentation with all 18 issues: Load references/common-errors.md when debugging GitHub Actions issues or configuring workflows.
When to Load References
Load reference files when working on specific aspects of GitHub automation:
Common Errors (references/common-errors.md)
Load when:
Encountering workflow syntax errors
Debugging failed GitHub Actions runs
Setting up CodeQL or Dependabot for first time
Resolving "Secret not found" errors
Understanding why matrix builds fail
Need detailed solutions for any of the 18 documented errors
Setting up multi-environment deployments (staging/production)
Creating reusable workflows or composite actions
Optimizing CI/CD pipeline performance
Implementing advanced matrix strategies
Using OIDC for cloud authentication (no long-lived secrets)
Need workflow optimization techniques
Integration with Existing Skills
cloudflare-worker-base → Add CI/CD
When user creates new Worker project:
# User: "Create Cloudflare Worker with CI/CD"# This skill runs AFTER cloudflare-worker-basecp templates/workflows/ci-cloudflare-workers.yml .github/workflows/deploy.yml
# Configure secrets
gh secret set CLOUDFLARE_API_TOKEN
Result: New Worker with automated deployment on push to main
project-planning → Generate Automation
When user uses project-planning skill:
# User: "Plan new React app with GitHub automation"# project-planning generates IMPLEMENTATION_PHASES.md# Then this skill sets up GitHub automationcp templates/workflows/ci-react.yml .github/workflows/ci.yml
cp templates/issue-templates/*.yml .github/ISSUE_TEMPLATE/
Result: Planned project with complete GitHub automation
