Owns GitHub Actions workflows and custom actions under `.github/` — workflow YAML, composite/Docker/JavaScript actions, reusable `workflow_call`, monorepo and container/release pipelines, SLSA/SBOM attestation, advanced triggers (workflow_run, dispatch, ChatOps) — their hardening (SHA pinning, OIDC, harden-runner, injection-safe `run:`), and the local gate `gha check|pin|run` over actionlint, zizmor, and act. Use on "the CI run is failing", "pin these actions", "this workflow has a security warning", "run the workflow locally", and on any actionlint rule, deprecated runner label, or `::set-output` error. `.claude/workflows/*.js` orchestrators belong to workflow-creator; shell bodies inside `run:` belong to coding-bash.
Owns GitHub Actions workflows and custom actions under `.github/` — workflow YAML, composite/Docker/JavaScript actions, reusable `workflow_call`, monorepo and container/release pipelines, SLSA/SBOM attestation, advanced triggers (workflow_run, dispatch, ChatOps) — their hardening (SHA pinning, OIDC, harden-runner, injection-safe `run:`), and the local gate `gha check|pin|run` over actionlint, zizmor, and act. Use on "the CI run is failing", "pin these actions", "this workflow has a security warning", "run the workflow locally", and on any actionlint rule, deprecated runner label, or `::set-output` error. `.claude/workflows/*.js` orchestrators belong to workflow-creator; shell bodies inside `run:` belong to coding-bash.
[GITHUB_ACTIONS]
Generate and validate production-ready GitHub Actions workflows and custom actions.
Every generated workflow enforces defense-in-depth: supply chain integrity prevents compromised actions from executing, minimal permissions limit blast radius if a job is compromised, and harden-runner detects anomalous behavior at runtime. These layers are independent — failure of one leaves others intact.
[CRITICAL]:
[ALWAYS]: SHA-pin every uses: reference — CVE-2025-30066 retargeted tj-actions mutable tags (@v1, @main) to compromise consuming repos.
[ALWAYS]: step-security/harden-runner as first step in every job — detected the tj-actions breach.
[ALWAYS]: Top-level permissions: {} (deny-all default); grant minimal per-job permissions.
[ALWAYS]: timeout-minutes: on every job — prevents runaway billing on stuck workflows.
Templates use [PLACEHOLDER] syntax for generation-time substitution. SHA resolution happens at generation time via the discovery protocol — templates contain placeholder SHAs, not static pins.
[03.1]-[PLACEHOLDER_CONVENTION]
All templates use a unified [UPPER_SNAKE_CASE] placeholder convention:
harden-runner is included as the first step in every workflow job template (basic, reusable). Action templates (composite, Docker, JavaScript) do NOT include harden-runner — the calling workflow is responsible for adding it as the first step in the job that invokes the action. Actions are steps, not jobs.
[REFERENCE] custom-actions.md — Action type selection, metadata, runtime deprecation.
[04]-[EXAMPLES]
Load the relevant examples before generation to match the target scenario.
[05]-[ACTION_DISCOVERY]
Static SHA catalogs decay — actions release frequently and stale pins miss security patches. Resolve versions at generation time. Never embed hardcoded SHAs in reference docs or templates.
[RESOLUTION_PROTOCOL]:
git ls-remote --tags https://github.com/{owner}/{repo} — verify tag exists.
gh api repos/{owner}/{repo}/git/ref/tags/{tag} --jq '.object.sha' — resolve tag to full SHA.
Format: owner/repo@<40-char-SHA> # vX.Y.Z.
[FALLBACK_METHODS]:
Context7 MCP: resolve-library-id then query-docs for action documentation.
WebSearch: "[owner/repo] [version] github action" for release notes.
[IMPORTANT]:
[ALWAYS]: Verify the tag exists before pinning — deleted tags return empty results.
[ALWAYS]: Include version comment suffix (# vX.Y.Z) — Dependabot parses it for automated updates.
[NEVER]: Embed static SHAs in reference files — they decay within weeks.
[REFERENCE] version-discovery.md — Discovery protocol, SHA pinning format, common actions index, automated maintenance.
[06]-[VALIDATION]
[VALIDATION_PIPELINE]: gha check folds the first three stages into one typed envelope.
