| skill_id | nezam-github-actions-ci |
| name | nezam-Github Actions Ci |
| tier | 3 |
| description | Deterministic CI/CD workflow authoring for GitHub Actions with required checks, artifact hygiene, and release safety controls. |
| version | 1.0.0 |
| updated | "2026-05-08T00:00:00.000Z" |
| changelog | [] |
Purpose
Create and maintain production-grade GitHub Actions workflows aligned with NEZAM SDD gates and /SCAN//FIX quality loops.
Inputs
- Existing
.github/workflows/*.yml files.
- Branching/release policy docs (
.nezam/core/plans/legacy/tag-version-plan.md, .nezam/core/plans/legacy/commit-conventions.md).
- Required quality commands (lint, tests, type-check, security scans).
Step-by-Step Workflow
- Audit current workflow topology (PR, push, release, manual dispatch triggers).
- Define job graph by responsibility:
- Validate: lint, type-check, format, unit tests.
- Verify: E2E and security scans.
- Release: tagging, changelog, publish.
- Set minimum permissions per workflow/job (
permissions: least privilege).
- Add deterministic caching and dependency install strategy.
- Configure matrix jobs only where they provide meaningful coverage.
- Add artifact upload with explicit retention windows and naming conventions.
- Configure required status checks for protected branches.
- Add failure-notification and retry-safe mechanics where needed.
- Validate workflow syntax and dry-run logic before merge.
- Document workflow ownership and expected runtime budgets in repository docs.
Validation & Metrics
- CI pass rate on PRs (target: >= 95%).
- Median workflow duration within budget.
- Required-check enforcement rate (target: 100% on protected branches).
- Artifact retention policy adherence (no orphan/indefinite artifacts).
Output Format
- New/updated workflow YAML files under
.github/workflows/.
- Required-check matrix and branch-protection mapping.
- Artifact lifecycle policy summary.
- CI health report (duration, flake risk, pass/fail trend).
Integration Hooks
/SCAN code and /SCAN tests consume CI outputs./FIX remediations must rerun affected workflow jobs before closure./SAVE records final CI evidence and release readiness.- GitHub webhook events: pull_request, push, workflow_dispatch, release.
Anti-Patterns
- Over-permissive
GITHUB_TOKEN scopes.
- Monolithic workflows with unrelated failure domains.
- Unbounded artifact retention and no cleanup policy.
- Required checks missing from protected branches.
External Reference
