Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
# Use yamllint or GitHub's workflow validator
yamllint .github/workflows/*.yml
✅ Test workflows on feature branch first
git checkout -b test/github-actions
# Push and verify CI runs before merging to main
Never Do
❌ Don't use @latest for action versions
Breaks without warning when actions update
Security risk (unvetted versions auto-adopted)
❌ Don't hardcode secrets in workflows
# ❌ NEVER DO THISenv:API_TOKEN:"sk_live_abc123..."# Secret exposed in repo!
❌ Don't skip build steps for compiled languages (CodeQL)
# ❌ WRONG - CodeQL fails for Java without build-name:PerformCodeQLAnalysis# No .class files to analyze# ✅ CORRECT - Include build-name:Buildprojectrun:./mvnwcleaninstall-name:PerformCodeQLAnalysis# Now has .class files
❌ Don't ignore devDependencies in Dependabot
DevDependencies run during build, can execute malicious code
Include both prod and dev dependencies
❌ Don't use single ISSUE_TEMPLATE.md file
# ❌ OLD WAY
.github/ISSUE_TEMPLATE.md
# ✅ NEW WAY
.github/ISSUE_TEMPLATE/
bug_report.yml
feature_request.yml
Known Issues Prevention
This skill prevents 18 documented issues:
Issue #1: YAML Indentation Errors
Error: workflow file is invalid. mapping values are not allowed in this contextSource: Stack Overflow (most common GitHub Actions error)
Why It Happens: Spaces vs tabs, missing spaces after colons, inconsistent indentation
Prevention: Use skill templates with validated 2-space indentation
Issue #2: Missing run or uses Field
Error: Error: Step must have a run or uses keySource: GitHub Actions Error Logs
Why It Happens: Empty step definition, forgetting to add command
Prevention: Templates include complete step definitions
Issue #3: Action Version Pinning Issues
Error: Workflow breaks unexpectedly after action updates
Source: GitHub Security Best Practices 2025
Why It Happens: Using @latest or @v4 instead of specific SHA
Prevention: All templates pin to SHA with version comment
Issue #4: Incorrect Runner Version
Error: Unexpected environment changes, compatibility issues
Source: CI/CD Troubleshooting Guides
Why It Happens: ubuntu-latest changed from 22.04 → 24.04 in 2024
Prevention: Templates use explicit ubuntu-24.04
Issue #5: Multiple Keys with Same Name
Error: duplicate key found in mappingSource: YAML Parser Updates
Why It Happens: Copy-paste errors, duplicate job/step names
Prevention: Templates use unique, descriptive naming
Issue #6: Secrets Not Available
Error: Secret not found or empty variable
Source: GitHub Actions Debugging Guides
Why It Happens: Wrong syntax ($secrets.NAME instead of ${{ secrets.NAME }})
Prevention: Templates demonstrate correct context syntax
Issue #7: Matrix Strategy Errors
Error: Matrix doesn't expand, tests skipped
Source: Troubleshooting Guides
Why It Happens: Invalid matrix config, wrong variable reference
Prevention: Templates include working matrix examples
Issue #8: Context Syntax Errors
Error: Variables not interpolated, empty values
Source: GitHub Actions Docs
Why It Happens: Forgetting ${{ }} wrapper
Prevention: Templates show all context patterns
Issue #9: Overly Complex Templates
Error: Contributors ignore template, incomplete issues
Source: GitHub Best Practices
Why It Happens: 20+ fields, asking irrelevant details
Prevention: Skill templates are minimal (5-8 fields max)
Issue #10: Generic Prompts Without Context
Error: Vague bug reports, hard to reproduce
Source: Template Best Practices
Why It Happens: No guidance on what info is needed
Prevention: Templates include specific placeholders
Issue #11: Multiple Template Confusion
Error: Users don't know which template to use
Source: GitHub Docs
Why It Happens: Using single ISSUE_TEMPLATE.md file
Prevention: Proper ISSUE_TEMPLATE/ directory with config.yml
Issue #12: Missing Required Fields
Error: Incomplete issues, missing critical info
Source: Community Feedback
Why It Happens: Markdown templates don't validate
Prevention: YAML templates with required: true
Issue #13: CodeQL Not Running on Dependabot PRs
Error: Security scans skipped on dependency updates
Source: GitHub Community Discussion #121836
Why It Happens: Default trigger limitations
Prevention: Templates include push: branches: [dependabot/**]
Error: No code found to analyzeSource: CodeQL Documentation
Why It Happens: Missing build steps for Java/C++/C#
Prevention: Templates include build examples
Issue #16: Development Dependencies Ignored
Error: Vulnerable devDependencies not scanned
Source: Security Best Practices
Why It Happens: Thinking devDependencies don't matter
Prevention: Templates scan all dependencies
Issue #17: Dependabot Alert Limit
Error: Only 10 alerts auto-fixed, others queued
Source: GitHub Docs (hard limit)
Why It Happens: GitHub limits 10 open PRs per ecosystem
Prevention: Templates document limit and workaround
Issue #18: Workflow Duplication
Error: Wasted CI minutes, maintenance overhead
Source: DevSecOps Guides
Why It Happens: Separate workflows for CI/CodeQL/dependency review
Prevention: Templates offer integrated option
See: references/common-errors.md for detailed error documentation with examples
Configuration Files Reference
dependabot.yml (Full Example)
version:2updates:# npm dependencies (including devDependencies)-package-ecosystem:"npm"directory:"/"schedule:interval:"weekly"day:"monday"time:"09:00"timezone:"Australia/Sydney"open-pull-requests-limit:10# GitHub hard limitreviewers:-"jezweb"labels:-"dependencies"-"npm"commit-message:prefix:"chore"prefix-development:"chore"include:"scope"# GitHub Actions-package-ecosystem:"github-actions"directory:"/"schedule:interval:"weekly"open-pull-requests-limit:5labels:-"dependencies"-"github-actions"
Why these settings:
Weekly schedule reduces noise vs daily
10 PR limit matches GitHub maximum
Includes devDependencies (Error #16 prevention)
Reviewers auto-assigned for faster triage
Conventional commit prefixes (chore: for deps)
CodeQL Workflow (security-codeql.yml)
name:CodeQLSecurityScanon:push:branches: [main, master]
pull_request:branches: [main, master]
schedule:-cron:'0 0 * * 0'# Weekly on Sundaysjobs:analyze:runs-on:ubuntu-24.04permissions:actions:readcontents:readsecurity-events:write# REQUIRED for CodeQLstrategy:fail-fast:falsematrix:language: ['javascript-typescript'] # Add your languagessteps:-uses:actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683-name:InitializeCodeQLuses:github/codeql-action/init@ea9e4e37992a54ee68a9622e985e60c8e8f12d9fwith:languages:${{matrix.language}}# For compiled languages, add build here-name:PerformCodeQLAnalysisuses:github/codeql-action/analyze@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f
Critical permissions:
security-events: write is REQUIRED for CodeQL uploads
Without it, workflow fails silently
Common Patterns
Pattern 1: Multi-Framework Matrix Testing
Use for libraries that support multiple Node.js/Python versions:
strategy:matrix:node-version: [18, 20, 22] # LTS versionsfail-fast:false# Test all versions even if one failssteps:-uses:actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5afwith:node-version:${{matrix.node-version}}cache:'npm'# Cache dependencies for speed-run:npmci# Use ci (not install) for reproducible builds-run:npmtest
When to use: Libraries, CLI tools, packages with broad version support
When to use: Production deployments, avoiding test deployments from PRs
Pattern 3: Artifact Upload/Download
Share build outputs between jobs:
jobs:build:steps:-run:npmrunbuild-uses:actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882with:name:build-outputpath:dist/retention-days:7deploy:needs:buildsteps:-uses:actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16with:name:build-outputpath:dist/-run:# Deploy from dist/
When to use: Separating build and deployment, sharing test results
Using Bundled Resources
Scripts (scripts/)
Coming in Phase 3 - Automation scripts for common tasks:
# User: "Create Cloudflare Worker with CI/CD"# This skill runs AFTER cloudflare-worker-basecp templates/workflows/ci-cloudflare-workers.yml .github/workflows/deploy.yml
# Configure secrets
gh secret set CLOUDFLARE_API_TOKEN
Result: New Worker with automated deployment on push to main
project-planning → Generate Automation
When user uses project-planning skill:
# User: "Plan new React app with GitHub automation"# project-planning generates IMPLEMENTATION_PHASES.md# Then this skill sets up GitHub automationcp templates/workflows/ci-react.yml .github/workflows/ci.yml
cp templates/issue-templates/*.yml .github/ISSUE_TEMPLATE/
Result: Planned project with complete GitHub automation
# User: "Prepare repo for open source contributions"# open-source-contributions skill handles CONTRIBUTING.md# This skill adds issue templates and CODEOWNERScp templates/issue-templates/*.yml .github/ISSUE_TEMPLATE/
cp templates/misc/CODEOWNERS .github/
Result: Contributor-friendly repository
Advanced Topics
Integrating with GitHub Projects v2
Status: Researched, not implemented (see /planning/github-projects-poc-findings.md)
Why separate skill: Complex GraphQL API, ID management, niche use case
When to consider: Team projects needing automated board management
Custom Workflow Composition
Combining workflows for efficiency:
# Option A: Separate workflows (easier maintenance).github/workflows/ci.yml# Test and buildcodeql.yml# Security scanningdeploy.yml# Production deployment# Option B: Integrated workflow (fewer CI minutes).github/workflows/main.yml# All-in-one: test, scan, deploy
Trade-off: Separate = clearer, Integrated = faster (Error #18 prevention)
