nezam-github-actions-ci

skill_id	nezam-github-actions-ci
name	nezam-Github Actions Ci
tier	3
description	Deterministic CI/CD workflow authoring for GitHub Actions with required checks, artifact hygiene, and release safety controls.
version	1.0.0
updated	"2026-05-08T00:00:00.000Z"
changelog	[]

Purpose

Create and maintain production-grade GitHub Actions workflows aligned with NEZAM SDD gates and /SCAN//FIX quality loops.

Inputs

• Existing .github/workflows/*.yml files.
• Branching/release policy docs (.nezam/core/plans/legacy/tag-version-plan.md, .nezam/core/plans/legacy/commit-conventions.md).
• Required quality commands (lint, tests, type-check, security scans).

Step-by-Step Workflow

1. Audit current workflow topology (PR, push, release, manual dispatch triggers).
2. Define job graph by responsibility:
   • Validate: lint, type-check, format, unit tests.
   • Verify: E2E and security scans.
   • Release: tagging, changelog, publish.
3. Set minimum permissions per workflow/job (permissions: least privilege).
4. Add deterministic caching and dependency install strategy.
5. Configure matrix jobs only where they provide meaningful coverage.
6. Add artifact upload with explicit retention windows and naming conventions.
7. Configure required status checks for protected branches.
8. Add failure-notification and retry-safe mechanics where needed.
9. Validate workflow syntax and dry-run logic before merge.
10. Document workflow ownership and expected runtime budgets in repository docs.

Validation & Metrics

• CI pass rate on PRs (target: >= 95%).
• Median workflow duration within budget.
• Required-check enforcement rate (target: 100% on protected branches).
• Artifact retention policy adherence (no orphan/indefinite artifacts).

Output Format

• New/updated workflow YAML files under .github/workflows/.
• Required-check matrix and branch-protection mapping.
• Artifact lifecycle policy summary.
• CI health report (duration, flake risk, pass/fail trend).

Integration Hooks

• /SCAN code and /SCAN tests consume CI outputs.
• /FIX remediations must rerun affected workflow jobs before closure.
• /SAVE records final CI evidence and release readiness.
• GitHub webhook events: pull_request, push, workflow_dispatch, release.

Anti-Patterns

• Over-permissive GITHUB_TOKEN scopes.
• Monolithic workflows with unrelated failure domains.
• Unbounded artifact retention and no cleanup policy.
• Required checks missing from protected branches.

External Reference

• GitHub Actions docs
• Workflow syntax reference
• Managing GitHub Actions permissions