# Ghactions

> |

- **Type:** Skill
- **Install:** `agentstack add skill-arbazkhan971-godmode-ghactions`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [arbazkhan971](https://agentstack.voostack.com/s/arbazkhan971)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [arbazkhan971](https://github.com/arbazkhan971)
- **Source:** https://github.com/arbazkhan971/godmode/tree/master/skills/ghactions

## Install

```sh
agentstack add skill-arbazkhan971-godmode-ghactions
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# GHACTIONS — GitHub Actions Expert

## Activate When
- User invokes `/godmode:ghactions`
- User says "create workflow", "add GitHub Actions"
- User says "matrix build", "reusable workflow"
- User mentions `.github/workflows/` or `action.yml`
- Project needs CI/CD on GitHub Actions

## Workflow

### Step 1: Discover Repository Context

```bash
# Detect existing workflows
ls .github/workflows/*.yml 2>/dev/null

# Audit current actions
grep -rh "uses:" .github/workflows/ 2>/dev/null \
  | sort -u

# Find unpinned actions (security risk)
grep -rn "uses:.*@v[0-9]" .github/workflows/ 2>/dev/null

# Find missing permissions declarations
grep -L "permissions:" .github/workflows/*.yml 2>/dev/null

# Find missing timeouts
grep -L "timeout-minutes:" .github/workflows/*.yml 2>/dev/null
```

```
REPOSITORY CONTEXT:
  Workflows: 
  Language: , Package Manager: 
  Test: , Linter: 
  Monorepo: yes/no, Environments: staging|production

IF no workflows: create from scratch
IF unpinned actions: pin to SHA immediately
IF missing permissions: add explicit per-job
IF missing timeouts: add to every job
```

### Step 2: Triggers & Filtering

```
KEY TRIGGERS:
  push (CI on merge), pull_request (PR checks)
  schedule (nightly), workflow_dispatch (manual)
  workflow_call (reusable), release (publish)

RULES:
  Use paths/paths-ignore to skip irrelevant workflows
  IF docs-only change: skip test workflow
  IF monorepo: trigger per-package via paths
```

### Step 3: Job Structure & Matrix

```yaml
jobs:
  lint:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@
      - uses: actions/setup-node@
        with: { node-version: '20', cache: 'npm' }
      - run: npm ci && npm run lint

  test:
    needs: lint
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest]
        node-version: [18, 20, 22]
```

### Step 4: Caching & Optimization

```yaml
# Cancel redundant runs
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
```

```
OPTIMIZATION:
  Shallow clone: fetch-depth: 1
  Dependency caching: via setup action cache param
  Docker layers: BuildKit GHA backend
  Test sharding: matrix strategy

THRESHOLDS:
  PR pipeline target:  90%
  IF pipeline > 15min: split jobs, add sharding
```

### Step 5: Security Hardening

```yaml
# Pin to SHA, minimal permissions
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
permissions:
  contents: read
# NEVER interpolate untrusted input in run:
env:
  PR_TITLE: ${{ github.event.pull_request.title }}
```

```
SECURITY CHECKLIST:
  Pin all actions to full commit SHA
  Declare minimum permissions per job
  Never interpolate untrusted input in run: blocks
  Restrict fork access to secrets
  Use OIDC for cloud providers (no long-lived secrets)
  Run OpenSSF Scorecard weekly

IF write-all permissions: CRITICAL — restrict now
IF unpinned actions: HIGH — pin to SHA
IF untrusted interpolation in run: CRITICAL
```

### Step 6: Deployment & Environments

```
ENVIRONMENTS:
  Staging: auto-deploy on push to main
  Production: manual approval required

PROTECTION RULES:
  Required reviewers: 1+
  Wait timer: optional (e.g., 5min for monitoring)
  Branch restriction: main only
  IF deploy fails: auto-rollback
```

### Step 7: Commit
```
Save in .github/workflows/ and .github/actions/
Commit: "ci:  — GitHub Actions
  ( jobs, )"
```

## Key Behaviors
Never ask to continue. Loop autonomously until done.

1. **Least privilege permissions.** Per-job, not global.
2. **Pin actions to SHA.** Use Dependabot for updates.
3. **Cancel redundant runs.** Concurrency groups.
4. **Cache everything.** Dependencies, Docker, builds.
5. **Fail fast on cheap checks.** Lint → test.
6. **Environments gate production.**
7. **Timeouts on every job.** 15 minutes default.

## HARD RULES
1. Never use `permissions: write-all`.
2. Never pin actions to mutable tags — use SHA.
3. Never interpolate untrusted input in `run:`.
4. Never share secrets with fork PRs.
5. Always set `timeout-minutes` on every job.
6. Always use concurrency groups.
7. Always set `retention-days` on artifact uploads.
8. Never use `continue-on-error: true` for flaky tests.

## Auto-Detection
```bash
ls .github/workflows/*.yml 2>/dev/null
grep -rh "uses:" .github/workflows/ | sort -u
grep -rn "uses:.*@v[0-9]" .github/workflows/
grep -L "permissions:" .github/workflows/*.yml
grep -L "timeout-minutes:" .github/workflows/*.yml
```

## Quality Targets
- Target: 95% workflow success rate over 30 days
- Cache hit rate: >80% for dependency caching

## Output Format
Print: `GHActions: {N} workflows, {M} jobs.
  Cache: {active|missing}. Concurrency: {status}.
  Security: {pinned|unpinned}. Status: {status}.`

## TSV Logging
```
iteration	workflow	jobs	duration_before	duration_after	cache_hit_rate	security_fixes	status
```

## Keep/Discard Discipline
```
KEEP if: workflow passes on test PR
  AND no secret exposure AND cache hit maintained
DISCARD if: workflow fails OR secrets leaked
  OR build time increased > 20%
```

## Stop Conditions
```
STOP when ALL of:
  - All workflows pass on clean PR
  - Caching configured for dependencies
  - Concurrency groups prevent stale runs
  - Secrets in repository settings only
```

## Error Recovery
- Syntax error: run `actionlint` locally.
- Permission denied: add to permissions block.
- Cache miss: verify key matches lockfile path.
- Pipeline too long: add timeout, split jobs.
- Concurrency cancels needed runs: disable for deploys.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [arbazkhan971](https://github.com/arbazkhan971)
- **Source:** [arbazkhan971/godmode](https://github.com/arbazkhan971/godmode)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-arbazkhan971-godmode-ghactions
- Seller: https://agentstack.voostack.com/s/arbazkhan971
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.