github-workflow-automation
Automate GitHub Workflows with AI Coordination
Complex GitHub Actions pipelines are difficult to coordinate, optimize, and maintain. This skill provides workflow templates, swarm commands, security patterns, monitoring guidance, and repository automation examples.
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "github-workflow-automation" from https://skillstore.io/skills/ruvnet-github-workflow-automation.md and its manifest at https://skillstore.io/api/skills/ruvnet-github-workflow-automation/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "github-workflow-automation". Optimize our Node.js pull request workflow for speed.
Expected outcome:
- Finding: dependency installation repeats across three jobs.
- Recommendation: use one keyed npm cache and separate lint, test, and security jobs.
- Expected result: shorter feedback time with unchanged required checks.
Using "github-workflow-automation". Diagnose GitHub Actions run 1824.
Expected outcome:
- Failure: the integration job cannot reach its test database.
- Likely cause: the service health check finishes after the test command starts.
- Next step: add a bounded readiness check, then rerun only the failed job.
Using "github-workflow-automation". Plan a secure monorepo release.
Expected outcome:
- Detect changed packages and validate every generated matrix value.
- Run package tests in parallel with read-only default permissions.
- Require environment approval before publishing signed artifacts.
Security Audit
High RiskThe 154 static matches are false positives caused by Markdown formatting, normal shell capture, documentation links, cache paths, secret references, and identifier names. Semantic review found high-risk shell injection paths in workflow templates and unpinned third-party package execution.
Confirmed security concerns (2)
Risk Factors
⚙️ External commands (50)
🌐 Network access (4)
📁 Filesystem access (4)
🔑 Env variables (1)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/ruvnet-github-workflow-automation/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/ruvnet-github-workflow-automation?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/ruvnet-github-workflow-automation?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/ruvnet-github-workflow-automation/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/ruvnet-github-workflow-automation.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
ruvnet. (2026). github-workflow-automation security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/ruvnet-github-workflow-automation/audits/8BibTeX citation
@techreport{ruvnet-ruvnet-github-workflow-automation-2026,
author = {ruvnet},
title = {github-workflow-automation security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/ruvnet-github-workflow-automation/audits/8},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "github-workflow-automation security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "ruvnet"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/ruvnet-github-workflow-automation/audits/8"
identifiers:
- type: other
value: "skillstore:ruvnet-github-workflow-automation:audit:8"
description: "Skillstore immutable audit report identifier"
Compare variants
3 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
dnyoussef-github-workflow-automation
2026-08-21
sickn33-github-workflow-automation
2026-08-21
ruvnet-github-workflow-automation
2026-08-21
Skillstore Score
Why this score Evidence Confidence: MediumWhat You Can Build
Build a Repository CI Pipeline
Create a language-aware workflow plan with parallel tests, caching, security checks, and clear permissions.
Coordinate Pull Request Maintenance
Plan automated validation, review comments, issue updates, and failure diagnosis across active pull requests.
Harden Workflow Automation
Review workflow permissions, secret handling, dependency pins, deployment gates, and shell interpolation risks.
Try These Prompts
Analyze this repository and propose a basic GitHub Actions CI workflow. Identify languages, test commands, required permissions, and caching. Do not modify files until I approve.
Review .github/workflows/[file] for slow or duplicated work. Recommend parallel jobs, dependency caching, timeouts, and least-privilege permissions. Show expected tradeoffs before editing.
Inspect GitHub Actions run [run-id] with gh. Summarize failed jobs, likely root causes, and safe fixes. Retry only after confirming no destructive side effects.
Design a reusable monorepo workflow for [packages]. Generate a validated dynamic matrix, parallel tests, security checks, and staged deployment. Pin dependencies and prevent expression injection. Require approval before publishing.
Best Practices
- Review generated workflows and diffs before running repository mutations.
- Pin actions and packages, declare minimal permissions, and protect deployment environments.
- Quote shell variables and validate every value derived from events, inputs, files, or tool output.
Avoid
- Do not run mutable packages or actions with repository secrets.
- Do not interpolate GitHub expressions directly into shell command text.
- Do not enable automatic deployment, release, or merge operations without approval gates.
Frequently Asked Questions
Does this skill change repositories automatically?
What tools are required?
Can it optimize existing workflows?
How should credentials be handled?
Does it support monorepos?
Are the examples production ready?
Developer Details
Author
ruvnetLicense
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Repository
https://github.com/ruvnet/claude-flow/tree/main/.claude/skills/github-workflow-automationRef
ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006
Maintenance freshness
7/26/2026
Usage
6 downloads · 333 views
File structure
📄 SKILL.md