# Automate GitHub Workflows with AI Coordination

Complex GitHub Actions pipelines are difficult to coordinate, optimize, and maintain. This skill provides workflow templates, swarm commands, security patterns, monitoring guidance, and repository automation examples.

## Install

```bash
npx skillstore add ruvnet/github-workflow-automation
```

## Metadata

- Status: approved
- Slug: ruvnet-github-workflow-automation
- Skillstore revision: r2
- Version status: missing
- Tree hash: 9e9acbe4d4a2bf8d36372f0b6327878e9353297dd3bfc872a709bdaea1ce7675
- Author: ruvnet
- GitHub username: ruvnet
- License: MIT
- Repository: https://github.com/ruvnet/claude-flow/tree/main/.claude/skills/github-workflow-automation
- Ref: ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network, filesystem, env\_access
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/ruvnet-github-workflow-automation
- Manifest: https://skillstore.pages.dev/api/skills/ruvnet-github-workflow-automation/manifest

## Capabilities

- Provides commands for generating and optimizing GitHub Actions workflows.
- Documents coordination modes for pull requests, issues, releases, repositories, reviews, CI, and security.
- Supplies workflow examples for testing, scanning, deployment, releases, caching, and monorepos.
- Shows failure analysis, cost optimization, resource analysis, and workflow profiling commands.
- Demonstrates Claude-Flow MCP coordination and concurrent GitHub CLI operations.

## Use Cases

- Build a Repository CI Pipeline: Create a language-aware workflow plan with parallel tests, caching, security checks, and clear permissions.
- Coordinate Pull Request Maintenance: Plan automated validation, review comments, issue updates, and failure diagnosis across active pull requests.
- Harden Workflow Automation: Review workflow permissions, secret handling, dependency pins, deployment gates, and shell interpolation risks.

## Prompt Templates

### Create a Basic CI Workflow

```
Analyze this repository and propose a basic GitHub Actions CI workflow. Identify languages, test commands, required permissions, and caching. Do not modify files until I approve.
```

### Optimize an Existing Workflow

```
Review .github/workflows/[file] for slow or duplicated work. Recommend parallel jobs, dependency caching, timeouts, and least-privilege permissions. Show expected tradeoffs before editing.
```

### Diagnose a Failed Run

```
Inspect GitHub Actions run [run-id] with gh. Summarize failed jobs, likely root causes, and safe fixes. Retry only after confirming no destructive side effects.
```

### Design Secure Monorepo Automation

```
Design a reusable monorepo workflow for [packages]. Generate a validated dynamic matrix, parallel tests, security checks, and staged deployment. Pin dependencies and prevent expression injection. Require approval before publishing.
```

## Limitations

- Requires GitHub CLI authentication plus external ruv-swarm and Claude-Flow packages.
- Examples require review and adaptation for repository permissions, branch rules, and deployment environments.
- The skill provides documentation only and includes no bundled validation or test suite.
- Mutable package references and unquoted workflow values require security corrections before production use.

## Best Practices

- Review generated workflows and diffs before running repository mutations.
- Pin actions and packages, declare minimal permissions, and protect deployment environments.
- Quote shell variables and validate every value derived from events, inputs, files, or tool output.

## Anti Patterns

- Do not run mutable packages or actions with repository secrets.
- Do not interpolate GitHub expressions directly into shell command text.
- Do not enable automatic deployment, release, or merge operations without approval gates.

## Security Audit

- Audited at: 2026-07-23T19:12:33.617\+00:00
- Summary: The 154 static matches are false positives caused by Markdown formatting, normal shell capture, documentation links, cache paths, secret references, and identifier names. Semantic review found high-risk shell injection paths in workflow templates and unpinned third-party package execution.

## Stats

- Views: 333
- Downloads: 8
- Favorites: 0
- Popularity score: 0