# Build GitHub Actions Workflows

Creating reliable CI/CD workflows requires careful triggers, permissions, caching, secrets, and deployment controls. This skill provides adaptable patterns for testing, containers, Kubernetes, matrices, scanning, and approvals.

## Install

```bash
npx skillstore add sickn33/github-actions-templates
```

## Metadata

- Status: approved
- Slug: sickn33-github-actions-templates
- Skillstore revision: r2
- Version status: missing
- Tree hash: 7c1882ee88c1205fae01bf62e36b119b9ee6a01a7e087cfcc07d7032d7488cc7
- Author: sickn33
- GitHub username: sickn33
- License: MIT
- Repository: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/github-actions-templates
- Ref: 88a8e9a07f4c54ab105c1c41b6267c287146b07b
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network, filesystem, env\_access
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/sickn33-github-actions-templates
- Manifest: https://skillstore.pages.dev/api/skills/sickn33-github-actions-templates/manifest

## Capabilities

- Provides a Node.js test workflow with version matrices, dependency caching, linting, tests, and coverage upload.
- Provides a Docker build and GHCR publishing workflow with metadata, labels, and GitHub Actions caching.
- Shows an AWS EKS deployment sequence using kubeconfig updates, Kubernetes apply, rollout checks, and service inspection.
- Shows Python matrix testing across three operating systems and four Python versions.
- Demonstrates reusable workflows with typed inputs and inherited repository secrets.
- Includes Trivy, Snyk, deployment environment metadata, and Slack notification patterns.

## Use Cases

- Add Application CI: Create a pull request workflow that installs dependencies, runs quality checks, tests supported runtimes, and uploads coverage.
- Publish and Deploy Services: Adapt container publishing and Kubernetes deployment patterns for a controlled release pipeline.
- Introduce Pipeline Scanning: Add filesystem vulnerability scans and publish findings through GitHub security integrations.

## Prompt Templates

### Create a Test Workflow

```
Create a GitHub Actions test workflow for [runtime] versions [versions]. Run [install command], [lint command], and [test command] on pull requests.
```

### Build and Publish a Container

```
Create a workflow that builds [image name] from [context] and publishes it to [registry]. Use least-privilege permissions and branch-based tags.
```

### Design a Reusable Matrix Workflow

```
Create a reusable workflow for [language] across [operating systems] and [versions]. Define typed inputs, required secrets, caching, tests, and artifact retention.
```

### Secure a Production Deployment

```
Design a production workflow for [platform]. Use immutable action pins, OIDC authentication, scoped permissions, approvals, concurrency controls, rollback checks, and deployment verification.
```

## Limitations

- Every template requires repository-specific changes to branches, commands, environments, permissions, and secret names.
- The skill does not validate workflow syntax, repository settings, cloud roles, or deployment results.
- The AWS example uses long-lived credentials and should be replaced with GitHub OIDC.
- Referenced asset and resource files are absent; only the inline patterns in SKILL.md are available.

## Best Practices

- Pin third-party actions to reviewed commit SHAs and update them through controlled dependency automation.
- Grant each job only required permissions and prefer short-lived OIDC credentials over stored cloud keys.
- Validate generated workflows in a nonproduction repository before enabling package publishing or deployment.

## Anti Patterns

- Do not copy placeholder branches, regions, cluster names, namespaces, or commands into production unchanged.
- Do not expose deployment secrets to untrusted pull request workflows or broadly privileged third-party actions.
- Do not use mutable master refs or assume major-version tags provide immutable supply-chain protection.

## Security Audit

- Audited at: 2026-07-23T23:47:56.092\+00:00
- Summary: The 26 backtick alerts are Markdown formatting, while the example URL, local workflow path, and scoped GITHUB\_TOKEN are benign template constructs. The AWS example promotes long-lived cloud credentials, and mutable third-party action references create a high-confidence CI supply-chain risk. Replace static AWS keys and pin actions before publication.

## Stats

- Views: 108
- Downloads: 10
- Favorites: 0
- Popularity score: 0