github-actions-templates
Build GitHub Actions Workflow Templates
Teams need reliable CI/CD workflows without rebuilding common patterns from scratch. This skill provides GitHub Actions templates for tests, builds, deployments, scans, and approvals.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "github-actions-templates" from https://skillstore.io/skills/wshobson-github-actions-templates.md and its manifest at https://skillstore.io/api/skills/wshobson-github-actions-templates/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "github-actions-templates". Create a Node.js test workflow for main and pull requests.
Expected outcome:
- A workflow plan with push and pull request triggers.
- A Node.js version matrix with dependency caching.
- Separate install, lint, test, and coverage upload steps.
Using "github-actions-templates". Create a Docker publish workflow for GitHub Container Registry.
Expected outcome:
- A workflow plan with registry login, metadata extraction, and image publishing.
- Recommended package permissions for the GitHub token.
- Caching guidance for faster Docker builds.
Using "github-actions-templates". Create a production deployment workflow with approval.
Expected outcome:
- A deployment workflow outline with an environment approval gate.
- Cloud authentication and kubeconfig setup steps.
- Rollout verification and notification steps.
Security Audit
Medium RiskMost static findings are false positives caused by Markdown code fences, inline file references, and GitHub Actions template syntax. The secret references use GitHub Actions secrets rather than local environment reads by the skill. One real hardening issue remains: two third-party actions use mutable master refs in SKILL.md.
Confirmed security concerns (1)
Risk Factors
⚙️ External commands (25)
🌐 Network access (1)
📁 Filesystem access (1)
🔑 Env variables (3)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/wshobson-github-actions-templates/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/wshobson-github-actions-templates?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/wshobson-github-actions-templates?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wshobson-github-actions-templates/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/wshobson-github-actions-templates.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
wshobson. (2026). github-actions-templates security audit report (audit version 7) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wshobson-github-actions-templates/audits/7BibTeX citation
@techreport{wshobson-wshobson-github-actions-templates-2026,
author = {wshobson},
title = {github-actions-templates security audit report (audit version 7)},
institution = {Skillstore},
year = {2026},
number = {7},
url = {https://skillstore.io/skills/wshobson-github-actions-templates/audits/7},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "github-actions-templates security audit report (audit version 7)"
version: "unspecified"
type: report
authors:
- name: "wshobson"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/wshobson-github-actions-templates/audits/7"
identifiers:
- type: other
value: "skillstore:wshobson-github-actions-templates:audit:7"
description: "Skillstore immutable audit report identifier"
Compare variants
2 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
wshobson-github-actions-templates
2026-08-21
sickn33-github-actions-templates
2026-08-21
Skillstore Score
Why this score Evidence Confidence: HighWhat You Can Build
Add Continuous Integration
Create test workflows for pull requests and main branch pushes with dependency caching and coverage upload.
Standardize Deployment Pipelines
Draft workflows for Docker image publishing, Kubernetes deployment, and production approval environments.
Introduce Security Scans
Add vulnerability scan workflow patterns that publish results into GitHub security reporting.
Try These Prompts
Create a GitHub Actions workflow for a Node.js project. It should run on pull requests and main branch pushes, cache npm dependencies, run lint, run tests, and upload coverage.
Create a GitHub Actions workflow that builds a Docker image, tags it from branches and release tags, and publishes it to GitHub Container Registry with least-privilege permissions.
Create a GitHub Actions workflow for deploying to an Amazon EKS cluster. Include environment approvals, minimal permissions, OIDC-based AWS authentication, kubectl rollout checks, and clear placeholders.
Review these existing GitHub Actions workflows and convert repeated test, build, scan, and deploy steps into reusable workflows with documented inputs, secrets, permissions, and failure behavior.
Best Practices
- Pin third-party actions to trusted versions or commit SHAs before production use.
- Use least-privilege GitHub token permissions for every workflow job.
- Store deployment secrets in GitHub secrets or OIDC providers, never plaintext workflow files.
Avoid
- Copying templates without replacing placeholder clusters, paths, and environments.
- Granting broad write permissions when a job only needs read access.
- Using mutable action branches for production workflows.
Frequently Asked Questions
Can this skill create workflows for Node.js projects?
Does it support Docker image publishing?
Can it help with Kubernetes deployments?
Does it manage secrets for me?
Are the templates ready to copy into production?
Can I use it with Claude, Codex, and Claude Code?
Developer Details
Author
wshobsonLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Repository
https://github.com/wshobson/agents/tree/main/plugins/cicd-automation/skills/github-actions-templatesRef
36e07d5e13068e5be64447e8f20b427cf2cbd21a
Maintenance freshness
7/20/2026
Usage
13 downloads · 293 views
File structure
📄 SKILL.md