git:20260316.2d4c8cf to git:20261002.e6369ee

---

name: github-actions-generator

description: Generates production-ready GitHub Actions workflows, custom actions, and CI/CD configurations following security and performance standards. Creates CI/CD pipelines, test workflows, deployment configurations, matrix builds, caching strategies, composite actions, Docker actions, JavaScript actions, and reusable workflows. Use when creating or scaffolding GHA resources, writing .github/workflows YAML files, setting up build automation, implementing deployment pipelines, adding security scanning, or building reusable actions — including triggers like 'create a workflow', 'build a pipeline', 'add CI', 'set up GHA', or 'generate a YAML workflow'.

---

# GitHub Actions Generator

Generate production-ready GitHub Actions workflows and custom actions following current best practices, security standards, and naming conventions. All generated resources are automatically validated using the devops-skills:github-actions-validator skill.

## Core Capabilities

### 1. Generate Workflows

**Triggers:** "Create a workflow for...", "Build a CI/CD pipeline..."

**Process:**

1. Understand requirements (triggers, runners, dependencies)

2. Reference `references/best-practices.md` for patterns

3. Reference `references/common-actions.md` for action versions

4. Generate workflow with:

- Semantic names, pinned actions (SHA), proper permissions

- Concurrency controls, caching, matrix strategies

5. **Validate** with devops-skills:github-actions-validator skill

6. Fix issues and re-validate if needed

**Minimal Example:**

```yaml

name: CI Pipeline

on:

push:

branches: [main]

pull_request:

permissions:

contents: read

concurrency:

group: ${{ github.workflow }}-${{ github.ref }}

cancel-in-progress: true

jobs:

test:

runs-on: ubuntu-latest

steps:

- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

- uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0

with:

node-version: '20'

cache: 'npm'

- run: npm ci

- run: npm test

```

### 2. Generate Custom Actions

**Triggers:** "Create a composite action...", "Build a Docker action...", "Create a JavaScript action..."

**Types:**

- **Composite:** Combine multiple steps → Fast startup

- **Docker:** Custom environment/tools → Isolated

- **JavaScript:** API access, complex logic → Fastest

**Process:**

1. Use templates from `assets/templates/action/`

2. Follow structure in `references/custom-actions.md`

3. Include branding, inputs/outputs, documentation

4. **Validate** with devops-skills:github-actions-validator skill

See `references/custom-actions.md` for:

- Action metadata and branding

- Directory structure patterns

- Versioning and release workflows

### 3. Generate Reusable Workflows

**Triggers:** "Create a reusable workflow...", "Make this workflow callable..."

**Key Elements:**

- `workflow_call` trigger with typed inputs

- Explicit secrets (avoid `secrets: inherit`)

- Outputs mapped from job outputs

- Minimal permissions

```yaml

on:

workflow_call:

inputs:

environment:

required: true

type: string

secrets:

deploy-token:

required: true

outputs:

result:

value: ${{ jobs.build.outputs.result }}

```

See `references/advanced-triggers.md` for complete patterns.

### 4. Generate Security Workflows

**Triggers:** "Add security scanning...", "Add dependency review...", "Generate SBOM..."

**Components:**

- **Dependency Review:** `actions/dependency-review-action@v4`

- **SBOM Attestations:** `actions/attest-sbom@v2`

- **CodeQL Analysis:** `github/codeql-action`

**Required Permissions:**

```yaml

permissions:

contents: read

security-events: write # For CodeQL

id-token: write # For attestations

attestations: write # For attestations

```

See `references/best-practices.md` section on security.

### 5. Modern Features

**Triggers:** "Add job summaries...", "Use environments...", "Run in container..."

See `references/modern-features.md` for:

- Job summaries (`$GITHUB_STEP_SUMMARY`)

- Deployment environments with approvals

- Container jobs with services

- Workflow annotations

### 6. Public Action Documentation

When using public actions:

1. **Search for documentation:**

```

"[owner/repo] [version] github action documentation"

```

2. **Or use Context7 MCP:**

- `mcp__context7__resolve-library-id` to find action

- `mcp__context7__get-library-docs` for documentation

3. **Pin to SHA with version comment:**

```yaml

- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

```

See `references/common-actions.md` for pre-verified action versions.

---

## Validation Workflow

**CRITICAL:** Every generated resource MUST be validated.

1. Generate workflow/action file

2. Invoke `devops-skills:github-actions-validator` skill

3. If errors: fix and re-validate

4. If success: present with usage instructions

**Skip validation only for:**

- Partial code snippets

- Documentation examples

- User explicitly requests skip

---

## Mandatory Standards

All generated resources must follow:

| Standard | Implementation |

|----------|---------------|

| **Security** | Pin to SHA, minimal permissions, mask secrets |

| **Performance** | Caching, concurrency, shallow checkout |

| **Naming** | Descriptive names, lowercase-hyphen files |

| **Error Handling** | Timeouts, cleanup with `if: always()` |

See `references/best-practices.md` for complete guidelines.

---

## Common Patterns

### Matrix Testing

```yaml

strategy:

matrix:

os: [ubuntu-latest, windows-latest]

node: [18, 20, 22]

fail-fast: false

```

### Conditional Deployment

```yaml

deploy:

if: github.event_name == 'push' && github.ref == 'refs/heads/main'

```

### Artifact Sharing

```yaml

# Upload

- uses: actions/upload-artifact@v4

with:

name: build-${{ github.sha }}

path: dist/

# Download (in dependent job)

- uses: actions/download-artifact@v4

with:

name: build-${{ github.sha }}

```

---

## Workflow Summary

1. **Understand** requirements

2. **Reference** appropriate docs

3. **Generate** with standards

4. **Search** for public action docs (if needed)

5. **Validate** with devops-skills:github-actions-validator

6. **Fix** any errors

7. **Present** validated result

## Anti-Patterns

### NEVER use `@latest` or branch-based action references

### NEVER use `secrets: inherit` in reusable workflows without justification

### NEVER omit `permissions:` at the job or workflow level

### NEVER set `fail-fast: false` by default in matrix builds

### NEVER use `pull_request_target` with `actions/checkout` checking out PR code