Writes, reviews and debugs GitHub Actions workflows. Use whenever the user edits a file under .github/workflows, asks to set up CI or deployment on GitHub, wants to speed up or secure a pipeline, sees a workflow fail or never start, or asks about permissions, secrets, caching, matrices or pull_request_target, even if they only say "add CI to my repo". Lints workflows for script injection, unpinned actions and broad permissions before suggesting changes.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# github-actions
Write CI that is fast, least-privilege and hard to abuse. The linter is line based and dependency free, so it runs anywhere, including Termux.
```
github-actions/
├── SKILL.md
├── scripts/
│ └── lint_workflow.py script injection, pull_request_target, permissions, unpinned actions, leaks
└── references/
└── hardening.md safe starter workflow, injection fix, pinning, secrets, speed, debugging
```
## When to use
- Creating a first workflow for tests, lint, build or release
- Reviewing a workflow before merging, especially from a fork
- A workflow is slow, flaky, never triggers or fails only in CI
- Questions about permissions, secrets, OIDC, caching, matrices
## Workflow
1. **Lint first**: `python3 scripts/lint_workflow.py .github/workflows` (a file or a folder). Errors must be fixed; warnings are likely risks; add `--strict` to fail on warnings.
2. **Fix by severity**: script injection and `pull_request_target` with a PR checkout first, then moving-branch actions, then missing `permissions:`, then pinning and timeouts.
…
The line at the top of this page pins the label git:20261104.b07e2c3, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
GET https://markdownregistry.com/api/v1/artifacts/art_n4jujw7k2d4rivsa
GET https://markdownregistry.com/api/v1/resolve?ref=mehranqadirian/skills/github-actions
GET https://markdownregistry.com/api/v1/blob/01b2d6d827b9f2a3cc59e8677617dc76dd829430a5f28b5d67d0f12a7d3ba841
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
mehranqadirian/skills · agent-engineering/multi-agent-orchestration/SKILL.md · Designs and runs systems where several AI agents cooperate. Use whenever the user wants to split a task across agents…
mehranqadirian/skills · agent-engineering/prompt-regression-testing/SKILL.md · Builds and runs regression tests for prompts, skills and agents so changes can be checked instead of guessed. Use…
mehranqadirian/skills · agent-engineering/skill-authoring/SKILL.md · Creates, reviews and improves Claude skills (SKILL.md folders). Use whenever the user wants to write a new skill, turn…
mehranqadirian/skills · data/csv-profiling/SKILL.md · Profiles and safely cleans CSV files. Use whenever the user shares or mentions a CSV, TSV or spreadsheet export, asks…
mehranqadirian/skills · devops/docker-basics/SKILL.md · Reviews, writes and troubleshoots Dockerfiles and container builds. Use whenever the user shares a Dockerfile or…
mehranqadirian/skills · devops/linux-troubleshooting/SKILL.md · Diagnoses problems on Linux machines in a structured, read-only-first way. Use whenever the user reports a slow or…
mehranqadirian/skills · devops/shell-scripting/SKILL.md · Writes, reviews and fixes shell scripts (bash and sh) so they are safe, portable and testable. Use whenever the user…
mehranqadirian/skills · documents/document-conversion/SKILL.md · Converts documents between Markdown, Word, HTML, PDF, EPUB and plain text with pandoc, including right-to-left Persian…
mehranqadirian/skills · documents/pdf-atelier/SKILL.md · House style for creating ANY new PDF with Claude - reports, proposals, brochures, menus, resumes, certificates…
mehranqadirian/skills · documents/pdf-processing/SKILL.md · Processes, extracts and verifies existing PDF files. Use whenever the user wants to read text or tables from a PDF, OCR…
mehranqadirian/skills · git/git-recovery/SKILL.md · Recovers lost git work and undoes mistakes safely. Use whenever the user says they lost commits, ran git reset --hard…
ericrisco/rsc-harness · skills/github-actions/SKILL.md · Use when authoring or fixing GitHub Actions CI/CD — workflows under .github/workflows, triggers, job matrix, caching…
openhands/extensions · skills/github-actions/SKILL.md · Create, debug, and test GitHub Actions workflows and custom actions. Use when building CI/CD pipelines, automating…
nahid-sparktales/agent-dispatcher · skills/devops/github-actions/SKILL.md · Write and review GitHub Actions workflows that fail honestly and finish fast enough to be trusted — least-privilege…
opensourceagi/dev-tools-starter-agent · skills/github-actions/SKILL.md · How to set up the GitHub Actions workflows from the qwksearch reference CI — a discovered per-package test matrix with…
