github-actions-gen SKILL.md skillA
github-actions-gen from laolaoshiren/claude-code-skills-zh is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add laolaoshiren/claude-code-skills-zh/github-actions-gen@git:20260722.bac2f9dPins git:20260722.bac2f9d in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- laolaoshiren/claude-code-skills-zh
- Path
skills/github-actions-gen/SKILL.md- Versions recorded
- 3
- Latest version
- git:20260722.bac2f9d, committed Jul 22, 2026
- First version recorded
- Apr 19, 2026
- Size
- 7,042 bytes
- Repository stars
- 869
- License
- MIT
分析真实项目并生成或修订安全、可验证的 GitHub Actions workflow；当用户要求创建 CI、测试矩阵、构建、Release、部署、缓存、Secrets、OIDC、PR 自动化或排查 workflow 配置时使用.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# GitHub Actions CI/CD 生成器
## 核心原则
- 先读项目，再生成 workflow。不要凭项目名猜测运行时、包管理器、测试命令或部署目标。
- 默认只生成只读 CI。Release、部署、推送镜像、写回仓库和调用外部 webhook 必须先确认目标、凭据、环境保护与回滚方式。
- 将不可信 PR 代码与 Secrets、写权限、自托管 Runner 隔离。不要为方便而改用 `pull_request_target` 执行 PR 代码。
- 把所有 Action 固定到核验过的完整 40 位 commit SHA，并在旁边保留版本注释。不要使用 `@main`、`@master`、`@latest` 或可移动的 `@vN` tag。
- 为每个 job 设置最小 `permissions` 和 `timeout-minutes`；不依赖仓库默认权限。
- 生成后运行真实语法与项目命令验证，不把“配置看起来正确”当作通过。
## 工作流程
### 1. 盘点项目证据
- 读取 manifest、lockfile、wrapper、运行时文件和现有 workflow，例如 `package.json`、`.nvmrc`、`pyproject.toml`、`go.mod`、`Cargo.toml`、`Dockerfile` 与 `.github/workflows/`。
- 从项目脚本、贡献文档和现有 CI 确认 lint、test、build、package 命令。命令不存在时先指出缺口。
- 识别 monorepo 边界、工作目录、矩阵维度、服务容器、缓存路径与产物。
- 询问必要决策：触发分支、支持的运行时、部署目标、云账号、GitHub Environment、失败处理和发布授权。
- 检查当前工作树，保留用户已有修改；只编辑本次授权的 workflow 和必要配置。
### 2. 建立威胁模型
- `pull_request`：按不可信代码处理，使用只读 Token，不提供 Secrets，不在高权限自托管 Runner 上执行 fork 代码。
- `pull_request_target`：仅处理标签、评论等可信基准分支逻辑；绝不 checkout PR head、运行 PR 脚本或安装 PR 依赖。
- `push` / tag / `workflow_dispatch`：仍需限制分支、输入、Environment 和权限；写操作放入独立 job。
- 避免把 `${{ github.event.* }}` 等不可信表达式直接插进 `run:`。通过 `env:` 传值，并在脚本中按数据处理。
…Read the whole file at its exact version.
How to install
mdr add laolaoshiren/claude-code-skills-zh/github-actions-gen@sha256:b0e639948cdc7e1bThe line at the top of this page pins the label git:20260722.bac2f9d, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_nvnftdvq6ywwciim)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 3 versions of this file, between Apr 19, 2026 and Jul 22, 2026, about one every 47 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260722.bac2f9d latest | 2026-07-22 | bac2f9d | 7,042 B | A | view · diff |
| git:20260713.6d2b008 | 2026-07-13 | 6d2b008 | 3,360 B | A | view · diff |
| git:20260419.b11a9ff | 2026-04-19 | b11a9ff | 3,101 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (7042 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
laolaoshiren/claude-code-skills-zh · 869 stars · license MIT · pushed 2026-09-22 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_nvnftdvq6ywwciim GET https://markdownregistry.com/api/v1/resolve?ref=laolaoshiren/claude-code-skills-zh/github-actions-gen GET https://markdownregistry.com/api/v1/blob/b0e639948cdc7e1b286cc20977787e62c57a0acd730237f034786832c876cf8e
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.