Github Actions

This one handles GitHub Actions workflows from scratch or audits existing ones. It detects your project type (Node, Python, Go, etc.) and generates proper CI workflows with SHA-pinned actions, minimal permissions, and concurrency controls. The audit mode scans your workflows against seven rule categories, flags issues by severity, then auto-fixes them using the GitHub CLI to look up commit SHAs. It's opinionated about security practices like action pinning, which is good because most repos get this wrong. If you're setting up CI or inherited workflows that use floating tags everywhere, this will save you from reading GitHub's security docs for the hundredth time.

skills.sh installs: 430
GitHub stars: 8
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add tartinerlabs/skills --skill github-actions --agent claude-code

Installs into .claude/skills of the current project.

Files

Mode Detection

Audit and report by default. Generate workflows only when asked to create, add, or set up CI — and never merely because .github/workflows/ is absent; report that none were found instead. Apply fixes only when asked to fix or pin. When the ask is unclear, report and offer to apply the fixes.

Create Mode

1. Detect Project Type

Scan for project indicators:

package.json → Node.js/JS/TS
go.mod → Go
requirements.txt / pyproject.toml / setup.py → Python
Cargo.toml → Rust
Gemfile → Ruby

2. Detect Package Manager (JS/TS projects)

Detect the package manager from the lockfile, in this order: nub.lock, pnpm-lock.yaml, bun.lock/bun.lockb, yarn.lock, package-lock.json. With no lockfile, ask.

SKILL.md on GitHub

Sponsors

Promote your product hereReach 125k+ visitors monthly Promote your product hereReach 125k+ visitors monthly