Gh Actions

GitHub Actions best practices — current action versions, caching, security, and common patterns. Activate when writing or modifying GitHub Actions workflows.

11 stars 1 forksGit & Code Review

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add retlehs/gh-actions --skill gh-actions

Manual install

git clone --depth 1 https://github.com/retlehs/gh-actions.git /tmp/gh-actions
mkdir -p ~/.claude/skills
cp -r /tmp/gh-actions/. ~/.claude/skills/gh-actions

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# GitHub Actions Best Practices

When writing or modifying GitHub Actions workflows (`.github/workflows/*.yml`), follow these guidelines.

## Action Versions

Never guess action versions. Before writing or updating a workflow, check the latest release for each action you use:

```bash
gh api repos/{owner}/{action}/releases/latest --jq '.tag_name'
```

The `{owner}/{action}` maps directly to the GitHub repo — e.g. `actions/checkout` lives at `github.com/actions/checkout`.

For example:
```bash
gh api repos/actions/checkout/releases/latest --jq '.tag_name'
gh api repos/actions/setup-node/releases/latest --jq '.tag_name'
```

Use the latest major version (e.g. if the latest tag is `v6.3.0`, use `v6`). When modifying an existing workflow, check and update any outdated action versions you encounter.

## Security

- Always set top-level `permissions` to least privilege. Start with `permissions: {}` and add only what's needed:
  ```yaml
  permissions:
    contents: read
  ```
- Never use `permissions: write-all` or omit permissions entirely
- Use `pull_request`, not `pull_request_target`. Only use `pull_request_target` when the workflow must write to the base repo from a fork — it runs with write access and secrets from the base branch
- Never interpolate untrusted input directly in `run:` blocks — use environment variables instead:

Read the full skill on GitHub

Details

Skill name: gh-actions
Repository: retlehs/gh-actions
Repo updated: 13 April 2026

FAQ

What does the Gh Actions skill do?

GitHub Actions best practices — current action versions, caching, security, and common patterns. Activate when writing or modifying GitHub Actions workflows.

How do I install the Gh Actions skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add retlehs/gh-actions --skill gh-actions. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Gh Actions popular?

It lives in retlehs/gh-actions, which has 11 GitHub stars and 1 forks.

Related skills

Nb

Alan-Youngzhe/noob2builder

Noob2Builder AI Builder School——由 Agent 在主对话中带学的全选修课程，从电脑与 AI 基础、Git/GitHub、Builder 工作法，到做出并发布第一个可验收作品、测试与验证、前后端工程基础（HTML/CSS/JS、npm、Vite、TypeScript、Vue、React、组件化、TSX、路由、项目结构、API、鉴权与部署）、Agent 构建和 Agentic Engineering。适用于纯小白或已有项目的学习者提出“带我学 AI”“我想做第一个作品”“教我 Git/GitHub”“教我单元测试、集成测试、冒烟测试或 E2E”“教我前端/后端”“看不懂 Agent 生成的网页代码”“什么是 token/context/Agent/MCP/Skill”“教我构建 Agent”“从 vibe coding 进阶”“继续上次课程”等请求；支持按目标选课、动态插入共享知识、真实实操、本地学习存档和证据卡。

Git & Code Review

Recat Web

0xtbug/Recat

Automatically install and set up the Recat website from github.com/0xtbug/Recat, including prerequisites, dependencies, local password, findings folder, build, and server startup. Also use to repair or develop an existing Recat installation.

Git & Code Review

Explain for Dumb

MotleyWildside/explain-for-dumb

Explains code changes (branch diff vs master, or uncommitted changes) in plain human language, no scary jargon — so the user understands what an agent (or they) actually changed. Two modes - a "for dummies" story (what was, what happened, how it was done) or a per-file walkthrough. Use when the user says "explain-for-dumb", "explain my changes", "what did the agent do", "walk me through the diff", or wants a plain-language recap of a PR/diff.

Git & Code Review

Build It

DevOtts/build-it

Autonomous goal-to-DoD delivery orchestrator — the build stage of the *-it lifecycle ("plan-it plans it, build-it builds it"); formerly named fable-it. Hand it a goal and a numbered Definition of Done and it runs the whole job to completion, typically unattended, enforcing checkable gates (turn-end, claim, state-change, phase-boundary, delegation, and safe-parallel: interlock, worktree, integration), disk-backed run state, an evidence ledger that makes VERIFIED a lookup, a fresh-eyes verification pass, and an honest per-criterion report. Model-adaptive for Sonnet 5 and Opus 4.8; host-agnostic

Git & Code Review

Commit Daily Summary

leonsong09/commit-daily-summary

Use when the user wants a same-day summary of git commits or a commit-based daily report, asks what they did today, or says 总结我今天做了什么, 总结我的提交, 提交总结, 今天提交总结, 日报.

Git & Code Review

Address PR Review

mnapoli/skill-address-pr-review

Look at the pull request review comments and address any issues raised.

Git & Code Review

Browse the most popular Claude skills, all git & code review skills, or write your own with the skills generator.