/github-actions-generator

name: github-actions-generator
description: Create, generate, or scaffold GitHub Actions workflows, action.yml, or .github/workflows CI/CD pipelines.

GitHub Actions Generator

Generate production-ready GitHub Actions workflows and custom actions following current best practices, security standards, and naming conventions. All generated resources are automatically validated using the devops-skills:github-actions-validator skill.

Quick Reference

| Capability | When to Use | Reference | |------------|-------------|-----------| | Workflows | CI/CD, automation, testing | `references/best-practices.md` | | Composite Actions | Reusable step combinations | `references/custom-actions.md` | | Docker Actions | Custom environments/tools | `references/custom-actions.md` | | JavaScript Actions | API interactions, complex logic | `references/custom-actions.md` | | Reusable Workflows | Shared patterns across repos | `references/advanced-triggers.md` | | Security Scanning | Dependency review, SBOM | `references/best-practices.md` | | Modern Features | Summaries, environments | `references/modern-features.md` |

---

Trigger Decision Tree

Route every request through this decision tree before reading references or generating files:

1. If the user asks for `.github/workflows/*.yml` CI/CD automation, choose **Workflow Generation**. 2. If the user asks for `action.yml` or a reusable step package, choose **Custom Action Generation**. 3. If the user asks for `workflow_call` or shared pipelines across repositories, choose **Reusable Workflow Generation**. 4. If the request includes security-only scanning (dependency review, SBOM, CodeQL), stay on **Workflow Generation** with the security pattern. 5. If intent is ambiguous, ask one disambiguation question: "Do you want a workflow, a custom action, or a reusable workflow?"

Progressive Disclosure Route

Load only what is needed for the selected route, in this order:

| Route | Load First (required) | Load Next (only if needed) | Primary Template | |-------|------------------------|------------------------------|------------------| | Workflow Generation | `references/best-practices.md` | `references/common-actions.md`, `references/expressions-and-contexts.md`, `references/modern-features.md` | `assets/templates/workflow/basic_workflow.yml` | | Custom Action Generation | `references/custom-actions.md` | `references/best-practices.md` | `assets/templates/action/composite/action.yml`, `assets/templates/action/docker/`, `assets/templates/action/javascript/` | | Reusable Workflow Generation | `references/advanced-triggers.md` | `references/best-practices.md`, `references/common-actions.md` | `assets/templates/workflow/reusable_workflow.yml` |

If a required reference/template is unavailable, continue with the closest available reference and report the fallback explicitly in output.

---

Core Capabilities

1. Generate Workflows

**Triggers:** "Create a workflow for...", "Build a CI/CD pipeline..."

**Process:** 1. Understand requirements (triggers, runners, dependencies) 2. Define trust boundaries (internal branches vs fork PRs vs external triggers) 3. Set default `permissions` to read-only, then elevate only per job when required 4. Reference `references/best-practices.md` for patterns 5. Reference `references/common-actions.md` for action versions 6. Generate workflow with:

• Semantic names, pinned actions (SHA), explicit permissions
• Concurrency controls, caching, matrix strategies
• Fork-safe PR handling (no secrets in untrusted contexts)

7. **Validate** with devops-skills:github-actions-validator skill 8. Fix issues and re-validate if needed

**Minimal Example:**

name: CI Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: '24'
          cache: 'npm'
      - run: npm ci
      - run: npm test

**Untrusted PR Guardrail (required for secret-using jobs):**

jobs:
  deploy:
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository

2. Generate Custom Actions

**Triggers:** "Create a composite action...", "Build a Docker action...", "Create a JavaScript action..."

**Types:**

• **Composite:** Combine multiple steps → Fast startup
• **Docker:** Custom environment/tools → Isolated
• **JavaScript:** API access, complex logic → Fastest

**Process:** 1. Use templates from `assets/templates/action/` 2. Follow structure in `references/custom-actions.md` 3. Include branding, inputs/outputs, documentation 4. **Validate** with devops-skills:github-actions-validator skill

See `references/custom-actions.md` for:

• Action metadata and branding
• Directory structure patterns
• Versioning and release workflows

3. Generate Reusable Workflows

**Triggers:** "Create a reusable workflow...", "Make this workflow callable..."

**Key Elements:**

• `workflow_call` trigger with typed inputs
• Explicit secrets (avoid `secrets: inherit`)
• Explicit trusted-caller expectations (document org/repo boundaries)
• Outputs mapped from job outputs
• Minimal permissions

on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string
    secrets:
      deploy-token:
        required: false
    outputs:
      result:
        value: ${{ jobs.build.outputs.result }}

When secrets are required, pass only the exact secret names needed and prefer environment protection rules for deployment stages.

See `references/advanced-triggers.md` for complete patterns.

4. Generate Security Workflows

**Triggers:** "Add security scanning...", "Add de