# CI Guardrails

> Use to improve GitHub Actions workflows for speed, reliability, and security. Do NOT change product code unless required by CI. Keep checks deterministic and aligned with branch protection.

- Skill: `askaret/ci-guardrails` (Agent Skill)
- Install (CLI): `npx skillmds@latest add askaret/ci-guardrails`
- Raw SKILL.md: https://api.skillmd.com/api/skills/askaret/ci-guardrails/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: askaret (https://skillmd.com/u/askaret)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/askaret/ci-guardrails

---


Checklist:
1) Required checks alignment
- Ensure workflow/job names match branch protection required checks
- Ensure PR checks run on `pull_request` and are fast and deterministic

2) Least privilege & secure defaults
- Set default workflow permissions to minimal required
- Use per-job `permissions:` blocks for elevation
- Prefer OIDC auth to clouds; avoid long-lived secrets

3) Build/test hygiene
- Cache appropriately:
  - .NET: NuGet packages
  - Node: npm/pnpm/yarn cache + lockfile-based key
- Use matrix for OS/runtime versions only if valuable
- Use `concurrency` to cancel redundant runs on the same branch/PR
- Split "quick PR checks" vs "full pipeline" when needed

4) Artifact handling
- Upload test results/coverage as artifacts if useful
- Ensure artifacts are not treated as trusted input without validation
- Add provenance attestation for release artifacts where applicable

5) Reusability
- Convert repeated logic into reusable workflows (`workflow_call`)
- Centralize security-hardening steps (permissions, pinning policy, dependency checks)

Finish with:
- Summary of workflow changes
- Expected performance impact (faster? less flaky?)
- Security impact (permissions, OIDC, pinning)
- Any follow-ups (branch protection updates, secrets/env setup)