Edit Workflow
GitHub Actions conventions. Run this skill before modifying workflow files in .github/.
Action Version Pinning (Required)
All actions must be pinned to commit SHA with version comment:
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- Never use version tags alone (
@v4is wrong) - Local actions (
./.github/actions/*) are exempt from pinning
Runner Selection
Self-hosted runners ([self-hosted-ghr, size-*-x64]) are a shared EF devops
pool — reserve them for jobs that need the capacity. Non-critical or low-load
jobs belong on GitHub-hosted runners (ubuntu-latest), which also avoids a
provisioning wait (~2.5 min) if the self-hosted warm pool is exhausted.
- Pattern: lightweight job (short runtime, no heavy parallelism) →
ubuntu-latest(e.g.spec-toolsin #3177). - Anti-pattern: defaulting a quick gate, lint, or cache-restore job to
size-xl-x64"to be safe". - Exception: a job may need self-hosted for reasons other than load, e.g.
Docker Hub pulls from GHR egress IPs to dodge per-IP rate limits (#3185
keeps push runs self-hosted while PR runs use
ubuntu-latest).
If unsure which runner a job needs, flag it and ask instead of guessing.
Validation
Run just lint-actions before committing to validate YAML syntax and structure.