# Github Actions

> Use when: write or review GitHub Actions workflows that are fast, secure, and maintainable.

- Skill: `kimtth/github-actions` (Agent Skill)
- Install (CLI): `npx skillmds@latest add kimtth/github-actions`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kimtth/github-actions/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: kimtth (https://skillmd.com/u/kimtth)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/kimtth/github-actions

---


Goal: CI workflows that are quick, least-privileged, and reliable.

Use for:
- authoring workflows for build, test, and release
- speeding up slow or flaky Actions runs
- hardening workflow permissions and secrets

Workflow:
1. Trigger on the right events with path and branch filters.
2. Set least-privilege permissions for GITHUB_TOKEN.
3. Cache dependencies and reuse setup across jobs.
4. Parallelize with a matrix; fail fast where useful.
5. Pin third-party actions to a commit SHA.
6. Use secrets via the secrets context, never echoed.

Practices:
- minimal permissions block per workflow/job
- matrix builds for versions and platforms
- concurrency groups to cancel superseded runs
- reusable workflows for shared logic

Rules:
- pin actions by SHA; do not trust mutable tags
- grant the token the least access needed
- never print secrets; mask sensitive output
- keep workflows fast with caching and concurrency control