laurigates /configure:workflows
Check and configure GitHub Actions CI/CD workflows against project standards.
When to Use This Skill
| Use this skill when... | Use another approach when... |
|---|---|
| Checking GitHub Actions workflows for compliance with project standards | Debugging a failing CI run (use github-actions-inspection skill) |
| Setting up container build, test, or release-please workflows | Installing Claude-powered reusable workflows (use /configure:reusable-workflows) |
| Updating outdated action versions (checkout, build-push, etc.) | Writing a custom workflow from scratch (use ci-workflows skill) |
| Adding multi-platform builds or GHA caching to existing workflows | Configuring security-specific workflows (use /configure:security) |
| Auditing which required workflows are missing from a project | Managing GitHub repository settings or branch protection rules |
Context
- Workflows dir: !
find . -maxdepth 1 -type d -name '.github/workflows' - Workflow files: !
find . -path '*/.github/workflows/*' -maxdepth 3 \( -name '*.yml' -o -name '*.yaml' \) - Package files: !
find . -maxdepth 1 \( -name 'package.json' -o -name 'pyproject.toml' -o -name 'Cargo.toml' -o -name 'go.mod' \) - Dockerfile: !
find . -maxdepth 1 -name 'Dockerfile*' - Release-please config: !
find . -maxdepth 1 -name 'release-please-config.json'
Skills referenced: ci-workflows, github-actions-auth-security
Display name convention: Every generated or repaired workflow's name: follows <Domain>: <Action> [<target>] (quoted, since YAML treats : as a key separator). See .claude/rules/workflow-naming.md for the full rule and active domains.
Parameters
Parse from command arguments:
--check-only: Report status without offering fixes--fix: Apply fixes automatically
Execution
Execute this GitHub Actions workflow configuration check:
Step 1: Fetch latest action versions
Verify latest versions before reporting outdated actions:
actions/checkout- releasesactions/setup-node- releasesactions/cache- releasesdocker/setup-buildx-action- releasesdocker/build-push-action- releasesdocker/login-action- releasesdocker/metadata-action- releasesreproducible-containers/buildkit-cache-dance- releasesgoogle-github-actions/release-please-action- releases
Use WebSearch or WebFetch to verify current versions.
Step 2: Detect project type and list workflows
- Check for
.github/workflows/directory - List all workflow files (*.yml, *.yaml)
- Categorize workflows by purpose (container build, test, release)
Determine required workflows based on project type:
| Project Type | Required Workflows |
|---|---|
| Frontend | container-build, release-please, renovate (optional: claude-auto-fix) |
| Python | container-build, release-please, test, renovate (optional: claude-auto-fix) |
| Infrastructure | release-please, renovate (optional: docs, claude-auto-fix) |
Step 3: Analyze workflow compliance
Container Build Workflow Checks:
| Check | Standard | Severity |
|---|---|---|
| checkout action | v6 | WARN if older |
| build-push action | v7 | WARN if older |
| Multi-platform | amd64 + arm64 | WARN if missing |
| Registry | GHCR (ghcr.io) | INFO |
| Caching | GHA cache enabled | WARN if missing |
| Permissions | Explicit | WARN if missing |
id-token: write |
Required when provenance/SBOM enabled | WARN if missing |
| Cache scope | Explicit scope= when multiple build jobs |
WARN if missing |
| Dead metadata tags | No type=schedule without schedule trigger |
INFO |
| Semver regex escaping | Dots escaped in type=match patterns (\d+\.\d+) |
WARN if unescaped |
| Hardcoded image names | Derive from ${{ github.repository }} |
INFO if hardcoded |
| Digest output | Capture build-push digest via id: for traceability |
INFO if missing |
| Job summary | Write image/digest/tags to $GITHUB_STEP_SUMMARY |
INFO if missing |
| Duplicated job conditions | Identical if: on sibling jobs; suggest gate job |
INFO |
Release Please Workflow Checks:
| Check | Standard | Severity |
|---|---|---|
| Action version | v4 | WARN if older |
| Token | MY_RELEASE_PLEASE_TOKEN | WARN if GITHUB_TOKEN |
| Permissions | contents: write, pull-requests: write | FAIL if missing |
Test Workflow Checks:
| Check | Standard | Severity |
|---|---|---|
| Node version | 22 | WARN if older |
| Linting | npm run lint | WARN if missing |
| Type check | npm run typecheck | WARN if missing |
| Coverage | Coverage upload | INFO |
Renovate Workflow Checks:
| Check | Standard | Severity |
|---|---|---|
| RENOVATE_REPOSITORIES env var | Must be set (${{ github.repository }}) |
FAIL if missing |
| checkout action | v6 | WARN if older |
| renovatebot/github-action | Minor-pinned (e.g., v46.1.0), not major tag | WARN if major-only |
| Uses reusable workflow | Preferred (except infrastructure) | INFO if standalone |
Claude Auto-Fix Workflow Checks (if present):
| Check | Standard | Severity |
|---|---|---|
| workflow_run trigger | Monitors at least one workflow | WARN if misconfigured |
| Loop prevention | Skips fix(auto): commits | FAIL if missing |
| Deduplication | Caps open auto-fix PRs | WARN if missing |
| Claude Code Action | anthropics/claude-code-action@v1 | WARN if older |
| OAuth token | CLAUDE_CODE_OAUTH_TOKEN secret | FAIL if missing |
| Permissions | Minimal required set | WARN if excessive |
Step 4: Generate compliance report
Print a formatted compliance report showing workflow status, per-workflow check results, and missing workflows.
If --check-only is set, stop here.
For the report format, see REFERENCE.md.
Step 5: Apply configuration (if --fix or user confirms)
- Missing workflows: Create from standard templates
- Outdated actions: Update version numbers
- Missing multi-platform: Add platforms to build-push
- Missing caching: Add GHA cache configuration
For standard templates (container build, test workflow), see REFERENCE.md.
Step 6: Update standards tracking
Update .project-standards.yaml:
components:
workflows: "2025.1"
Agentic Optimizations
| Context | Command |
|---|---|
| Quick compliance check | /configure:workflows --check-only |
| Auto-fix all issues | /configure:workflows --fix |
| List workflow files | find .github/workflows -name '*.yml' -o -name '*.yaml' |
| Check action versions | rg 'uses:' .github/workflows/ --no-heading |
| Verify release-please config | test -f release-please-config.json && echo "EXISTS" |
Flags
| Flag | Description |
|---|---|
--check-only |
Report status without offering fixes |
--fix |
Apply fixes automatically |
See Also
/configure:container- Comprehensive container infrastructure (builds, registry, scanning)/configure:dockerfile- Dockerfile configuration and security/configure:release-please- Release automation specifics/configure:all- Run all compliance checksci-workflowsskill - Workflow patternsgithub-actions-inspectionskill - Workflow debugging