How do I install the Github Actions skill?

Run npx skillmds@latest add octaviantocan/github-actions in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Github Actions safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Github Actions?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Github Actions free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Github Actions?

octaviantocan (@octaviantocan) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Github Actions by octaviantocan — Agent Skill

Name: Github Actions
Author: octaviantocan

Github Actions

Use when creating or modifying GitHub Actions workflows for Pawrrtal. Covers mandatory OctavianTocan actor gate, self-hosted runner defaults, pull_request_target exception, and where CI jobs must live. For VPS runner launch/cleanup, use runner-ops.

File contents

GitHub Actions (Pawrrtal)

Public repo on a self-hosted runner pool. Every workflow job needs the actor gate — even ubuntu-latest jobs.

VPS runner operations (start/cleanup scripts, volume paths) → runner-ops skill.
Rule files → .cursor/plugins/pawrrtal/rules/github-actions/.

Mandatory actor gate

if: >-
  github.actor == 'OctavianTocan' &&
  (github.event_name != 'pull_request' ||
    github.event.pull_request.head.repo.full_name == github.repository)

Fork PRs and non-owner authors must not trigger workflows.

Default runner

runs-on: [self-hosted, openclaw-mini, pawrrtal]

Pool: /mnt/HC_Volume_105512717/github-runners/pawrrtal-ephemeral/
Ephemeral per-job runners — no persistent runner services on this public repo
Workdirs on mounted volume, not VPS root disk
Launch: scripts/ephemeral-self-hosted-runners.sh start --count <N> --tag <name>
Cleanup: scripts/ephemeral-self-hosted-runners.sh cleanup --count <N> --tag <name>
Default batch size: 1–2 when VPS is busy

Use ubuntu-latest only with a real reason (macOS/Windows/GPU/untrusted code already gated separately).

Documented exception

rebase.yml uses pull_request_target and never runs PR code; uses author_association instead of actor gate. See safe-pull-request-target.mdc.

New CI surfaces

Backend pytest, frontend vitest, Maestro E2E, sentrux, etc. belong on self-hosted + actor gate. Do not add ungated ubuntu-latest jobs "just once."

Repo settings (GitHub UI)

Require approval for first-time contributor workflows
Default workflow permissions = read
(standard CI tokens cannot set Actions admin scope)

Handbook

frontend/content/docs/handbook/ci/self-hosted-runner.md

Checklist for new workflows

Actor gate on every job
runs-on uses self-hosted tags unless exception documented
No secrets in workflow logs
Paths scoped to what the job needs (paths: filters when appropriate)
Matches patterns in .github/workflows/ siblings

---name: github-actionsdescription: Use when creating or modifying GitHub Actions workflows for Pawrrtal. Covers mandatory OctavianTocan actor gate, self-hosted runner defaults, pull_request_target exception, and where CI jobs must live. For VPS runner launch/cleanup, use runner-ops.---# GitHub Actions (Pawrrtal)Public repo on a self-hosted runner pool. **Every** workflow job needs the actor gate — even `ubuntu-latest` jobs.VPS runner operations (start/cleanup scripts, volume paths) → `runner-ops` skill. Rule files → `.cursor/plugins/pawrrtal/rules/github-actions/`.## Mandatory actor gate```yamlif: >- github.actor == 'OctavianTocan' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)```Fork PRs and non-owner authors must not trigger workflows.## Default runner```yamlruns-on: [self-hosted, openclaw-mini, pawrrtal]```- Pool: `/mnt/HC_Volume_105512717/github-runners/pawrrtal-ephemeral/`- Ephemeral per-job runners — no persistent runner services on this public repo- Workdirs on mounted volume, not VPS root disk- Launch: `scripts/ephemeral-self-hosted-runners.sh start --count <N> --tag <name>`- Cleanup: `scripts/ephemeral-self-hosted-runners.sh cleanup --count <N> --tag <name>`- Default batch size: 1–2 when VPS is busyUse `ubuntu-latest` only with a real reason (macOS/Windows/GPU/untrusted code already gated separately).## Documented exception`rebase.yml` uses `pull_request_target` and never runs PR code; uses `author_association` instead of actor gate. See `safe-pull-request-target.mdc`.## New CI surfacesBackend pytest, frontend vitest, Maestro E2E, sentrux, etc. belong on **self-hosted + actor gate**. Do not add ungated `ubuntu-latest` jobs "just once."## Repo settings (GitHub UI)- Require approval for first-time contributor workflows- Default workflow permissions = read (standard CI tokens cannot set Actions admin scope)## Handbook`frontend/content/docs/handbook/ci/self-hosted-runner.md`## Checklist for new workflows- [ ] Actor gate on every job- [ ] `runs-on` uses self-hosted tags unless exception documented- [ ] No secrets in workflow logs- [ ] Paths scoped to what the job needs (`paths:` filters when appropriate)- [ ] Matches patterns in `.github/workflows/` siblings

Frequently asked questions