Github Skill

GitHub Expert

Overview

Advanced expertise in GitHub — from repository management and Git workflows to GitHub Actions CI/CD, the GitHub CLI, GitHub API, and team collaboration patterns.

1. Git Workflow Strategies

Git Flow

main ← develop ← feature/*, release/*, hotfix/*

GitHub Flow (recommended for most teams)

main ← feature-branch → PR → merge to main → deploy

Trunk-Based Development

• Short-lived feature branches (< 1 day)
• Feature flags for incomplete features
• Continuous integration on every commit

Conventional Commits

feat(scope): add user authentication
fix(api): handle null response from /users
docs: update README with setup instructions
chore(deps): bump lodash to 4.17.21
BREAKING CHANGE: removed deprecated API endpoint

2. GitHub Actions — CI/CD

Workflow File Structure

# .github/workflows/ci.yml
name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
      - run: npm ci
      - run: npm test

Key Actions

• actions/checkout@v4 — clone repo
• actions/setup-node@v4 — Node.js setup with caching
• actions/setup-python@v5 — Python setup
• actions/cache@v4 — dependency caching
• actions/upload-artifact@v4 / download-artifact@v4
• actions/github-script@v7 — run JS with octokit
• github/codeql-action — security scanning

Secrets & Variables

env:
  DATABASE_URL: ${{ secrets.DATABASE_URL }}
  NODE_ENV: ${{ vars.NODE_ENV }}   # non-sensitive vars

Matrix Builds

strategy:
  matrix:
    os: [ubuntu-latest, windows-latest]
    node: ['18', '20', '22']
  fail-fast: false

Reusable Workflows

# caller
jobs:
  deploy:
    uses: ./.github/workflows/deploy.yml
    with:
      environment: production
    secrets: inherit

Environment Protection Rules

jobs:
  deploy:
    environment: production   # requires approval
    runs-on: ubuntu-latest

3. GitHub CLI (gh)

Authentication

gh auth login
gh auth status

Pull Requests

gh pr create --title "feat: add login" --body "..." --base main
gh pr list --state open
gh pr view 123
gh pr merge 123 --squash --delete-branch
gh pr checkout 123
gh pr review 123 --approve
gh pr review 123 --request-changes --body "..."

Issues

gh issue create --title "Bug: ..." --label bug --assignee @me
gh issue list --assignee @me --state open
gh issue close 45 --comment "Fixed in #123"

Releases

gh release create v1.2.0 --generate-notes
gh release create v1.2.0 --notes "Release notes" dist/*
gh release list
gh release download v1.2.0

Workflows

gh workflow run deploy.yml --field environment=staging
gh workflow list
gh run list --workflow=ci.yml
gh run watch
gh run view 123456 --log

Repository Management

gh repo create my-app --public --clone
gh repo fork owner/repo --clone
gh repo view --web
gh repo set-default owner/repo

GitHub API

gh api repos/{owner}/{repo}/issues --method POST \
  --field title="Bug report" \
  --field body="..."
gh api graphql -f query='{ viewer { login } }'

4. Branch Protection Rules

Best practice config for main:

• Require pull request reviews (min 1-2 approvals)
• Dismiss stale reviews on new commits
• Require status checks to pass (CI, lint, tests)
• Require branches to be up to date before merging
• Restrict force pushes and deletions
• Require signed commits (optional but recommended)

5. Pull Request Best Practices

PR Template (.github/pull_request_template.md)

## Summary
<!-- What does this PR do? -->

## Type of Change
- [ ] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update

## Testing
- [ ] Unit tests added/updated
- [ ] E2E tests pass

## Checklist
- [ ] Code follows style guidelines
- [ ] Self-reviewed
- [ ] No console.logs left

PR Size

• Aim for < 400 lines changed per PR
• Split large features into stacked PRs

6. GitHub Actions — Deployment Patterns

Deploy to Vercel

- uses: amondnet/vercel-action@v25
  with:
    vercel-token: ${{ secrets.VERCEL_TOKEN }}
    vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
    vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
    vercel-args: '--prod'

Deploy to AWS (S3 + CloudFront)

- uses: aws-actions/configure-aws-credentials@v4
  with:
    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    aws-region: us-east-1
- run: aws s3 sync ./dist s3://my-bucket --delete
- run: aws cloudfront create-invalidation --distribution-id ${{ secrets.CF_DIST_ID }} --paths "/*"

Docker Build & Push

- uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}
- uses: docker/build-push-action@v5
  with:
    push: true
    tags: ghcr.io/${{ github.repository }}:${{ github.sha }}
    cache-from: type=gha
    cache-to: type=gha,mode=max

7. GitHub Packages

• Docker images: ghcr.io/owner/image:tag
• npm packages: @owner/package via npm.pkg.github.com
• Authenticate with GITHUB_TOKEN in Actions
• Visibility tied to repository visibility

8. Security Features

• Dependabot: auto PRs for dependency updates (.github/dependabot.yml)
• CodeQL: SAST scanning via github/codeql-action
• Secret scanning: detects leaked credentials in commits
• GHAS: GitHub Advanced Security for private repos
• SBOM: software bill of materials generation

Dependabot Config

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: npm
    directory: "/"
    schedule:
      interval: weekly
    open-pull-requests-limit: 5

9. GitHub Pages

# .github/workflows/pages.yml
- uses: actions/configure-pages@v4
- uses: actions/upload-pages-artifact@v3
  with:
    path: './dist'
- uses: actions/deploy-pages@v4

Settings: Pages → Source → GitHub Actions

10. GitHub API (REST & GraphQL)

REST with Octokit

import { Octokit } from '@octokit/rest'
const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN })

const { data } = await octokit.rest.issues.create({
  owner: 'org', repo: 'repo',
  title: 'Bug', body: 'Description'
})

GraphQL

query {
  repository(owner: "vercel", name: "next.js") {
    stargazerCount
    issues(states: OPEN) { totalCount }
  }
}

11. CODEOWNERS

# .github/CODEOWNERS
*               @org/team-all
/frontend/      @org/frontend-team
/backend/       @org/backend-team
*.go            @gopher-lead

Core Competency Summary

• Design and implement GitHub Actions CI/CD pipelines
• Manage repositories, PRs, issues, and releases with gh CLI
• Configure branch protection and code review workflows
• Set up Dependabot, CodeQL, and security scanning
• Deploy applications via GitHub Actions to any cloud provider
• Work with GitHub REST and GraphQL APIs programmatically