# Github Skill

> This skill should be used when the user asks about GitHub, git workflows, GitHub Actions, CI/CD pipelines, pull requests, issues, GitHub CLI (gh), GitHub API, branch protection, releases, GitHub Pages, Actions secrets, repository management, code review workflows, GitHub Packages, Dependabot, or any GitHub platform feature. Trigger when the user mentions "github", "gh cli", "github actions", "workflow yaml", "pull request", "CI/CD", "git flow", "branch strategy", "github pages", or managing code repositories on GitHub.

- Skill: `sirhamza/github-skill` (Agent Skill)
- Install (CLI): `npx skillmds@latest add sirhamza/github-skill`
- Raw SKILL.md: https://api.skillmd.com/api/skills/sirhamza/github-skill/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: SirHamza (https://skillmd.com/u/sirhamza)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/sirhamza/github-skill

---


# GitHub Expert

## Overview

Advanced expertise in GitHub — from repository management and Git workflows to GitHub Actions CI/CD, the GitHub CLI, GitHub API, and team collaboration patterns.

---

## 1. Git Workflow Strategies

### Git Flow
```
main ← develop ← feature/*, release/*, hotfix/*
```

### GitHub Flow (recommended for most teams)
```
main ← feature-branch → PR → merge to main → deploy
```

### Trunk-Based Development
- Short-lived feature branches (< 1 day)
- Feature flags for incomplete features
- Continuous integration on every commit

### Conventional Commits
```
feat(scope): add user authentication
fix(api): handle null response from /users
docs: update README with setup instructions
chore(deps): bump lodash to 4.17.21
BREAKING CHANGE: removed deprecated API endpoint
```

---

## 2. GitHub Actions — CI/CD

### Workflow File Structure
```yaml
# .github/workflows/ci.yml
name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
      - run: npm ci
      - run: npm test
```

### Key Actions
- `actions/checkout@v4` — clone repo
- `actions/setup-node@v4` — Node.js setup with caching
- `actions/setup-python@v5` — Python setup
- `actions/cache@v4` — dependency caching
- `actions/upload-artifact@v4` / `download-artifact@v4`
- `actions/github-script@v7` — run JS with octokit
- `github/codeql-action` — security scanning

### Secrets & Variables
```yaml
env:
  DATABASE_URL: ${{ secrets.DATABASE_URL }}
  NODE_ENV: ${{ vars.NODE_ENV }}   # non-sensitive vars
```

### Matrix Builds
```yaml
strategy:
  matrix:
    os: [ubuntu-latest, windows-latest]
    node: ['18', '20', '22']
  fail-fast: false
```

### Reusable Workflows
```yaml
# caller
jobs:
  deploy:
    uses: ./.github/workflows/deploy.yml
    with:
      environment: production
    secrets: inherit
```

### Environment Protection Rules
```yaml
jobs:
  deploy:
    environment: production   # requires approval
    runs-on: ubuntu-latest
```

---

## 3. GitHub CLI (`gh`)

### Authentication
```bash
gh auth login
gh auth status
```

### Pull Requests
```bash
gh pr create --title "feat: add login" --body "..." --base main
gh pr list --state open
gh pr view 123
gh pr merge 123 --squash --delete-branch
gh pr checkout 123
gh pr review 123 --approve
gh pr review 123 --request-changes --body "..."
```

### Issues
```bash
gh issue create --title "Bug: ..." --label bug --assignee @me
gh issue list --assignee @me --state open
gh issue close 45 --comment "Fixed in #123"
```

### Releases
```bash
gh release create v1.2.0 --generate-notes
gh release create v1.2.0 --notes "Release notes" dist/*
gh release list
gh release download v1.2.0
```

### Workflows
```bash
gh workflow run deploy.yml --field environment=staging
gh workflow list
gh run list --workflow=ci.yml
gh run watch
gh run view 123456 --log
```

### Repository Management
```bash
gh repo create my-app --public --clone
gh repo fork owner/repo --clone
gh repo view --web
gh repo set-default owner/repo
```

### GitHub API
```bash
gh api repos/{owner}/{repo}/issues --method POST \
  --field title="Bug report" \
  --field body="..."
gh api graphql -f query='{ viewer { login } }'
```

---

## 4. Branch Protection Rules

Best practice config for `main`:
- Require pull request reviews (min 1-2 approvals)
- Dismiss stale reviews on new commits
- Require status checks to pass (CI, lint, tests)
- Require branches to be up to date before merging
- Restrict force pushes and deletions
- Require signed commits (optional but recommended)

---

## 5. Pull Request Best Practices

### PR Template (`.github/pull_request_template.md`)
```markdown
## Summary
<!-- What does this PR do? -->

## Type of Change
- [ ] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update

## Testing
- [ ] Unit tests added/updated
- [ ] E2E tests pass

## Checklist
- [ ] Code follows style guidelines
- [ ] Self-reviewed
- [ ] No console.logs left
```

### PR Size
- Aim for < 400 lines changed per PR
- Split large features into stacked PRs

---

## 6. GitHub Actions — Deployment Patterns

### Deploy to Vercel
```yaml
- uses: amondnet/vercel-action@v25
  with:
    vercel-token: ${{ secrets.VERCEL_TOKEN }}
    vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
    vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
    vercel-args: '--prod'
```

### Deploy to AWS (S3 + CloudFront)
```yaml
- uses: aws-actions/configure-aws-credentials@v4
  with:
    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    aws-region: us-east-1
- run: aws s3 sync ./dist s3://my-bucket --delete
- run: aws cloudfront create-invalidation --distribution-id ${{ secrets.CF_DIST_ID }} --paths "/*"
```

### Docker Build & Push
```yaml
- uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}
- uses: docker/build-push-action@v5
  with:
    push: true
    tags: ghcr.io/${{ github.repository }}:${{ github.sha }}
    cache-from: type=gha
    cache-to: type=gha,mode=max
```

---

## 7. GitHub Packages

- Docker images: `ghcr.io/owner/image:tag`
- npm packages: `@owner/package` via `npm.pkg.github.com`
- Authenticate with `GITHUB_TOKEN` in Actions
- Visibility tied to repository visibility

---

## 8. Security Features

- **Dependabot**: auto PRs for dependency updates (`.github/dependabot.yml`)
- **CodeQL**: SAST scanning via `github/codeql-action`
- **Secret scanning**: detects leaked credentials in commits
- **GHAS**: GitHub Advanced Security for private repos
- **SBOM**: software bill of materials generation

### Dependabot Config
```yaml
# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: npm
    directory: "/"
    schedule:
      interval: weekly
    open-pull-requests-limit: 5
```

---

## 9. GitHub Pages

```yaml
# .github/workflows/pages.yml
- uses: actions/configure-pages@v4
- uses: actions/upload-pages-artifact@v3
  with:
    path: './dist'
- uses: actions/deploy-pages@v4
```

Settings: Pages → Source → GitHub Actions

---

## 10. GitHub API (REST & GraphQL)

### REST with Octokit
```ts
import { Octokit } from '@octokit/rest'
const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN })

const { data } = await octokit.rest.issues.create({
  owner: 'org', repo: 'repo',
  title: 'Bug', body: 'Description'
})
```

### GraphQL
```graphql
query {
  repository(owner: "vercel", name: "next.js") {
    stargazerCount
    issues(states: OPEN) { totalCount }
  }
}
```

---

## 11. CODEOWNERS

```
# .github/CODEOWNERS
*               @org/team-all
/frontend/      @org/frontend-team
/backend/       @org/backend-team
*.go            @gopher-lead
```

---

## Core Competency Summary

- Design and implement GitHub Actions CI/CD pipelines
- Manage repositories, PRs, issues, and releases with `gh` CLI
- Configure branch protection and code review workflows
- Set up Dependabot, CodeQL, and security scanning
- Deploy applications via GitHub Actions to any cloud provider
- Work with GitHub REST and GraphQL APIs programmatically