v1truv1us Default output: return only the result, blockers, and required evidence. Omit preambles, process narration, repeated context, confidence scores, and follow-up offers. Use at most five bullets unless a required artifact or schema needs more.
GitHub Operations
Current Versions (Verify Before Use)
gh --version # GitHub CLI
act --version # Local Actions runner (optional)
Check GitHub CLI releases and GitHub Actions runner releases.
Core Principles
- PRs are the unit of review. Every change goes through a PR. No direct pushes to main.
- Actions are code. Workflows get the same review as application code.
- Branch protection is mandatory. Main requires: PR, review, passing checks, up-to-date branch.
- gh CLI over web UI. Scriptable, reproducible, faster.
PR Hygiene Checklist
- PR title describes what and why (not just the ticket number)
- Description links to issue/ticket, summarizes changes, includes screenshots for UI
- Branch is up-to-date with main (rebased or merged)
- Checks are green before requesting review
- Reviewers assigned explicitly (not just "anyone")
- PR is small enough to review in < 20 minutes (~250 lines max)
gh CLI Patterns
# Create PR from current branch
gh pr create --title "feat: add OAuth2 login" --body-file .github/PULL_REQUEST_TEMPLATE.md
# View checks
gh pr checks --watch --fail-fast
# Checkout a PR for local review
gh pr checkout 123
# View PR diff with comments
gh pr view 123 --comments
# Merge when green
gh pr merge --squash --delete-branch
# Review from CLI
gh pr review 123 --approve --body "LGTM"
Actions Optimization
Caching
- uses: actions/cache@v4
with:
path: ~/.npm
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
Matrix Strategy
strategy:
fail-fast: false
matrix:
node: [20, 22]
os: [ubuntu-latest]
Reusable Workflows
jobs:
ci:
uses: ./.github/workflows/reusable-ci.yml
with:
node-version: 22
secrets: inherit
Common Anti-Patterns
| Anti-Pattern | Why It's Wrong | Fix |
|---|---|---|
actions/checkout@v2 |
Deprecated, security risks | Use actions/checkout@v4 |
set-output command |
Deprecated | Use GITHUB_OUTPUT env file |
save-state / set-env |
Security vulnerability | Use GITHUB_STATE / GITHUB_ENV |
| No timeout on jobs | Runaway jobs burn minutes | timeout-minutes: 10 |
pull_request_target without care |
Can expose secrets to forks | Use pull_request for untrusted code |
| Hardcoded secrets in workflows | Leaked in logs, not rotatable | Use GitHub Secrets + environments |
permissions: write-all |
Overprivileged workflows | Explicit permissions block |
Validation Checklist
-
.github/workflows/files passactionlintoryamllint - All
uses:references are pinned to major version or SHA -
permissions:is explicitly defined (not default write-all) - No secrets in workflow files (use
${{ secrets.XXX }}) - Jobs have
timeout-minutes - Reusable workflows are used for duplicated logic
- Branch protection rules enforce required checks