SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsgenerate-github-workflow

generate-github-workflow

Office & productivity

View repository

Updated 10-16 03:05

About this skill

Skill: Generate GitHub workflows

Purpose

Generate, for various software projects, Appendix A: Workflow Output Contract that satisfies this skill's GitHub Actions workflow files. Standardized structure, triggers, and security reduce CI/CD setup costs and improve maintainability and auditability, while avoiding common security and permission issues. This skill only produces workflow YAML; it is unrelated to documentation or rules skills. If the user later needs README or AGENTS.md updates, invoke those skills separately.

Core Objective

Primary objective: Generate complete, specification-compliant, and immediately runnable GitHub Actions workflow YAML files for the user's scenario, stack, and security posture — only placeholders need to be replaced before deployment.

Success criteria(all requirements must be met):

  1. ✅ Complies with Appendix A: The output satisfies all mandatory structural and security requirements in Appendix A (name, jobs, runs, steps, pinned actions, no hardcoded secrets)
  2. ✅ Narrow triggers：on blocks are scoped only to specific branches/paths/tags - no bare on: Push
  3. ✅ Least privilege: Set "permissions" at the workflow or job level to the minimum permissions required by the scenario type (CI: "contents: read"; release: "contents: write", "packages: write")
  4. ✅ Stack alignment: Runner, language version, package manager, and commands match the user-specified stack
  5. ✅ User confirmation before writing: List the required comments and placeholders, and obtain user confirmation before writing .github/Workflows/ previously obtained user confirmation

AcceptanceTest: After the user replaces the placeholders, can the workflow run in the target repository without further modification, aside from secret names and environment-specific values?

Scope boundaries (Scope boundaries)

This skill is responsible for：

  • Generating complete GitHub Actions workflow YAML for CI, PR checks, release, and scheduled scenarios
  • Security hardening (pinned actions, least privilege, no hardcoded secrets)
  • Stack alignment (Node/Python/Go/Rust runners, package managers, build commands)
  • Multi-workflow generation (CI + Release split into separate files)
  • Conflict detection with existing workflows
  • Go + Docker + GHCR + GoReleaser pattern (see Appendix B)

This skill is not responsible for：

  • Linking to documentation skills (README, AGENTS.md updates) — invoke those skills separately after workflow generation
  • Writing without user confirmation .github/工作流s/
  • Overwriting existing workflows without warning
  • Implementing build/release logic already defined in ".goreleaser.yaml" or the Dockerfile
  • Generating non-GitHub CI/CD (GitLab CI, Jenkins, etc.)

Handoff point: After generating and confirming the workflow YAML, write the file with user approval.github/工作流/. For documentation updates triggered by new workflows, use the documentation skill separately.

Use cases (Use cases)

  • New project setup: Add CI (build, test, lint) or PR check workflows to a new repository.
  • Unify standards: Coordinate workflow style and naming across multiple repositories for operation and auditing.
  • Fill gaps: Add missing CI/release/scheduled workflows to legacy projects using least privilege and pinned versions.
  • Scenario-based: Generate YAML for a given scenario (e.g. "run tests only on PRs", "build and publish on tags").

When to use: When the user or project needs to "create or add a GitHub workflow for the current or specified project".

Scope: The output of this skill followsEmbedded Appendix A(narrow triggers, least privilege, pinned versions, auditable). General templates (e.g. Skills.sh github-actions-templates) are more general; this skill emphasizes security and maintainability.

Behavior (Behavior)

Principles (Principles)

  • Appendix A is authoritative: The output YAML must satisfy Appendix A (structure, naming, security, maintainability).
  • Narrow triggers：onBranches/paths/tags must be specified; avoid triggering on every push. Common patterns: "push"/"pull_request" with "branches" or "paths". Release workflows must trigger only on version tags (e.g.push:tags:['v*']) and exist in a different file from CI.
  • Least privilege: When a workflow needs repo write, PR, or Secrets, set the workflow- or job-level "permissions" to the minimum required; e.g. CI 内容：读取, release内容：写入，包：写入; avoid "all".
  • Pinned versions: Pin third-party actions (commit SHA or major version tag); do not use "@master" or unpinned references; prefer specific versions for security/scanning actions (e.g. Trivy).

Tone and style

  • Use objective technical language; keep workflow and step "names" short and easy to read in action logs.
  • Match the project stack: choose runners, package managers, and build commands by project type (Node/Python/Go/Rust) and existing conventions; if the project already has workflows, adjust naming and style.

IN (Input) driven

  • If CLAUDE.md or .ai-cortex/config.yamlexists, preferentially read the test_command、base_branch etc. within it; otherwise infer from user input or the project. See docs/guides/project-config.md。
  • Use the user'sscenario(e.g. "CI: run tests on PRs", "Release: build and upload on tags") and stack(language, package manager, test/build commands) to generate the workflow; when information is missing, use reasonable placeholders and mark them for replacement; do not invent commands or paths.

Interaction (Interaction)

  • Confirm before writing: After generating the YAML, list therequired notes(placeholders, branch names, Secret names the user must set), then ask for confirmation; do not write .github/工作流s/ or commit without user confirmation.
  • Multiple files/releases: If generating multiple workflows (e.g. CI + Release) or using write permissions (contents: write、packages: write), list the files to be created/overwritten and the scope of permissions, then confirm before writing.
  • Conflict: If a workflow with the same purpose or overlapping purpose already exists at the target path, warn and ask whether to overwrite or save elsewhere; do not silently overwrite.

Input & Output

Input

  • Scenario: Purpose (CI, PR checks, release, schedule, matrix).
  • Stack: Language and version (e.g. Node 20, Python 3.11, Go 1.21), package manager (npm/pnpm/yarn, pip, cargo), test/build/release commands.
  • Triggers: Branches (e.g.main、develop), path filters, optional工作流_dispatch。
  • Target path: Where to write the file, defaulting to.github/Workflows/under the project root; for multiple workflows, specify each file name (e.g. "ci.yml", "release.yml").

Output

  • Workflow YAML: The complete file content conforms to Appendix A, ready to be written to .github/工作流s/<name>.yml。
  • Notes: List placeholders (e.g. "npm run test", branch "main"), secret names, and any items the user must configure.

Constraints

Hard Boundaries

  • Do not violate Appendix A: The output must havename、on、jobs, and each job must haveruns-onandsteps; do not use unpinned third-party actions or hardcoded secrets.
  • Do not over-trigger: Unless the user explicitly requests it, do not use a bare "on:push" without branch/path filters.
  • Do not invent commands: Use placeholders for unknown test/build/release commands and mark them "replace with the actual command"; do not invent scripts or paths.
  • Do not ignore existing workflows: If the project already has.github/工作流/, adjust naming and style and avoid duplication or conflicts.
  • Do not duplicate build logic: If the project uses GoReleaser, Dockerfile, etc. for building and image shaping, the workflow should only trigger, log in, and pass parameters (e.g. GITHUB_TOKEN、BUILDX_BUILDER); do not reimplement that logic.

Skill Boundaries

Do not do these(other skills can handle them):

  • Do not link to documentation or README skills - invoke them separately
  • Do not write without user confirmation .github/工作流s/
  • Do not silently overwrite existing workflows
  • Do not reimplement build/release logic already defined in .goreleaser.yaml or Dockerfiles
  • Do not generate CI/CD for non-GitHub platforms (GitLab CI, Jenkins, etc.)

When to stop and hand off：

  • After writing the workflow file and confirming it, if README/AGENTS.md updates are needed, hand off to the documentation skill
  • When the user needs registry or secret configuration, provide guidance but do not automatically set up external services

Self-Check

Core success criteria

  • Complies with Appendix A: The output satisfies all mandatory structural and security requirements in Appendix A (name, jobs, runs, steps, pinned actions, no hardcoded secrets)
  • Narrow triggers：onBlock scope is limited to specific branches/paths/tags - no unfiltered bareon：push
  • Least privilege: Set "permissions" at the workflow or job level to the minimum permissions required by the scenario type
  • Stack alignment: The runner, language version, package manager, and commands match the user-specified stack
  • User confirmation before writing: List the required comments and placeholders, and obtain user confirmation before writing to .github/Workflows/ previously confirmed by the user

Process quality checks

  • Appendix A: Does the output satisfy the mandatory structure and security in Appendix A?
  • Triggers: Is "on" narrowed to specific branches/paths/tags?
  • Permissions and security: Is the minimum "permissions" set? Are third-party actions pinned? Are there no hardcoded secrets?
  • Runnable: After the user replaces the placeholders, can the workflow run in the target repository?
  • Stack alignment: Do the runner, language version, package manager, and commands match the user's stack?
  • Step order and dependencies: For multi-step jobs (e.g., QEMU → Buildx → login → GoReleaser), is the order correct and are the ids/env variables passed? See Appendix B。

Acceptance test

After the user replaces the placeholders, can the workflow run in the target repository without further modification, other than secret names and environment-specific values?

Examples (Examples)

Example 1: Node CI (test + lint on PR)

Input: Scenario: CI. Stack: Node 20, pnpm, test pnpm test、lint pnpm lint. Trigger: "pull_request" to "main". File:ci.yml。

Expected: A single "ci.yml" with "name", e.g., "CI"; on: pull_request: 分支: [main]; working on ubuntu-latest , including checkout, setup Node/pnpm, install, lint, test; using pinned official "actions/checkout" and "pnpm/action-setup" (or equivalent); no hardcoded secrets; if "permissions" is set, it is read-only.

Example 2: PR check with path filter

Input: Scenario: PR check. Stack: Go 1.21, test "go test ./...". Only when go.mod or *.go changes. File:pr-check.yml。

Expected：on.pull_request and paths: ['**.go', 'go.mod']; job with pinned "actions/setup-go", steps checkout, setup Go, run test; omit "permissions" or use "contents: read" if write is not needed.

Example 3: Go release (Docker + GHCR + GoReleaser)

Input: Scenario: CD/release. Stack: Go, Docker multi-architecture (amd64/arm64), GoReleaser for image and GitHub Release. Trigger: only "push" tag "v*". File:release.yml。

Expected：on:push:tags:['v*']; 权限includes内容：写、包：写. Steps: checkout (fetch-深度：0) → setup Go (go-version-file：go.mod, cache) → setup QEMU (linux/amd64，linux/arm64) → setup Docker Buildx (id：buildx, same platforms) → login GHCR (docker/login-action，ghcr.io）→GoReleaser（goreleaser/goreleaser-action pinned, pass GITHUB_TOKEN and BUILDX_BUILDER: ${{ steps.buildx.outputs.name }}). Do not reimplement .goreleaser.yaml/logic defined in the Dockerfile. See Appendix B。

Example 4 (Edge): Minimal Information

Input: Project: legacy-api. No description. Language and commands unknown. The user wants "at least one CI placeholder workflow".

Expected: Generate a structurally complete YAML that conforms to Appendix A; use placeholders for the runner and steps (e.g., "specify runner and install/test commands") and mark them "to be replaced"; keep the "on" scope small (e.g., "pull_request:branches:[main]"); do not invent test or build commands; retain "name", "on", "jobs", "runs-on", "steps", and recommended fields (e.g., "permissions") so the user can fill them in later.