agentmods.dev

github-actions-standards

A set of GitHub Actions rules for keeping automated repository workflows on supported action versions and following common workflow practices. GitHub Actions runs build, test, and deployment jobs from a repository.

In plain words
What is it for?
It checks checkout and artifact actions, recommends current versions, and suggests clear jobs, dependency caching, and limited workflow permissions.
Why use it?
It identifies outdated action versions and recommends safer, more maintainable workflow settings. This helps prevent deprecated actions from remaining unnoticed.

Cursor rule for Cursor

2 1y ago A scan 0 tokens original MIT
View the source file abderrahimghazali/cursor-rules
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/abderrahimghazali/cursor-rules/github-actions-standards
Clone the repo
git clone --depth 1 https://github.com/abderrahimghazali/cursor-rules

Made for: Cursor.

Per session 0 Nothing until a file matches its globs; then the whole rule loads.
When invoked 577 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.00577
Opus 5 $0.00000 $0.00289
Sonnet 5 $0.00000 $0.00115
Haiku 4.5 $0.00000 $0.00058

Measured yesterday against content hash 1d37aa467dee, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

github-actions-standards scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/rules/github-actions-standards.mdc · 65 lines

What it actually says

GitHub Actions Standards

Ensures GitHub Actions workflows follow best practices and use the latest action versions.

actions:

  • type: enforce conditions:

    • pattern: "uses:\s*actions/upload-artifact@v[123]" message: "Use actions/upload-artifact@v4 instead of older versions. Version 3 is deprecated: https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/"

    • pattern: "uses:\s*actions/download-artifact@v[123]" message: "Use actions/download-artifact@v4 instead of older versions."

    • pattern: "uses:\s*actions/checkout@v[12]" message: "Consider using actions/checkout@v4 for the latest features and security updates."

  • type: suggest message: | GitHub Actions Best Practices:

    • Latest Action Versions: Always use the latest stable versions of GitHub Actions.
      • actions/checkout@v4
      • actions/upload-artifact@v4
      • actions/download-artifact@v4
      • actions/setup-node@v4
      • actions/setup-python@v5
    • Workflow Structure: Organize workflows with clear job names and step descriptions.
    • Caching: Implement caching for dependencies to speed up workflows.
    • Security: Use GITHUB_TOKEN with minimum required permissions.
    • Artifacts: Use descriptive names for artifacts and set appropriate retention periods.
    • Matrix Strategy: Use matrix builds for testing across multiple environments.
    • Timeouts: Set appropriate timeouts for jobs to prevent hanging workflows.

  • type: validate conditions:

    • pattern: "uses:\s*actions/upload-artifact@v4" message: "Good job using the latest version of actions/upload-artifact!"

    • pattern: "uses:\s*actions/download-artifact@v4" message: "Good job using the latest version of actions/download-artifact!"

    • pattern: "uses:\s*actions/checkout@v[34]" message: "Good job using a recent version of actions/checkout!"

metadata: priority: high version: 1.0 tags: - ci/cd - github - automation

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 65 lines · 0 tokens per session scan A 1d37aa467dee

Subscribe to this mod's changes

github-actions-standards is a cursor rule published in the GitHub repository abderrahimghazali/cursor-rules (2 stars, last pushed 1y ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 577 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

DevOps and cloudDrupalE-commerceTestingbest-practicescursor
Related

Other cursor rules, from other repositories

cursor

You are working on the checkout service. Preserve transaction integrity and auditability.

mrwogu/promptscript · 53 tokens

creating-cursor-rules

Meta-rule for creating effective Cursor IDE rules with best practices, patterns, and examples.

pr-pm/prpm · 16 tokens

creating-skills

Meta-guide for creating effective Claude Code skills with proper structure, CSO optimization, and real examples.

pr-pm/prpm · 19 tokens

test-case-to-katalon-studio

Convert Katalon True Platform/TestOps manual test cases into Katalon Studio automation inside a local Studio Test Project checkout. Use when you need to author or extend a .tc test case file and its paired Groovy script under Scripts/, keep test case variable GUIDs consistent with the .ts test suite bindings that read…

katalon-labs/true-skills · 195 tokens

stripe-payments

Stripe payment integration patterns — server-only, webhook handling.

vibestackdev/vibe-stack · 0 tokens

git-branch-agent

This rule enforces standards and best practices for branch management operations including checkout, creation, and deletion. This rule should be followed when: 1. creating new branches, 2. switching between branches, 3. deleting branches, or 4. when the git aliases 'gco', 'gcb', or similar branch-related commands are…

usrrname/cursorrules · 0 tokens