_setup-github-deploy

An internal helper that configures GitHub Actions to deploy a Vercel-linked project. GitHub Actions is GitHub's system for running automated tasks, and Vercel is a service that hosts web applications.

In plain words
What is it for?
Set up a GitHub Actions deployment workflow for a project connected to Vercel and explain that Vercel's built-in Git integration should be suspended.
Why use it?
It lets GitHub collaborators trigger deployments without needing their own Vercel account. It also prepares the required tokens, secrets, workflow file, and project instructions.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/flavien-ia/hypervibe-harness/_setup-github-deploy
Any agent
npx skills add flavien-ia/hypervibe-harness --skill _setup-github-deploy
Clone the repo
git clone --depth 1 https://github.com/flavien-ia/hypervibe-harness

Made for: Claude Code, Codex.

Per session 83 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,670 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00083 $0.02670
Opus 5 $0.00042 $0.01335
Sonnet 5 $0.00017 $0.00534
Haiku 4.5 $0.00008 $0.00267

Measured 2d ago against content hash 10456f55d3c9, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

_setup-github-deploy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/_setup-github-deploy/SKILL.md · 239 lines

How it starts

The opening of the file, as written. The whole thing — 239 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Setup GitHub Deploy - Internal helper

Communication

  • Detect the user's language from the conversation (the user's own messages, anywhere in the session - not just this invocation: a bare slash command like /bootstrap carries no language signal by itself). If nothing in the conversation gives a signal, fall back to the OS locale (node -e "console.log(Intl.DateTimeFormat().resolvedOptions().locale)") before defaulting to English. ALWAYS reply in that language for every user-facing message: questions, progress, confirmations, summaries, errors - including any example text quoted in this skill, which is illustrative and must be translated, never sent verbatim.
  • Use plain, non-technical business language. Never expose internal script names (*.mjs) or jargon; describe actions in human terms.
  • When generating user-facing content for the scaffolded project (UI labels, emails, copy), write it in the user's language too.
  • Show progress as a short natural-language checklist (in-progress and done states).

You configure GitHub Actions to deploy a Vercel-linked project so that any GitHub collaborator can trigger deployments without a Vercel account.

This is a one-time setup per project. Once done, /add-collab will skip directly to collaborator management.

The caller (/add-collab) has already verified that the setup is missing - do not re-check, go straight to Step 1.


Step 1 - Check prerequisites

gh auth status
vercel whoami

Verify the project is linked to Vercel:

test -f .vercel/project.json && echo "linked" || echo "not linked"

If .vercel/project.json does not exist, the project must be linked first. Tell the user:

The project is not linked to Vercel yet. First run vercel link or a full /bootstrap, then run /add-collab again.

Then exit. Otherwise continue.

Step 2 - Get a Vercel token

Vercel tokens cannot be created via CLI - the user must generate one manually.

Tell the user:

So that GitHub Actions can deploy to Vercel on your behalf, it needs a Vercel token.

  1. Go to https://vercel.com/account/tokens
  2. Click Create Token
  3. Give it a meaningful name (for example: github-actions-{project-name})
  4. Choose whatever expiration you want (No expiration is fine for a personal project)
  5. Click Create and copy the token immediately (you will not be able to see it again afterward)
  6. A small window will then open on your machine: paste the token in there, not in our conversation, so it never gets written into this chat.

⚠️ This token will have your Vercel account's permissions. Keep it secret and do not commit it.

Read the full file on GitHub · 239 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 239 lines · 83 tokens per session scan A 10456f55d3c9

Subscribe to this mod's changes

_setup-github-deploy is a skill published in the GitHub repository flavien-ia/hypervibe-harness (36 stars, last pushed 3d ago), licensed Apache-2.0. It adds 83 tokens to every session and 2,670 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

multi-agent-release-manager

Cleans up the workspace, formats code, runs presubmit checks, and uploads CLs to Gerrit.

chromium/chromium · 27 tokens

dsh-web-pre-push-checks

Use before pushing, opening or updating a pull request, or claiming dsh-web checks pass. Selects the required repository gates and diff-specific generation, build, and GUI evidence.

zhu1090093659/dsh-web · 45 tokens

babysit

Same-session monitoring loop for PRs, CI runs, tickets, and deployments using the monitorstart / monitorupdate / autonudgestop MCP tools. The loop re-injects your check instructions into THIS session on an idle interval — same context, same tools — and works from dashboard chat, Slack threads, and Discord DMs. Use…

kirodotdev/KiroCrew · 137 tokens

azsdk-common-pipeline-analysis

Analyze Azure SDK CI/CD pipeline failures into a structured diagnosis, and define the required output format. Load this skill before calling azsdkanalyzepipeline, which returns raw failure data that this skill interprets and formats. USE FOR: "pipeline failed", "build failure", "CI check failing", "tests failing in…

Azure/azure-sdk-for-net · 192 tokens

harness-setup

HAR: Project init, tool setup, agent config, memory setup, skill mirror sync. Trigger: setup, init, new project, CI/Codex setup, harness-mem, mirror. Do NOT load for: implementation, review, release, planning.

Chachamaru127/claude-code-harness · 57 tokens

managing-github-actions-secrets

Creates and updates GitHub Actions secrets for PostHog workflows. Use when adding a new CI secret, rotating an existing secret, wiring a workflow to an API token, package registry credential, deploy key, or any value referenced via ${{ secrets. }} in .github/workflows/.

PostHog/posthog-foss · 67 tokens