appkit: Skill for Claude Code

GitHub Actions CI/CD Skill

When to Use

• Creating a new CI/CD workflow from scratch
• Auditing an existing workflow for security, performance, or correctness
• Debugging a failing or misbehaving workflow
• Designing deployment strategies (rolling, blue/green, canary)
• Configuring secrets, OIDC, or environment protections

---

Mode: Create

1. Gather Requirements

Ask (or infer from context):

• Trigger events: push, pull_request, workflow_dispatch, schedule?
• Language/runtime (Python, Node.js, etc.) — determines setup actions and cache paths
• Test stages needed: unit, integration, E2E?
• Deployment target: cloud provider, registry, k8s?
• Environments: staging + production with manual approval gates?

2. Scaffold Structure

name: <Descriptive Name>
on: ...
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
permissions:
  contents: read  # least privilege default
jobs:
  lint:   ...
  test:   ...
  build:  ...
  deploy: ...

3. Apply Checklist per Job

• runs-on: ubuntu-latest (or justified alternative)
• actions/checkout@v4 with fetch-depth: 1
• Cache keyed on hashFiles('**/lockfile') with restore-keys fallback
• All uses: pinned to full commit SHA or major version tag (@v4, not @main)
• timeout-minutes set for long-running jobs
• Secrets via ${{ secrets.NAME }} — never hardcoded

4. Security Gates

• Least-privilege permissions block at workflow + override at job level
• OIDC for cloud auth (prefer over long-lived keys)
• dependency-review-action on PRs targeting default branch
• CodeQL or Bandit for SAST on push/PR

5. Deployment Configuration

• Use environment: blocks with protection rules for staging/prod
• Manual approval required for production environment
• Store rollback artifact version as job output; document rollback command in workflow comment

---

Mode: Review (Audit Checklist)

Run through these checks on any existing workflow: