Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/nicogenti/opencode-orchestrator-kit/github-actions-cicdnpx skills add NicoGenti/opencode-orchestrator-kit --skill github-actions-cicdgit clone --depth 1 https://github.com/NicoGenti/opencode-orchestrator-kitWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00033 | $0.00425 |
| Opus 5 | $0.00016 | $0.00212 |
| Sonnet 5 | $0.00007 | $0.00085 |
| Haiku 4.5 | $0.00003 | $0.00042 |
Grade A, and why
github-actions-cicd scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
GitHub Actions CI/CD Conventions
Workflow Structure
- Split logically distinct phases into separate jobs (build, test, lint, security scan, deploy) rather than one monolithic job [web:66][web:64].
- Split deployment targets into separate workflows or jobs per environment (dev/staging/prod) with explicit GitHub Environments and required approvals for prod [web:65].
- Keep workflows simple; add complexity incrementally rather than front-loading a complex pipeline [web:65].
- Parallelize independent jobs to reduce total pipeline time [web:65].
Caching and Performance
- Cache dependencies (npm/NuGet/pip) and build artifacts between runs using
actions/cache[web:65]. - Reuse composite actions or reusable workflows for logic repeated across pipelines instead of copy-pasting steps.
Security
- Store all credentials and API keys in GitHub Secrets, never in workflow YAML or committed files [web:65].
- Restrict third-party actions to pinned versions (commit SHA or exact tag), not floating
@main/@latest. - Avoid self-hosted runners on shared/production infrastructure; isolate them in a dedicated environment [web:60].
- Scope
GITHUB_TOKENpermissions to the minimum required (permissions:block) rather than defaulting to full write access.
Deployment
- Use GitHub Environments with protection rules for staging/production deploys, requiring manual approval for prod [web:65].
- Fail fast: run lint/test/security jobs before the deploy job, and make deploy depend on their success (
needs:).
When Reviewing or Debugging
Check for: unpinned action versions, secrets exposed in logs or run: commands, missing needs: dependencies that let deploy run before tests pass, and overly broad token permissions — these are higher priority than formatting nits.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 37 lines · 33 tokens per session scan A a49e47a9b877
github-actions-cicd is a skill published in the GitHub repository NicoGenti/opencode-orchestrator-kit (5 stars, last pushed 3d ago), licensed MIT. It adds 33 tokens to every session and 425 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
tutti-app-release
Set up, review, run, or debug external repositories that publish a Tutti workspace app through the reusable Tutti App Release GitHub Actions workflow. Use for caller workflows, tutti.app.json manifests, @tutti-os/app-release-tools, S3/CloudFront release hosting, latest.json, versions.json, catalog.json, catalog-only…
cao-workflow
Author and run CAO Python workflow scripts — multi-step, parameterized, fan-out orchestrations executed by cao workflow run. Use when the user wants a repeatable multi-step job (e.g. data analysis over many files, a review pipeline, a parameterized batch). Authoring ends at a validated script file; running it is a…
aidlc-portfolio
Coordinate multiple AI-DLC workflows across repositories and Git worktrees using an evidence-backed portfolio catalog and deterministic workspace tooling. Use when initializing an AI-DLC portfolio workspace, discovering organization or business context, registering projects and dependencies, creating child intents and…
cao-plugin
Create a new CAO (CLI Agent Orchestrator) plugin. Use this skill whenever the user wants to add a plugin that reacts to CAO lifecycle or messaging events, scaffold a plugin package, understand plugin requirements, or integrate an external system (Discord, Slack, dashboards, logging, metrics) with CAO. Also use when…
agui-author
Author live dashboard UI from an agent via the emitui MCP tool. Emit one of six allow-listed components (approvalcard, choiceprompt, diffsummary, progress, metric, agentcard) with JSON props and it renders in any AG-UI client watching the fleet. Use when you want the operator to see a decision, a diff, or a status…
cao-mcp-apps
Enable, operate, and extend CAO's MCP Apps surface — the host-rendered fleet dashboard visible inside MCP App hosts (Claude Desktop, ChatGPT, VS Code Copilot, Goose, Postman). Use when the user says "enable MCP Apps in CAO", "the ui://cao views aren't rendering", "rebuild MCP Apps bundles", "add a new ui://cao/ view"…