Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add roedyrustam/vibes-plug --skill github-actions-expertgit clone --depth 1 https://github.com/roedyrustam/vibes-plugWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/roedyrustam/vibes-plug/github-actions-expert)<a href="https://agentmods.dev/skills/roedyrustam/vibes-plug/github-actions-expert"><img src="https://agentmods.dev/badge/skills/roedyrustam/vibes-plug/github-actions-expert/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/roedyrustam/vibes-plug/github-actions-expert"><img src="https://agentmods.dev/badge/skills/roedyrustam/vibes-plug/github-actions-expert.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00071 | $0.02897 |
| Opus 5.5 | $0.00028 | $0.01159 |
| Sonnet 5.5 | $0.00014 | $0.00579 |
| Haiku 4.5 | $0.00007 | $0.00290 |
Grade A, and why
github-actions-expert scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 258 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GitHub Actions Expert (Enterprise CI/CD Standard 2026)
English
Orchestration & Integration
Connects with: brainstorming, zero-to-prod-orchestrator, ci-cd-devops-architect, e2e-testing-expert, autonomous-tdd-debugger, production-ready-hardener, anti-slop, zero-trust-secret-vault, cloud-hosting-expert, session-memory-manager.
Description
Enterprise-grade guide for engineering hardened, high-performance Continuous Integration & Continuous Delivery (CI/CD) pipelines on GitHub Actions. Covers deterministic dependency caching (pnpm/bun/uv/cargo), reusable workflows (workflow_call), composite actions (using: 'composite'), dynamic multi-platform matrix builds, OpenID Connect (OIDC) cloud federation for AWS/GCP/Azure with zero long-lived credentials, immutable action pinning by commit SHA, fine-grained GITHUB_TOKEN permissions, concurrency control, artifact attestation, and npm/OCI provenance publishing.
Trigger Conditions
- Designing, scaffolding, or modernizing
.github/workflows/pipelines. - Implementing automated PR verification: linting, type-checking, unit tests, and E2E gates.
- Setting up reusable workflows (
workflow_call) or modular composite actions. - Hardening CI/CD security: replacing long-lived tokens with OIDC federation.
- Pinning third-party GitHub Actions to immutable full commit SHAs.
- Configuring concurrency groups with
cancel-in-progress: trueto prevent queue bloat. - Generating build provenance and software bills of materials (SBOM).
- Automating multi-platform release builds, semantic versioning, and package publishing.
What's New in 2026 (Modern GitHub Actions Standard)
1. Security & Governance First
- Zero Static Credentials: All cloud deployments must use OpenID Connect (OIDC) federated role assumption via
permissions: id-token: write. - Full SHA Action Pinning: Never use
@v4or@maintags in production workflows. Pin exact 40-character commit SHAs with inline human-readable comments (e.g.actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2). - Least-Privilege Token Permissions: Workflows must declare top-level
permissions: {}(deny all) and elevate only specific job scopes (contents: read,pull-requests: write, etc.). - Software Supply Chain Provenance: Automated SLSA Level 3 attestations using
actions/attest-build-provenance.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed 50a24dabb8c1
- yesterday First seen · 258 lines · 71 tokens per session scan A 79d4a6722b2f
github-actions-expert is a skill published in the GitHub repository roedyrustam/vibes-plug (108 stars, last pushed today), licensed MIT. It adds 71 tokens to every session and 2,897 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-20.
Other skills, from other repositories
argocd
Expert Argo CD GitOps assistance covering Application CRDs, sync policies, automated self-healing, Helm/Kustomize, and multi-cluster deployments. Use when managing Kubernetes deployments via GitOps.
github-actions
Expert GitHub Actions assistance covering workflow syntax, matrices, composite actions, caching, environments, and OIDC AWS/GCP auth. Use when building robust CI/CD automation pipelines.
gitlab-ci
Expert GitLab CI/CD assistance covering .gitlab-ci.yml, stages, artifacts, caching, GitLab Runners, and Auto DevOps. Use when configuring continuous integration and deployment pipelines on GitLab.
git-workflow-and-versioning
Structures git workflow practices. Use when making any code change. Use when committing, branching, resolving conflicts, splitting uncommitted work in a messy working tree into clean atomic commits, opening or reviewing a pull request (PR), pushing to a remote, or when you need to organize work across multiple…
ci-cd-and-automation
Automates CI/CD pipeline setup. Use when setting up or modifying build and deployment pipelines. Use when you need to automate quality gates, configure test runners in CI, or establish deployment strategies.
chinese-git-workflow
A reference for configuring Git with Chinese code-hosting services such as Gitee, Coding.net, GitLab China, and CNB, including SSH, HTTPS, credentials, CI, and repository mirroring.