Source: wshobson/agents · Maintainer: community: Seth Hobson · License: MIT · Checked: 24 October 2026
What is the GitHub Actions skill?
The github-actions-templates skill gives a coding agent a set of GitHub Actions workflow patterns it can adapt to your project: a test workflow, a Docker build and push, a Kubernetes deploy, a matrix build, reusable workflows, security scanning and a production deploy behind an environment. It is for developers who ask Claude Code, Codex or Cursor to write CI/CD and want a known-good starting shape instead of YAML written from memory.
It belongs to the cicd-automation plugin in wshobson/agents, Seth Hobson's catalog of plugins, agents and skills for several coding tools. The skill's description reads: "Create production-ready GitHub Actions workflows for automated testing, building, and deploying applications. Use when setting up CI/CD with GitHub Actions, automating development workflows, or creating reusable workflow templates."
As of 24 October 2026, its skills.sh page listed 17.4K installs (snapshot, 24 October 2026).
What does it do?
The skill is model-invoked. The agent loads it when you ask for CI/CD on GitHub, a workflow that builds and pushes a container, a Kubernetes deploy, a security scan or a matrix build across versions.
The folder is a single SKILL.md with no scripts or reference files. Most of it is YAML:
| Pattern | What the template does |
|---|---|
| Test workflow | Runs on push and pull request, Node.js version matrix, npm ci, lint, test, uploads coverage to Codecov |
| Build and push Docker image | Logs in to ghcr.io with GITHUB_TOKEN, tags with docker/metadata-action, builds with GitHub Actions cache |
| Deploy to Kubernetes | Configures AWS credentials, updates kubeconfig for EKS, runs kubectl apply and waits on the rollout |
| Matrix build | Ubuntu, macOS and Windows across four Python versions, then pytest |
| Reusable workflow | A workflow_call workflow with inputs and secrets, plus the caller job |
| Security scan | Trivy filesystem scan uploaded as SARIF to GitHub code scanning, plus a Snyk scan |
| Deploy with approvals | Tag-triggered deploy to a production environment with a Slack notification on success |
It closes with ten best practices: pin action versions instead of @latest, cache dependencies, use secrets, add status checks on pull requests, use matrix builds, set permissions, reuse workflows, add approval gates for production, notify on failure, and use self-hosted runners for sensitive workloads. It points to related skills in the same plugin: gitlab-ci-patterns, deployment-pipeline-design and secrets-management.
How do you install it?
The repo README documents a skills-only route and plugin routes. Choose one per tool.
Just this skill. The skills.sh command, using the skills CLI:
npx skills add https://github.com/wshobson/agents --skill github-actions-templates
Or GitHub CLI 2.90 or later, as listed in the README:
gh skill install wshobson/agents github-actions-templates
These copy only the skill, under its bare name: .claude/skills/github-actions-templates/ in a project, or ~/.claude/skills/github-actions-templates/ for all projects, per the Claude Code skills docs. Codex and Cursor read the same SKILL.md format; see Codex skills and Cursor skills.
The cicd-automation plugin in Claude Code. Inside a session:
/plugin marketplace add wshobson/agents
/plugin install cicd-automation@claude-code-workflows
The plugin adds four skills (deployment-pipeline-design, github-actions-templates, gitlab-ci-patterns, secrets-management), five agents such as deployment-engineer and devops-troubleshooter, and a workflow-automate command. The skill then runs as /cicd-automation:github-actions-templates.
Codex plugin.
codex plugin marketplace add wshobson/agents
codex plugin add cicd-automation@claude-code-workflows
claude.ai. Under the MIT License you can zip the folder and upload it in Customize > Skills, following Anthropic's skills help article.
How do you use it?
Tell the agent your stack, your registry and where you deploy. The templates assume Node.js, Python, GHCR and AWS EKS, so anything different should be in the prompt.
Example prompts (suggestions, not quotes from the repo):
Add a CI workflow for this pnpm monorepo: lint and test on pull requests to main, Node 22 and 24, cache the store.Write a workflow that builds our Dockerfile and pushes to ghcr.io on every tag, with semver tags and layer caching.Turn our three copy-pasted test jobs into one reusable workflow and call it from each repo's CI.Add a Trivy scan that uploads SARIF to code scanning and fails the build on critical findings.Create a production deploy that only runs on v* tags and uses the production environment so it waits for approval.
Requirements: a GitHub repository with Actions enabled. Individual patterns need their own secrets, such as SNYK_TOKEN, SLACK_WEBHOOK or AWS credentials, and the Kubernetes pattern assumes an existing EKS cluster.
What should you update before using the templates?
Some pinned versions in the templates are behind. Check these before you commit a generated workflow:
- Action versions. The templates use
actions/checkout@v4,actions/setup-node@v4,docker/build-push-action@v5andaquasecurity/trivy-action@0.28.0. On 24 October 2026 the latest releases were checkout v7.0.1, setup-node v7.1.0, build-push-action v7.4.0 and trivy-action v0.36.0. Ask the agent to look up each action's current major version. - Runtime versions. The test matrix uses Node.js 18.x and 20.x. Both have reached end of life according to the Node.js release schedule (18 on 30 April 2025, 20 on 30 April 2026). The Python matrix includes 3.9 and 3.10, which the Python devguide lists as end of life (3.10 since 1 October 2026).
- Pinning. The skill's advice is to pin a version tag. GitHub's secure use reference recommends workflow dependency lockfiles where you can adopt them, and otherwise pinning actions to a full-length commit SHA.
- Cloud credentials. The Kubernetes pattern stores AWS access keys as repository secrets. GitHub documents OpenID Connect as a way to request short-lived cloud tokens instead of long-lived secrets.
- Approvals live in settings. The deploy pattern names a
productionenvironment, but the wait for approval comes from deployment protection rules such as required reviewers, which you set in the repository.
Tips and limits
- It writes YAML, nothing else. The skill runs no scripts. Your workflows run only after you commit them.
- GitLab is separate. For GitLab CI, the same plugin has
gitlab-ci-patterns. - Security audits. On 24 October 2026 the skills.sh page showed Pass from Gen Agent Trust Hub, Socket and Snyk.
- License. MIT, from the repo's LICENSE (copyright 2024 Seth Hobson).
- Want Claude inside your workflows? That is a different tool. See Claude Code GitHub Actions for
@claudementions on issues and pull requests.
Save it in your Kipt library
In Kipt, open Skills and paste the skill's GitHub folder link into the import box. Kipt saves the SKILL.md as Markdown in your own private GitHub repo. The copy lives in your own repo, so you can update its action versions there. Everything in your library installs into Claude Code or Codex with npx skills add https://github.com/<you>/<repo>.git --all -g. Kipt is not affiliated with Seth Hobson or wshobson/agents.
Similar skills
- Claude Code GitHub Actions: run Claude in your workflows to answer
@claudementions and review pull requests. - Kubernetes manifest generator skill: writes the manifests your deploy workflow applies.
- Docker skill: multi-stage Dockerfiles for the image your build job pushes.
- Terraform skill: HashiCorp's style guide skill for the infrastructure your pipeline deploys to.