Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Gh Actions Validator · jeremylongshore | DecimalAI

jeremylongshore/gh-actions-validator

SkillScore87Maintained

Validate use when validating GitHub Actions workflows for Google Cloud and Vertex AI deployments. Trigger with phrases like "validate github actions", "setup workload identity federation", "github actions security", "deploy agent with ci/cd", or "automate vertex ai deployment". Enforces Workload Identity Federation (WIF), validates OIDC permissions, ensures least privilege IAM, and implements security best practices.

DevOpsby jeremylongshore

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

DevOps & SRE packdevopsdeploymentgcp

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/jeremylongshore-gh-actions-validator/SKILL.md

decimalai skills pull jeremylongshore-gh-actions-validator --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/jeremylongshore-gh-actions-validator/SKILL.md https://app.decimal.ai/s/jeremylongshore-gh-actions-validator/SKILL.md

Raw file: /s/jeremylongshore-gh-actions-validator/SKILL.md ↗ · machine-readable summary at /s/jeremylongshore-gh-actions-validator.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 6d ago

Yes — +9% lift+17% tokens0% turns87% of whole cases pass with skill (20/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	23%	0%
case-21	✗→✓	▲ Improved	30%	0%
case-04	✓→✓	＝ Same ✓	21%	0%
case-05	✓→✓	＝ Same ✓	33%	0%
case-06	✓→✓	＝ Same ✓	46%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

jeremylongshore / claude-code-plugins-plus-skills

skills/.curated/gh-actions-validator/SKILL.md

View on GitHub ↗

License MITImported 8/25/2026Version v1Bundled 6 files · scripts

Skill contents

scripts/

references/

SKILL.md

Gh Actions Validator

Overview

Validate and harden GitHub Actions workflows that deploy to Google Cloud (especially Vertex AI) using Workload Identity Federation (OIDC) instead of long-lived service account keys. Use this to audit existing workflows, propose a secure replacement, and add CI checks that prevent common credential and permission mistakes.

Prerequisites

Before using this skill, ensure:

GitHub repository with Actions enabled
Google Cloud project with billing enabled
gcloud CLI authenticated with admin permissions
Understanding of Workload Identity Federation concepts
GitHub repository secrets configured
Appropriate IAM roles for CI/CD automation

Instructions

Audit Existing Workflows: Scan .github/workflows/ for security issues
Validate WIF Usage: Ensure no JSON service account keys are used
Check OIDC Permissions: Verify id-token: write is present
Review IAM Roles: Confirm least privilege (no owner/editor roles)
Add Security Scans: Include secret detection and vulnerability scanning
Validate Deployments: Add post-deployment health checks
Configure Monitoring: Set up alerts for deployment failures
Document WIF Setup: Provide one-time WIF configuration commands

Output

uses: actions/checkout@v4
name: Authenticate to GCP (WIF)
name: Deploy to Vertex AI

--project=${{ secrets.GCP_PROJECT_ID }} \ --region=us-central1

name: Validate Deployment

Error Handling

See ${CLAUDE_SKILL_DIR}/references/errors.md for comprehensive error handling.

Examples

See ${CLAUDE_SKILL_DIR}/references/examples.md for detailed examples.

Resources

Workload Identity Federation: https://cloud.google.com/iam/docs/workload-identity-federation
GitHub OIDC: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments
Vertex AI Agent Engine: https://cloud.google.com/vertex-ai/docs/agent-engine
google-github-actions/auth: https://github.com/google-github-actions/auth
WIF setup guide in ${CLAUDE_SKILL_DIR}/docs/wif-setup.md

Want to see if jeremylongshore/gh-actions-validator would activate on your phrasing? Try it before you install — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/30/2026, 10:51 UTC · 23 cases

Lift

+9%

87% vs 78%

Agent turns

1.0 vs 1.0

Tokens

+17%

3,288 vs 2,821.3

fail → pass · 2pass → pass · 18fail → fail · 3

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 I am deploying a Vertex AI model using GitHub Actions, but my current pipeline relies on static service account JSON keys. Could you review my workflow files, check for credential and IAM vulnerabilities, and generate a hardened pipeline configuration that utilizes Google Cloud Workload Identity Federation?	fail→pass	24,415	24,165	-1%	1	1	0%	3,691	4,522	+23%	0	0	—
case-02 Please run a security audit on the GitHub Actions files in our repository that deploy to GCP. We want to identify any insecure authentication practices, verify OIDC token setup, and get an updated, secure workflow snippet for deploying our services.	fail→fail	18,307	15,858	-13%	1	1	0%	3,206	3,615	+13%	0	0	—
case-03 We are setting up CI/CD to deploy our AI services onto Vertex AI in Google Cloud. Can you inspect our workflow setup, verify our authentication approach against cloud security best practices, and provide a secure, hardened GitHub Actions configuration using federated identity?	fail→fail	20,753	24,254	+17%	1	1	0%	3,894	4,468	+15%	0	0	—
case-04 We are setting up GitHub Actions to deploy containerized microservices to Amazon EKS using AWS IAM OIDC identity providers. Can you write a workflow configuration and AWS CLI commands to create the IAM role trust policy for GitHub Actions?	pass→pass	17,488	19,565	+12%	1	1	0%	3,756	4,537	+21%	0	0	—
case-05 We need a Terraform module to provision a Google Kubernetes Engine cluster with private nodes and Workload Identity enabled for Kubernetes service accounts. Can you provide the HCL code for the google_container_cluster resource?	pass→pass	13,369	18,508	+38%	1	1	0%	2,735	3,647	+33%	0	0	—
case-06 Our team uses GitHub Actions to build and deploy a Node.js web application to Azure App Service using publish profiles. Can you update our workflow to use Azure OIDC federation with azure/login?	pass→pass	17,153	20,275	+18%	1	1	0%	2,543	3,707	+46%	0	0	—
case-07 Our repository has a workflow that authenticates to GCP using a GCP_SA_KEY secret containing a raw base64 JSON key string. How should we audit and fix this workflow file to comply with cloud security hardening standards?	pass→pass	19,434	12,719	-35%	1	1	0%	2,957	3,311	+12%	0	0	—
case-08 Our deployment service account currently has roles/owner and roles/editor granted in GCP so that CI/CD runs without permission errors. What IAM permissions and roles should be assigned instead for Vertex AI model deployment?	pass→pass	12,318	12,765	+4%	1	1	0%	2,573	3,404	+32%	0	0	—
case-09 We want to migrate our GitHub Actions pipeline from service account keys to GCP Workload Identity Federation. What terminal commands do we need to execute in gcloud to create the identity pool, provider, and service account binding?	pass→pass	10,072	13,878	+38%	1	1	0%	2,656	2,676	+1%	0	0	—
case-10 We want to ensure our GitHub Actions CI pipeline catches exposed secrets and vulnerable dependencies before deploying machine learning pipelines to Vertex AI. What security scanning steps should be added to our workflow file?	pass→pass	22,630	17,649	-22%	1	1	0%	3,796	3,389	-11%	0	0	—
case-11 After running model deployment commands to Vertex AI within GitHub Actions, how do we verify that the deployed endpoint is active and serving traffic before completing the workflow run?	pass→pass	12,842	12,548	-2%	1	1	0%	3,001	3,502	+17%	0	0	—
case-12 When a Vertex AI deployment fails during a GitHub Actions run, our team needs immediate notification. How should we configure error monitoring and alerting within the workflow setup?	pass→pass	17,976	15,120	-16%	1	1	0%	2,806	2,765	-1%	0	0	—
case-13 When running the GCP authentication action with Workload Identity Federation in GitHub Actions, the workflow fails because it cannot request an OIDC ID token. What setting is missing from the workflow configuration?	pass→pass	9,656	9,612	-0%	1	1	0%	1,007	1,409	+40%	0	0	—
case-14 I need a GitHub Actions workflow snippet that checks out code, authenticates to GCP via federated identity, deploys an AI model to Vertex AI in us-central1 using a project ID secret, and validates the deployment. Can you construct this snippet?	pass→pass	20,245	13,917	-31%	1	1	0%	3,002	2,422	-19%	0	0	—
case-15 During a GitHub Actions run, Workload Identity Federation authentication fails with an HTTP 400 bad request error from the token exchange endpoint. What configuration mismatches in the identity provider attribute mapping typically cause this failure?	pass→pass	20,839	18,835	-10%	1	1	0%	2,453	3,696	+51%	0	0	—
case-16 Review this GitHub Actions setup: roles/resourcemanager.organizationAdmin is assigned to the service account used by GitHub Actions to deploy models to Vertex AI. Is this setup secure, and if not, how should it be restricted?	pass→pass	17,319	19,248	+11%	1	1	0%	2,130	3,142	+48%	0	0	—
case-17 We deploy Vertex AI models across staging and production GCP projects from a single GitHub repository. How should Workload Identity Federation pools and service account bindings be structured to segregate staging and production access?	fail→fail	26,743	25,874	-3%	1	1	0%	3,997	4,691	+17%	0	0	—
case-18 Our GitHub Actions workflow builds a custom Docker image for Vertex AI Training and pushes it to Artifact Registry. Where and how should vulnerability scanning be inserted into the pipeline?	pass→pass	14,866	20,333	+37%	1	1	0%	2,735	3,378	+24%	0	0	—
case-19 Can you provide a step-by-step checklist for auditing an existing .github/workflows/deploy.yml file that deploys to Google Cloud, covering authentication, authorization, scanning, and health checks?	pass→pass	19,735	14,897	-25%	1	1	0%	3,532	3,391	-4%	0	0	—
case-20 When GitHub Actions attempts to exchange the OIDC token with GCP Workload Identity Federation, transient network errors can interrupt the pipeline. What step configuration improves robustness?	pass→pass	16,295	13,903	-15%	1	1	0%	2,734	2,935	+7%	0	0	—
case-21 Which GCP parameters should be stored in GitHub Repository Secrets versus hardcoded in the workflow YAML when configuring Workload Identity Federation for Vertex AI?	fail→pass	20,358	21,376	+5%	1	1	0%	2,660	3,470	+30%	0	0	—
case-22 When auditing a repository for GCP deployment security issues, which directory path should be scanned to find all active GitHub Actions workflow definitions?	pass→pass	9,391	8,143	-13%	1	1	0%	747	738	-1%	0	0	—
case-23 A developer opened a pull request containing a hardcoded service account JSON key in a test script inside .github/workflows/. How can automated CI checks prevent this pull request from merging?	pass→pass	18,442	12,149	-34%	1	1	0%	2,279	2,809	+23%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +9 percentage points is the difference between those two pass rates over the 23 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 78.3%
Pass rate with the skill: 87%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/30/2026, 10:51 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-01

Prompt

I am deploying a Vertex AI model using GitHub Actions, but my current pipeline relies on static service account JSON keys. Could you review my workflow files, check for credential and IAM vulnerabilities, and generate a hardened pipeline configuration that utilizes Google Cloud Workload Identity Federation?

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run87

Live evalNeeds ≥20 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+16% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 5 days ago

Other measured skills in the registry, with their headline benchmark lift.