Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →toddkasper/github-actions
Authoring, maintaining, and securing GitHub Actions — CI/CD workflows, triggers, matrix builds, contexts and expressions, reusable and composite workflows, custom actions (action.yml; JS/Docker/composite), self-hosted and GitHub-hosted runners, secrets and OIDC cloud auth, and enterprise governance.
Passed 22 of 22 test cases with the skill, and 17 of 22 without it.
and 3 more in the full report
5 fixed17 passed either way0 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
A platform team is architecting a multi-layered template library using GitHub Actions reusable workflows where workflows call other reusable workflows. What is the maximum allowed nesting depth for reusable workflows, and what is the limit on unique reusable workflows referenced in a single call tree?
| Checked | Without skill | With skill |
|---|---|---|
| States that the reusable workflow nesting limit is 10 levels deep. | Missed | Passed |
| States that a single workflow file can reference at most 50 unique reusable workflows. | Missed | Passed |
The instructions your model reads when the skill loads.
This file is an operational playbook, not an exam outline. Each section states the rules an agent must apply when building or reviewing Actions automation: syntax constraints, security invariants, decision criteria, and anti-patterns to catch in review. Benchmarked against the GitHub Actions (GH-200) certification blueprint.
Load this skill when… authoring or reviewing GitHub Actions workflow YAML; designing reusable workflows, composite actions, or custom JS/Docker actions; configuring self-hosted runners, OIDC cloud auth, or enterprise runner/policy governance; or hardening an Actions pipeline against script-injection and supply-chain risks. Not this skill: general Git/GitHub repository administration, branch protection without Actions, or application code in the repository.
Study resources, domain weights, and credential logistics: references/study-resources.md.
Verify steps assume nothing about your tooling — use your project's MCP/automation, the GitHub CLI (
gh) and Actions log/act/workflow-lint, or the GitHub web UI, in that order of preference.
ubuntu-latest, windows-latest, macos-latest image mappings change on a rolling basis) [volatile — verify live], action SHA pins for commonly-used actions (e.g., actions/checkout, actions/setup-node) [volatile — verify live], free-tier minute allotments and per-minute pricing for larger runners [volatile — verify live], reusable workflow nesting limit (currently 10 levels — caller + up to 9 nested workflows) [volatile — verify live], artifact retention defaults and per-repo cache quota [volatile — verify live].[volatile — verify live] (changes with platform updates) or [opinion — house style] (a defensible default, not the only valid choice).Every workflow starts with on:. Pick the narrowest trigger that fits.
| Pattern | Trigger |
|---|---|
| Push/PR to specific branches | push: branches: / pull_request: branches: |
| Manual with inputs | workflow_dispatch: inputs: |
| Called by another workflow | workflow_call: inputs: secrets: |
| Schedule (cron) | schedule: cron: |
| Webhook event (e.g. issue labeled) | on: issues: types: [labeled] |
| After another workflow completes | workflow_run: workflows: types: [completed] |
workflow_dispatch inputs have types: string, boolean, choice, environment, number. Always declare required and default. Pass inputs into a called workflow via with: (for inputs) and secrets: inherit or explicit mapping (for secrets).
test cases passed, vs 17 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.