Github Actions Architect

The problem

Standard CI/CD templates often use broad write permissions and unpinned third-party actions, creating significant supply chain vulnerabilities. Most pipelines also waste money and time by rebuilding dependencies from scratch on every commit.

What it does

• Generates hardened YAML workflows using explicit least-privilege permissions and SHA-pinned actions.
• Implements intelligent caching and concurrency controls to reduce runner minutes and build times.
• Configures secure cloud authentication using OIDC instead of long-lived, high-risk secrets.
• Automates environment-specific deployments with gated approvals and path-based triggers for monorepos.

Frameworks & tools

GitHub Actions, OIDC (AWS, GCP, Azure), actionlint, YAML, and ecosystem-specific caching (Node.js, Python, Go, Rust).

Why this beats prompting it yourself

General LLMs often overlook critical security practices like SHA-pinning or the risks of pull_request_target. This skill enforces a hard requirement for security defaults and cost-saving job topology that standard prompts miss.

Use cases

• Setting up a secure PR validation pipeline with parallel testing and linting.
• Automating package releases to npm or PyPI with provenance and granular permissions.
• Deploying to cloud providers using Workload Identity Federation instead of static keys.
• Managing complex monorepo builds that only trigger jobs for modified packages.

Known limitations

Does not support self-hosted runner configuration or Enterprise Server-specific features like Runner Groups unless specified.