opencode-skills-collection 4.0.53 → 4.0.55

package/bundled-skills/github-actions-templates/SKILL.md

@@ -6,348 +6,68 @@ source: community
 date_added: "2026-02-27"
 ---
 
-# GitHub Actions Templates
+# GitHub Actions Workflow Patterns
 
-Production-ready GitHub Actions workflow patterns for testing, building, and deploying applications.
+## When to Use
 
-## Do not use this skill when
+Implement testing, matrix builds, artifact preparation or an explicitly authorized deployment workflow for an existing repository.
 
-- The task is unrelated to github actions templates
-- You need a different domain or tool outside this scope
+## Inputs
 
-## Instructions
+Inspect the repository's actual scripts, lockfile, supported runtimes, required check names and release policy. Read `resources/implementation-playbook.md` and `references/common-workflows.md` before choosing job boundaries.
 
-- Clarify goals, constraints, and required inputs.
-- Apply relevant best practices and validate outcomes.
-- Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
+## Test Workflow
 
-## Purpose
-
-Create efficient, secure GitHub Actions workflows for continuous integration and deployment across various tech stacks.
-
-## Use this skill when
-
-- Automate testing and deployment
-- Build Docker images and push to registries
-- Deploy to Kubernetes clusters
-- Run security scans
-- Implement matrix builds for multiple environments
-
-## Common Workflow Patterns
-
-### Pattern 1: Test Workflow
+This Node example assumes the target repository declares `npm test` and supports Node 22. Adapt the runtime and command to the actual project. The pinned action revisions are explicit review inputs; verify them before adopting or updating the template.
 
 ```yaml
 name: Test
-
 on:
-  push:
-    branches: [ main, develop ]
   pull_request:
-    branches: [ main ]
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        node-version: [18.x, 20.x]
-
-    steps:
-    - uses: actions/checkout@v4
-
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v4
-      with:
-        node-version: ${{ matrix.node-version }}
-        cache: 'npm'
-
-    - name: Install dependencies
-      run: npm ci
-
-    - name: Run linter
-      run: npm run lint
-
-    - name: Run tests
-      run: npm test
-
-    - name: Upload coverage
-      uses: codecov/codecov-action@v3
-      with:
-        files: ./coverage/lcov.info
-```
-
-**Reference:** See `assets/test-workflow.yml`
-
-### Pattern 2: Build and Push Docker Image
-
-```yaml
-name: Build and Push
-
-on:
   push:
-    branches: [ main ]
-    tags: [ 'v*' ]
-
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-    - uses: actions/checkout@v4
-
-    - name: Log in to Container Registry
-      uses: docker/login-action@v3
-      with:
-        registry: ${{ env.REGISTRY }}
-        username: ${{ github.actor }}
-        password: ${{ secrets.GITHUB_TOKEN }}
-
-    - name: Extract metadata
-      id: meta
-      uses: docker/metadata-action@v5
-      with:
-        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-        tags: |
-          type=ref,event=branch
-          type=ref,event=pr
-          type=semver,pattern={{version}}
-          type=semver,pattern={{major}}.{{minor}}
-
-    - name: Build and push
-      uses: docker/build-push-action@v5
-      with:
-        context: .
-        push: true
-        tags: ${{ steps.meta.outputs.tags }}
-        labels: ${{ steps.meta.outputs.labels }}
-        cache-from: type=gha
-        cache-to: type=gha,mode=max
-```
-
-**Reference:** See `assets/deploy-workflow.yml`
-
-### Pattern 3: Deploy to Kubernetes
-
-```yaml
-name: Deploy to Kubernetes
-
-on:
-  push:
-    branches: [ main ]
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@v4
-
-    - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@v4
-      with:
-        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-        aws-region: us-west-2
-
-    - name: Update kubeconfig
-      run: |
-        aws eks update-kubeconfig --name production-cluster --region us-west-2
-
-    - name: Deploy to Kubernetes
-      run: |
-        kubectl apply -f k8s/
-        kubectl rollout status deployment/my-app -n production
-        kubectl get services -n production
-
-    - name: Verify deployment
-      run: |
-        kubectl get pods -n production
-        kubectl describe deployment my-app -n production
-```
-
-### Pattern 4: Matrix Build
-
-```yaml
-name: Matrix Build
-
-on: [push, pull_request]
-
-jobs:
-  build:
-    runs-on: ${{ matrix.os }}
-
-    strategy:
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-        python-version: ['3.9', '3.10', '3.11', '3.12']
-
-    steps:
-    - uses: actions/checkout@v4
-
-    - name: Set up Python
-      uses: actions/setup-python@v5
-      with:
-        python-version: ${{ matrix.python-version }}
-
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install -r requirements.txt
-
-    - name: Run tests
-      run: pytest
-```
-
-**Reference:** See `assets/matrix-build.yml`
-
-## Workflow Best Practices
-
-1. **Use specific action versions** (@v4, not @latest)
-2. **Cache dependencies** to speed up builds
-3. **Use secrets** for sensitive data
-4. **Implement status checks** on PRs
-5. **Use matrix builds** for multi-version testing
-6. **Set appropriate permissions**
-7. **Use reusable workflows** for common patterns
-8. **Implement approval gates** for production
-9. **Add notification steps** for failures
-10. **Use self-hosted runners** for sensitive workloads
-
-## Reusable Workflows
-
-```yaml
-# .github/workflows/reusable-test.yml
-name: Reusable Test Workflow
-
-on:
-  workflow_call:
-    inputs:
-      node-version:
-        required: true
-        type: string
-    secrets:
-      NPM_TOKEN:
-        required: true
-
+    branches: [main]
+permissions:
+  contents: read
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-node@v4
-      with:
-        node-version: ${{ inputs.node-version }}
-    - run: npm ci
-    - run: npm test
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
+        with:
+          node-version: '22'
+          cache: npm
+      - run: npm ci
+      - run: npm test
 ```
 
-**Use reusable workflow:**
-```yaml
-jobs:
-  call-test:
-    uses: ./.github/workflows/reusable-test.yml
-    with:
-      node-version: '20.x'
-    secrets:
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-```
+## Matrix Builds
 
-## Security Scanning
+Add a matrix only for versions and operating systems the project supports. Keep dependencies reproducible, identify failing combinations, and avoid hiding failures with blanket continue-on-error. Test required-check behavior when jobs are conditionally skipped.
 
-```yaml
-name: Security Scan
+## Build and Publication
 
-on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
+Build an artifact from the tested commit and record its identity. Publication needs a separate trusted job with the minimum registry permission. Do not publish artifacts produced by arbitrary untrusted code in a privileged context; bind accepted artifacts to their exact source and producing workflow.
 
-jobs:
-  security:
-    runs-on: ubuntu-latest
+## Deployment
 
-    steps:
-    - uses: actions/checkout@v4
-
-    - name: Run Trivy vulnerability scanner
-      uses: aquasecurity/trivy-action@master
-      with:
-        scan-type: 'fs'
-        scan-ref: '.'
-        format: 'sarif'
-        output: 'trivy-results.sarif'
+Use the project's protected release path. Identify the immutable artifact, destination, workload identity, rollout and rollback checks before adding deployment commands. A named GitHub environment does not configure reviewers automatically. Verify its actual protections. Do not label a placeholder echo command as a successful deployment.
 
-    - name: Upload Trivy results to GitHub Security
-      uses: github/codeql-action/upload-sarif@v2
-      with:
-        sarif_file: 'trivy-results.sarif'
+## Verification
 
-    - name: Run Snyk Security Scan
-      uses: snyk/actions/node@master
-      env:
-        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-```
+Exercise one passing change and one deliberate test failure on a topic branch. Confirm the failing check prevents downstream publication. Inspect tokens, runner isolation, caches and artifact boundaries. Keep production credentials absent from untrusted validation jobs.
 
-## Deployment with Approvals
+## Example
 
-```yaml
-name: Deploy to Production
+A project needs Linux and Windows tests. Select its supported runtime, add the two runner combinations and confirm that either failure blocks the required result. Prepare publication separately; do not add registry credentials to the matrix.
 
-on:
-  push:
-    tags: [ 'v*' ]
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    environment:
-      name: production
-      url: https://app.example.com
-
-    steps:
-    - uses: actions/checkout@v4
-
-    - name: Deploy application
-      run: |
-        echo "Deploying to production..."
-        # Deployment commands here
-
-    - name: Notify Slack
-      if: success()
-      uses: slackapi/slack-github-action@v1
-      with:
-        webhook-url: ${{ secrets.SLACK_WEBHOOK }}
-        payload: |
-          {
-            "text": "Deployment to production completed successfully!"
-          }
-```
-
-## Reference Files
-
-- `assets/test-workflow.yml` - Testing workflow template
-- `assets/deploy-workflow.yml` - Deployment workflow template
-- `assets/matrix-build.yml` - Matrix build template
-- `references/common-workflows.md` - Common workflow patterns
+## Limitations
 
-## Related Skills
+This skill supplies patterns, not an installed deployment program. Repository policy, runner trust and environment settings must be inspected. Review every third-party action at its full commit SHA and treat logs and uploaded artifacts as possible data-exposure paths.
 
-- `gitlab-ci-patterns` - For GitLab CI workflows
-- `deployment-pipeline-design` - For pipeline architecture
-- `secrets-management` - For secrets handling
+## Sources
 
-## Limitations
-- Use this skill only when the task clearly matches the scope described above.
-- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
-- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
+- [GitHub secure workflow guidance](https://docs.github.com/en/actions/reference/security/secure-use)

package/bundled-skills/github-actions-templates/references/common-workflows.md

@@ -0,0 +1,13 @@
+# Choosing a workflow boundary
+
+## Inputs
+
+Inspect the target repository scripts, runtime support, protected branches and artifact publication policy.
+
+## Procedure and verification
+
+Use unprivileged pull-request jobs for tests and builds. Put publication in a separate trusted path with its own credentials and explicit protected environment where required. Bind the artifact to the tested commit and reject missing or mismatched provenance. Check that a failing test prevents the publishing job from running.
+
+## Limitations
+
+A template must be adapted to actual commands. Do not give fork code production secrets, persistent runner access or a write token. See the inline workflow patterns in the skill for the starting structure.

package/bundled-skills/github-actions-templates/resources/implementation-playbook.md

@@ -0,0 +1,23 @@
+# Workflow implementation playbook
+
+## Inputs
+
+Existing workflow files, supported runtime matrix, repository scripts, branch protection and deployment policy.
+
+## Procedure
+
+1. Choose separate jobs for untrusted source validation and privileged publication. Keep validation credentials absent and permissions minimal.
+2. Use reviewed immutable action revisions. Match commands to scripts that actually exist; bind artifacts to the tested commit and review any downloaded artifact before privileged use.
+3. Test a source-only change and a failing test on a topic branch. Confirm failure blocks downstream publication and required check names remain stable.
+
+## Worked example
+
+A pull request changes application code. Its test job runs without production credentials; deployment consumes only an accepted, tested artifact through the project's protected release path.
+
+## Verification and handoff
+
+Report the actual files or configuration changed, checks performed, observed results and any untested environment. Keep the original inputs and evidence sufficient to reproduce the conclusion.
+
+## Limitations
+
+A workflow file cannot configure required reviewers by itself. Never execute pull-request code in a privileged target-triggered job.

package/bundled-skills/github-automation/SKILL.md

@@ -86,6 +86,12 @@ Do not approve fork workflow runs by raw run ID when the repository provides a g
 - Never bypass required checks, reviews, merge queues, maintainer commands, or server-side branch protection.
 - Do not claim a merge, workflow, deployment, or permission change succeeded without reading the resulting remote state.
 
+## Example
+
+**User request:**
+
+> Operate GitHub issues, pull requests, branches, checks, workflows, and permissions through Rube MCP.
+
 ## Limitations
 
 - Available Rube tool names and schemas can change; discover them at runtime.