Workflow Skill Extractor: Top 3 Shared-Component Opportunities

[github-actions[bot]]

Method

Analyzed /tmp/gh-aw/agent/workflow-index.json (286 workflows) plus targeted regex scans of .github/workflows/*.md (excluding .lock.yml), cross-checked against 89 existing shared components in .github/workflows/shared/.

Coverage summary

• 286 workflows indexed; 76 declare an engine: block, 12 have zero imports:.
• Most-used existing imports: shared/otlp.md (239), shared/reporting.md (169), shared/mcp-pagination.md (18), shared/github-guard-policy.md (18), shared/gh.md (15, already covers tools.github.mode: gh-proxy).
• Frontmatter line-frequency scan surfaced several exact, byte-for-byte repeated blocks that are not yet backed by a shared import.

Opportunities identified (priority order)

1. network: allowed: [defaults] block — Priority: High

• Usage: 134 workflows contain the exact block:

  network:
    allowed:
      - defaults

  e.g. ab-testing-advisor.md:16-18, layout-spec-maintainer.md, org-health-report.md, copilot-opt.md, firewall.md, instructions-janitor.md, workflow-normalizer.md, spec-enforcer.md, step-name-alignment.md.
• Proposed shared component: shared/network-defaults.md
• Impact: 134 workflows, ~3 lines each (~400 lines), single point of change if the network egress policy ever needs a global tweak (e.g. adding an extra always-allowed domain).
• Migration: (1) create shared/network-defaults.md with the network.allowed: [defaults] block; (2) replace the inline block with imports: [shared/network-defaults.md] in each workflow (scripted sed/codemod is feasible since the block is byte-identical); (3) gh aw compile all workflows and diff .lock.yml to confirm no behavior change.
• Example:

  imports:
    - shared/network-defaults.md

2. Copilot-engine safety baseline (engine.copilot-sdk + max-tool-denials + max-daily-ai-credits) — Priority: High

• Usage: 69 workflows use engine: {id: copilot, copilot-sdk: true}; 63 use max-tool-denials: 3; 74 use max-daily-ai-credits: 10000; 24 workflows use all three together verbatim (e.g. copilot-opt.md:7,14-15, breaking-change-checker.md, craft.md, daily-compiler-quality.md, code-scanning-fixer.md, cli-consistency-checker.md, artifacts-summary.md).
• Proposed shared component: shared/copilot-engine-baseline.md
• Impact: Direct savings for the 24 workflows sharing the exact triple (~5 lines each, ~120 lines), plus a documented convention the other ~45-50 workflows using a subset could adopt. Primary benefit is maintenance: a single place to bump the default credit ceiling or denial threshold repo-wide instead of 24+ separate edits.
• Migration: (1) create the shared file bundling engine.id: copilot, engine.copilot-sdk: true, max-tool-denials: 3, max-daily-ai-credits: 10000; (2) migrate the 24 exact-match workflows first (lowest risk, no value overrides needed); (3) recompile and verify .lock.yml diffs are no-ops; (4) evaluate the remaining partial-match workflows in a follow-up pass since some override individual values.
• Example:

  imports:
    - shared/copilot-engine-baseline.md

3. cli-proxy: true + github.mode: gh-proxy tool pairing — Priority: Medium

• Usage: 206 workflows set tools.cli-proxy: true; 155 set tools.github.mode: gh-proxy; 122 workflows have both directly adjacent (e.g. ci-coach.md:21,23). shared/gh.md already exists but only sets github.mode: gh-proxy alone (15 current consumers) — it does not bundle cli-proxy: true, so the two are still being duplicated together in 122 files.
• Proposed shared component: extend/pair via shared/gh-cli-proxy.md (or extend shared/gh.md to add cli-proxy: true, if that's judged safe for all 15 existing consumers).
• Impact: ~122 workflows, ~2-3 lines each (~300 lines). Medium priority because it requires checking whether all 15 current shared/gh.md consumers are fine with cli-proxy: true added, or whether a net-new file is safer to avoid changing existing behavior.
• Migration: (1) confirm with shared/gh.md consumers whether cli-proxy: true is compatible; (2) create shared/gh-cli-proxy.md (new, safest option) bundling both settings; (3) migrate the 122 workflows using both settings adjacently; (4) recompile and diff lock files.
• Example:

  imports:
    - shared/gh-cli-proxy.md

Impact summary

Recommendation	Workflows affected	Approx. line savings	Priority
network: allowed: [defaults] shared import	134	~400	High
Copilot engine safety baseline	24 (exact) / ~74 (partial)	~120+	High
cli-proxy + gh-proxy mode pairing	122	~300	Medium

Notes

• Existing shared components already cover other frequent patterns well (shared/otlp.md, shared/reporting.md, shared/mcp-pagination.md, shared/github-guard-policy.md, shared/gh.md) and were excluded from these recommendations to avoid duplicate proposals.
• Workflow files were analyzed read-only; no .md or .lock.yml files were modified.
• Three issues have been filed for these recommendations (see linked issues below).

Generated by 🔍 Workflow Skill Extractor · auto · 86 AIC · ⌖ 5.54 AIC · ⊞ 7.4K · ◷

• expires on Aug 26, 2026, 8:01 PM UTC-08:00