Workflow skill/component extraction analysis: top 3 shared-component opportunities

[github-actions[bot]]

Method

Analyzed /tmp/gh-aw/agent/workflow-index.json covering all 294 workflows in .github/workflows/, cross-referencing imports: frequency, frontmatter_preview text, engine distribution, and existing shared components in .github/workflows/shared/ (93 files already extracted, e.g. shared/otlp.md used by 241 workflows, shared/reporting.md by 172). Validated top candidates with targeted grep/Python extraction against the full workflow set to get exact file counts and sample duplication blocks, then confirmed no equivalent shared component already exists for each pattern.

Coverage

• 294 workflows total; 93 existing shared components already cover common needs (OTLP observability, reporting format, MCP pagination, github guard policy, etc.)
• Focused this pass on frontmatter-level (not prompt-body) duplication that has not yet been extracted, since prompt-skill duplication is already well covered by the existing shared/ library.

Opportunities identified (by priority)

1. High — Copilot-SDK engine + tool-denial + credit-cap defaults (Issue created)

engine: {id: copilot, copilot-sdk: true} + max-tool-denials: 3 repeated verbatim across 55-61 workflows; max-daily-ai-credits: 10000 set independently in 74 workflows. No shared component exists despite shared/default-ai-credits-pricing.md already centralizing a related concern (model pricing fallback). Proposed: shared/copilot-sdk-engine-defaults.md.

2. High — Sandbox runtime profile centralization (Issue created)

231 of 294 workflows (79%) declare a sandbox: block; these cluster into ~7 discrete shapes (runtime: cloud-hypervisor alone: 59; id: awf alone: 57; runtime: gvisor alone: 33; cloud-hypervisor + id: awf: 28; id: awf + docker-sbx: 22; docker-sbx alone: 13; id: awf + cloud-hypervisor: 10), covering 222+ workflows. Centralizing these as named profiles under shared/sandbox/ would let the team manage sandbox/runtime security posture from a handful of files instead of 220+. Proposed: shared/sandbox/{gvisor,cloud-hypervisor,docker-sbx,...}.md.

3. High — cli-proxy + gh-proxy tools baseline (Issue created)

139 workflows (47%) set the identical tools.cli-proxy: true + tools.github.mode: gh-proxy combination (157 use mode: gh-proxy overall; 206 use cli-proxy: true). This is boilerplate for the standard "safe GitHub read access via CLI proxy" tool baseline. Proposed: shared/gh-proxy-tools-base.md, pending verification of gh-aw's nested-object merge semantics for tools.github.

Impact summary

Recommendation	Workflows affected	Est. line savings	Priority
Copilot-SDK engine defaults	55–74	~220 lines	High
Sandbox runtime profiles	222+	~660 lines	High
cli-proxy / gh-proxy tools baseline	139	~550 lines	High

Combined, these three extractions touch a large majority of the fleet's non-prompt frontmatter boilerplate and would meaningfully reduce the blast radius of future policy changes (credit caps, sandbox hardening, proxy access control) from "edit N files" to "edit 1-3 shared files."

References

• Issue: Extract shared component for copilot-sdk engine + tool-denial + credit-cap defaults (55+ workflows duplicate this block)
• Issue: Centralize repeated sandbox runtime profiles into shared imports (231 workflows set sandbox:, clustering into ~7 shapes)
• Issue: Centralize cli-proxy + gh-proxy tools baseline shared by 139 workflows

(Issue numbers will be assigned once the safe-output write transactions are applied.)

Generated by 🔍 Workflow Skill Extractor · copilot · auto · 92.2 AIC · ⌖ 6.17 AIC · ⊞ 7.5K · ◷

• expires on Sep 2, 2026, 9:36 PM UTC-08:00