Workflow Skill Extraction Report: shared-component opportunities across .github/workflows/

[github-actions[bot]]

Overview

Analyzed all 298 workflows in .github/workflows/ using the pre-generated workflow-index.json (file, path, imports, engine, tool/safe-output flags, frontmatter preview) plus targeted deep-dives via grep/python3 frontmatter parsing to find exact and near-exact duplicated configuration blocks not already factored into .github/workflows/shared/.

Method

1. Loaded workflow-index.json and computed import frequency, engine distribution, and tool/safe-output usage across all 298 workflows.
2. Cross-referenced the 89 existing files in shared/ to exclude patterns already extracted (e.g. otlp.md used 240x, reporting.md used 173x, daily-issue-base.md/daily-pr-base.md already exist but are under-adopted).
3. Parsed frontmatter blocks (permissions:, network:, tools:, engine:) across all workflow files to find exact-match duplicated blocks, ranked by occurrence count.
4. Verified sample workflows manually to confirm proposed shared components are drop-in compatible with current merge semantics (permissions: is validation-only; network.allowed unions across imports).

Opportunities identified (by priority)

High — #1: shared/read-permissions.md (new component)
63 of 298 workflows (~21%) declare the identical contents: read / issues: read / pull-requests: read permissions block inline. Since imported permissions: is validation-only under current merge rules, this is a safe, mechanical extraction. Est. ~189 lines saved.

High — #2: Broaden adoption of shared/daily-issue-base.md / shared/daily-pr-base.md (existing components, low adoption)
Only 11 workflows import the existing daily-issue-base.md bundle despite 129 workflows declaring create-issue: directly and 54 declaring create-pull-request: directly. Restricting to the daily-*.md naming convention alone (82 workflows), 53 hand-roll activation/reporting/safe-output config that the bundle already standardizes. This is pure migration effort — no new file needed.

Medium — #3: shared/network-github-defaults.md (new component)
72 workflows use a network.allowed: [defaults, github] baseline; 43 use it exactly with no extra domains. Since network.allowed unions across imports, this extraction is compatible with workflows that layer on additional domains (e.g. node, go).

Impact summary

#	Recommendation	Workflows affected	Est. lines saved	Complexity
1	shared/read-permissions.md	63	~189	Low
2	Adopt daily-issue-base.md/daily-pr-base.md	up to 129/54 (53 in daily-* alone)	500+	Low–Medium (migration, not new code)
3	shared/network-github-defaults.md	72 (43 exact, ~29 partial)	~129+	Medium

Notes on lower-priority findings

Also observed but not escalated to a top-3 recommendation (lower yield or higher complexity):

• tools.cli-proxy: true appears in 200+ workflows but is typically paired with per-workflow-specific github:/bash: scoping, making full extraction less mechanical.
• A 5-workflow exact-match tools: block (cache-memory, github.toolsets, edit, bash, web-fetch) across smoke-* engine-comparison workflows — likely intentional parallel test fixtures rather than duplication to remove.
• engine: blocks cluster heavily (e.g. 55x copilot + copilot-sdk: true, 38x codex + model-provider: openai) but engine selection is inherently per-workflow and not a good extraction candidate.

References

Full evidence and per-file lists are captured in the three issues created from this analysis:

• Issue: Skill extraction: shared/read-permissions.md
• Issue: Broaden adoption of shared/daily-issue-base.md and shared/daily-pr-base.md
• Issue: Skill extraction: shared/network-github-defaults.md

Run: §35952806154

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• o205451.ingest.us.sentry.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "o205451.ingest.us.sentry.io"

See Network Configuration for more information.

Generated by 🔍 Workflow Skill Extractor · copilot · auto · 83.1 AIC · ⌖ 9.31 AIC · ⊞ 7.3K · ◷

• expires on Sep 30, 2026, 7:56 PM UTC-08:00