GitHub Actions — Complete Reference Skill

A comprehensive, practitioner-oriented reference for GitHub Actions — covering workflow syntax, contexts, expressions, events, caching, security, reusable workflows, runners, and system limits.

Built from the official GitHub/Microsoft documentation (docs.github.com/en/actions), distilled into a single portable skill file for fast lookup and reuse.

---

What's Inside

SKILL.md — The Main Reference (19 sections)

#	Section	What It Covers
1	Workflow File Structure	Minimal skeleton, run-name, file conventions
2	Top-Level Keys	name, on, permissions, env, defaults, concurrency
3	Triggers (on)	Single/multiple events, activity types, branch/tag/path filters, glob patterns, cron syntax, workflow_dispatch, workflow_call, workflow_run
4	All 34 Event Types	Every event with activity types, GITHUB_SHA/GITHUB_REF behavior, and security notes
5	All 12 Contexts	github (30+ properties), env, vars, job, jobs, steps, runner, secrets, strategy, matrix, needs, inputs — plus context availability matrix
6	Expressions	Operators, type casting, 11 functions (contains, startsWith, hashFiles, fromJSON, etc.), 5 status check functions, object filter syntax
7	Jobs	Runner selection, matrix strategies, include/exclude, containers, services, conditionals, outputs
8	Steps	Action references (uses), shell commands (run), inputs/outputs, continue-on-error, background steps, parallel steps
9	Environment Files & Workflow Commands	GITHUB_ENV, GITHUB_OUTPUT, GITHUB_PATH, GITHUB_STEP_SUMMARY, annotations (::error::), log grouping, masking, stop-commands
10	Reusable Workflows	Caller/callee patterns, inputs/outputs/secrets passing, inherit, nesting limits (max 10 levels)
11	Dependency Caching	actions/cache, setup-* built-in cache, cache key strategies, restore-keys fallback, limits (10 GB, 7-day eviction)
12	GitHub-Hosted Runners	OS/arch/CPU/RAM specs for all runner types, execution limits, artifact storage by plan
13	Security Best Practices	Script injection prevention, action pinning to SHA, secrets management, OIDC, self-hosted runner safety
14	Workflow Cancellation	Signal escalation flow (SIGINT → SIGTERM → kill), 5-minute timeout
15	Concurrency	Groups, cancel-in-progress, queue mode
16	Common Patterns	Matrix builds, conditional execution, environment protection, composite actions, skip CI
17	Default Environment Variables	All 38 variables (CI, GITHUB_*, RUNNER_*) with descriptions
18	System Limits	Run time, job execution, matrix size, cache rates, variable limits
19	GITHUB_TOKEN Permissions	All 18 scopes, least-privilege configuration

references/expressions-cheatsheet.md

Quick-reference card for expression functions, operators, type coercion rules, object filters, and common expression patterns.

references/workflow-templates.md

10 ready-to-use workflow templates:

• Minimal CI
• Node.js CI (matrix)
• Multi-OS matrix
• Docker build & push to GHCR
• GitHub Pages deployment
• Reusable workflow pattern (caller + callee)
• Manual deploy with environment protection
• Scheduled cleanup (prune old runs)
• Cache with restore-keys fallback
• OIDC for AWS (no static credentials)

references/security-cheatsheet.md

8 security anti-patterns with BAD/GOOD examples:

1. Script injection via github.event.*
2. pull_request_target misuse
3. Unpinned third-party actions
4. Secret leaks in logs
5. Artifact poisoning
6. workflow_run escalation
7. Cache poisoning from forks
8. Self-hosted runner risks

Plus a 10-point security checklist.

---

How to Use

As a Hermes Agent Skill

This skill lives under ~/.hermes/skills/github-actions/ and is auto-loaded when GitHub Actions topics are discussed. To load it manually:

skill_view(name='github-actions')

To access reference files:

skill_view(name='github-actions', file_path='references/workflow-templates.md')

As a Standalone Reference

Clone this repo and read SKILL.md directly. It's a self-contained Markdown file — no dependencies, no tooling required.

git clone https://github.com/peditx/github-actions-skill.git
cat github-actions-skill/SKILL.md

Copy Into Your Own Project

You can also drop SKILL.md into any project's .github/ directory as a team reference document.

---

What This Is NOT

• Not a tutorial for beginners (see GitHub's official quickstart)
• Not a replacement for the official docs — it's a condensed, searchable cheat sheet
• Not language-specific — covers all ecosystem patterns (Node, Python, Docker, etc.)

---

Source

All content is derived from the official GitHub Actions documentation at docs.github.com/en/actions, accurate as of July 2026.

---

License

MIT — use freely, contribute freely.