github-actions-validation
Skill1 starsChanged 8 days agoApache-2.0View on GitHub
Validate GitHub Actions workflows for syntax and security with ORD-01 map key order checks, actionlint, ghalint, and zizmor. Use when committing workflow changes, running CI validation, or checking workflow security issues.
In this repository56 other files it gives its agents.
- AGENTS.mdAGENTS.md
- .apm/CLAUDE.mdCLAUDE.md
- CLAUDE.mdCLAUDE.md
- .github/workflows/CLAUDE.mdCLAUDE.md
- .cursor/rules/agent-skills.mdcCursor rule
- .cursor/rules/bats.mdcCursor rule
- .cursor/rules/github-actions-workflow.mdcCursor rule
- .cursor/rules/go.mdcCursor rule
- .cursor/rules/go-test.mdcCursor rule
- .cursor/rules/instructions.mdcCursor rule
- .cursor/rules/markdown.mdcCursor rule
- .cursor/rules/shell-script.mdcCursor rule
- .cursor/rules/terraform.mdcCursor rule
- agent-skills-reviewSkill
- changelogSkill
- ci-sweeperSkill
- docs-creatorSkill
- docs-updaterSkill
- github-actions-reviewSkill
- github-issue-autofixSkill
- github-issue-triageSkill
- github-pr-bodySkill
- github-pr-reviewSkill
- github-pr-reviseSkill
- go-reviewSkill
- go-validationSkill
- instructions-reviewSkill
- loop-verifierSkill
- markdown-validationSkill
- refactorSkill
- shell-script-reviewSkill
- shell-script-validationSkill
- tech-debtSkill
- test-gapSkill
- agent-skills-reviewSkill
- changelogSkill
- ci-sweeperSkill
- docs-creatorSkill
- docs-updaterSkill
- github-actions-reviewSkill
- github-actions-validationSkill
- github-issue-autofixSkill
- github-issue-triageSkill
- github-pr-bodySkill
- github-pr-reviewSkill
- github-pr-reviseSkill
- go-reviewSkill
- go-validationSkill
- instructions-reviewSkill
- loop-verifierSkill
- markdown-validationSkill
- refactorSkill
- shell-script-reviewSkill
- shell-script-validationSkill
- tech-debtSkill
- test-gapSkill
The file
We split this skill into the rules it gives an agent
3 rules. About 0 are common, 2 are distinctive, and 1 is very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈2
Distinctive · estimate
This author's own choices. Worth a look.
1
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 35
verify syntax and security findings from validation tools
- Very specific: line 53
Run bash scripts/validate.sh (or bash scripts/validate.sh <workflows-dir> to scope the ORD-01 check and ghalint).
- Distinctive: line 56
If checks fail and the user asked for fixes, fix reported issues and rerun the same command.
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Input
- Validation script (required):
scripts/validate.sh - Workflows directory (optional): defaults to
.github/workflows; scopes the ORD-01 map order check and ghalint (actionlint and zizmor always scan the whole repository). Without it, the ORD-01 check covers git-tracked.github/workflows/*.yml|yamland.github/actions/**/action.yml|yaml; untracked new files are not checked until they are added to git. With it, the ORD-01 check covers only YAML files under that directory (relative to the current directory), so composite actions are not checked --verbose/--quiet(optional)
Output Specification
Return structured Markdown in accordance with references/common-output-format.md. That file is the source of truth for the output contract.
Structured validation results from four tools: ORD-01 map order → actionlint → ghalint → zizmor. Attribute evidence to the producing tool.
Execution Scope
- Always use
scripts/validate.shfor comprehensive validation. Do not run individual commands. - Script executes all tools in order and stops at the first failing tool (fail-fast); later tools are reported as
⊘ Skipped. - Individual commands are for debugging only (see references/common-individual-commands.md)
USE FOR:
- validate workflow changes before commit or merge
- rerun CI-equivalent local checks for workflow failures
- verify syntax and security findings from validation tools
DO NOT USE FOR:
- judge workflow architecture or operational policy quality
- edit workflow files automatically
- validate non-workflow YAML files
Reference Files Guide
- common-checklist.md (always read)
- common-output-format.md (always read)
- common-troubleshooting.md (read on failure)
- common-individual-commands.md (read on failure)
- category-security.md (always read)
Workflow
- Run
bash scripts/validate.sh(orbash scripts/validate.sh <workflows-dir>to scope the ORD-01 check and ghalint). - Parse script output and map results to checklist ItemIDs.
- Report per-tool results (pass, fail, skipped) per references/common-output-format.md.
- If checks fail and the user asked for fixes, fix reported issues and rerun the same command; otherwise report the failures.
- Retry at most 2 times after fixes; if checks still fail, return blocking findings and stop.
Error Handling
| Condition | Severity | Action |
scripts/validate.sh missing | Fatal | Stop; report missing script |
| No workflow YAML under target path | Info | Report no reviewable workflows; stop |
| python3 / actionlint / ghalint / zizmor missing | Fatal | Stop; report the missing binary; set Status: ❌ FAIL |
| A tool fails | Recoverable | Report earlier tools as passed, the failed tool ❌ Fail with exit status, later tools ⊘ Skipped |
common-checklist.md unavailable | Fatal | Stop; report missing dependency |
common-output-format.md unavailable | Recoverable | Note missing file; emit ## Summary, ## Tool Results, and ## Error Details only |
Examples
- Prompt:
Validate workflows and report only failed checks with ItemIDs - Command:
bash scripts/validate.sh ./.github/workflows/ - Result: Structured report per references/common-output-format.md; attribute evidence to ORD-01, actionlint, ghalint, or zizmor.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.