重要前提
安装AI Skills的关键前提是:必须科学上网,且开启TUN模式,这一点至关重要,直接决定安装能否顺利完成,在此郑重提醒三遍:科学上网,科学上网,科学上网。查看完整安装教程 →
github-actions by tartinerlabs/skills
npx skills add https://github.com/tartinerlabs/skills --skill github-actions从项目中推断语言风格:
根据上下文确定模式:
.github/workflows/ 目录,或者用户明确要求创建/添加工作流程.github/workflows/*.yml 文件,或者用户明确要求审计/审查/修复工作流程扫描项目标识符:
package.json → Node.js/JS/TSgo.mod → Gorequirements.txt / / → Python广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
pyproject.tomlsetup.pyCargo.toml → RustGemfile → Rubypnpm-lock.yaml → pnpmbun.lock / bun.lockb → bunyarn.lock → yarnpackage-lock.json → npm生成工作流程时,应用 rules/ 目录中的所有规则。阅读每个规则文件以获取详细要求和示例。
根据检测到的项目类型和包管理器调整此 CI 模板(将 <pm> 替换为检测到的包管理器):
name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
ci:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: 'lts/*'
cache: '<pm>'
- run: <pm> install --frozen-lockfile
- run: <pm> check
- run: <pm> test
- run: <pm> build
读取 .github/workflows/*.yml 中的所有文件,并根据 rules/ 目录中的每条规则进行审计。
## GitHub Actions 审计结果
### 高严重性
- `.github/workflows/ci.yml:15` - `codecov/codecov-action@v4` → 固定到提交 SHA
### 中严重性
- `.github/workflows/ci.yml` - 缺少并发组 → 添加并发块
### 摘要
- 高:X
- 中:Y
- 低:Z
- 已扫描文件:N
报告后,应用修复。使用 gh api 查找用于固定的提交 SHA。
阅读各个规则文件以获取详细的检查和示例:
| 规则 | 严重性 | 文件 |
|---|---|---|
| Action 固定 | 高 | rules/action-pinning.md |
| 权限 | 高 | rules/permissions.md |
| 并发 | 中 | rules/concurrency.md |
| Node 版本 | 中 | rules/node-version.md |
| 缓存 | 中 | rules/caching.md |
| 触发器 | 低 | rules/triggers.md |
| 矩阵策略 | 低 | rules/matrix.md |
gh) 可用于查找 action 的提交 SHA每周安装次数
69
代码仓库
GitHub 星标数
5
首次出现
2026年2月15日
安全审计
安装于
github-copilot69
opencode61
amp61
codex61
kimi-cli61
gemini-cli61
Infer language style from the project:
Determine the mode based on context:
.github/workflows/ directory exists, or user explicitly asks to create/add a workflow.github/workflows/*.yml files exist, or user explicitly asks to audit/review/fix workflowsScan for project indicators:
package.json → Node.js/JS/TSgo.mod → Gorequirements.txt / pyproject.toml / setup.py → PythonCargo.toml → RustGemfile → Rubypnpm-lock.yaml → pnpmbun.lock / bun.lockb → bunyarn.lock → yarnpackage-lock.json → npmApply all rules from the rules/ directory when generating workflows. Read each rule file for detailed requirements and examples.
Adapt this CI template to the detected project type and package manager (replace <pm> with the detected package manager):
name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
ci:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: 'lts/*'
cache: '<pm>'
- run: <pm> install --frozen-lockfile
- run: <pm> check
- run: <pm> test
- run: <pm> build
Read all files in .github/workflows/*.yml and audit against every rule in the rules/ directory.
## GitHub Actions Audit Results
### HIGH Severity
- `.github/workflows/ci.yml:15` - `codecov/codecov-action@v4` → pin to commit SHA
### MEDIUM Severity
- `.github/workflows/ci.yml` - Missing concurrency group → add concurrency block
### Summary
- High: X
- Medium: Y
- Low: Z
- Files scanned: N
After reporting, apply fixes. Look up commit SHAs for pinning using gh api.
Read individual rule files for detailed checks and examples:
| Rule | Severity | File |
|---|---|---|
| Action pinning | HIGH | rules/action-pinning.md |
| Permissions | HIGH | rules/permissions.md |
| Concurrency | MEDIUM | rules/concurrency.md |
| Node version | MEDIUM | rules/node-version.md |
| Caching | MEDIUM | rules/caching.md |
gh) is available for looking up action commit SHAsWeekly Installs
69
Repository
GitHub Stars
5
First Seen
Feb 15, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykWarn
Installed on
github-copilot69
opencode61
amp61
codex61
kimi-cli61
gemini-cli61
Azure Data Explorer (Kusto) 查询技能:KQL数据分析、日志遥测与时间序列处理
145,500 周安装
| Triggers | LOW | rules/triggers.md |
| Matrix strategy | LOW | rules/matrix.md |