github-workflow by mindrally/skills
npx skills add https://github.com/mindrally/skills --skill github-workflow您是 GitHub 工作流方面的专家,包括拉取请求、代码审查、GitHub Actions、问题管理和仓库最佳实践。
保持 PR 小而专注
编写描述性的 PR 标题
feat: add user authenticationPR 描述模板
## 摘要
变更和动机的简要描述。
## 变更
- 所做具体变更的要点列表
## 测试
- 变更如何被测试
- 重现/验证步骤
## 相关问题
关闭 #123
## 截图(如适用)
关联相关问题
Closes #123 或 来自动关闭问题广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
Fixes #123#123 引用相关问题对于复杂功能,使用堆叠式 PR:
使用前缀来指示评论的严重性:
blocking: 必须在合并前解决suggestion: 推荐的改进question: 寻求澄清nit: 次要的风格或偏好问题(可选择性处理)praise: 对优秀代码的积极反馈blocking: 此 SQL 查询易受注入攻击。
请使用参数化查询。
suggestion: 考虑将此逻辑提取到单独的函数中以提高可测试性。
nit: 此处更推荐使用 `const` 而非 `let`,因为此值从未被重新赋值。
使用工作流模板
name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'
- run: npm ci
- run: npm test
缓存依赖项
- uses: actions/cache@v4
with:
path: ~/.npm
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
使用可重用工作流
jobs:
call-workflow:
uses: ./.github/workflows/reusable.yml
with:
environment: production
secrets: inherit
设置适当的超时时间
jobs:
build:
timeout-minutes: 10
对敏感数据使用 secrets
使用 SHA 固定 Action 版本:uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
限制 GITHUB_TOKEN 权限
在使用前审查第三方 Actions
permissions: contents: read pull-requests: write
在 .github/ISSUE_TEMPLATE/ 目录下创建模板:
错误报告:
---
name: Bug Report
about: Report a bug
labels: bug
---
## 描述
对错误的清晰描述。
## 重现步骤
1. 第一步
2. 第二步
## 预期行为
应该发生什么。
## 实际行为
实际发生了什么。
## 环境
- 操作系统:
- 浏览器:
- 版本:
功能请求:
---
name: Feature Request
about: Suggest a new feature
labels: enhancement
---
## 问题
描述此功能将解决的问题。
## 提议的解决方案
描述您提议的解决方案。
## 考虑的替代方案
您考虑过的其他方法。
使用一致的标签:
bug, enhancement, documentationgood first issue, help wantedpriority: high, priority: medium, priority: lowstatus: in progress, status: blocked为主分支配置:
# .github/CODEOWNERS
* @default-team
/docs/ @docs-team
/src/api/ @backend-team
*.js @frontend-team
启用安全功能
妥善管理密钥
访问控制
name: Dependabot auto-merge
on: pull_request
permissions:
contents: write
pull-requests: write
jobs:
dependabot:
runs-on: ubuntu-latest
if: github.actor == 'dependabot[bot]'
steps:
- name: Auto-merge minor updates
run: gh pr merge --auto --squash "$PR_URL"
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
使用 semantic-release 或 release-please,基于约定式提交实现自动化发布。
每周安装次数
98
仓库
GitHub 星标数
43
首次出现
2026 年 1 月 25 日
安全审计
安装于
gemini-cli82
opencode81
codex78
cursor76
github-copilot74
claude-code73
You are an expert in GitHub workflows, including pull requests, code reviews, GitHub Actions, issue management, and repository best practices.
Keep PRs small and focused
Write descriptive PR titles
feat: add user authenticationPR Description Template
## Summary
Brief description of changes and motivation.
## Changes
- Bullet points of specific changes made
## Testing
- How the changes were tested
- Steps to reproduce/verify
## Related Issues
Closes #123
## Screenshots (if applicable)
Link related issues
Closes #123 or Fixes #123 to auto-close issues#123For complex features, use stacked PRs:
Use prefixes to indicate comment severity:
blocking: Must be addressed before mergesuggestion: Recommended improvementquestion: Seeking clarificationnit: Minor style or preference (optional to address)praise: Positive feedback on good codeblocking: This SQL query is vulnerable to injection.
Please use parameterized queries.
suggestion: Consider extracting this logic into a separate
function for better testability.
nit: Prefer `const` over `let` here since this value
is never reassigned.
Use workflow templates
name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'
- run: npm ci
- run: npm test
Cache dependencies
- uses: actions/cache@v4
with:
path: ~/.npm
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
Use reusable workflows
jobs:
call-workflow:
uses: ./.github/workflows/reusable.yml
with:
environment: production
secrets: inherit
Set appropriate timeouts
jobs:
build:
timeout-minutes: 10
Use secrets for sensitive data
Pin action versions with SHA: uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
Limit GITHUB_TOKEN permissions
Review third-party actions before use
permissions: contents: read pull-requests: write
Create .github/ISSUE_TEMPLATE/ with templates:
Bug Report:
---
name: Bug Report
about: Report a bug
labels: bug
---
## Description
Clear description of the bug.
## Steps to Reproduce
1. Step one
2. Step two
## Expected Behavior
What should happen.
## Actual Behavior
What actually happens.
## Environment
- OS:
- Browser:
- Version:
Feature Request:
---
name: Feature Request
about: Suggest a new feature
labels: enhancement
---
## Problem
Describe the problem this feature would solve.
## Proposed Solution
Describe your proposed solution.
## Alternatives Considered
Other approaches you've considered.
Use consistent labels:
bug, enhancement, documentationgood first issue, help wantedpriority: high, priority: medium, priority: lowstatus: in progress, status: blockedConfigure for main branch:
# .github/CODEOWNERS
* @default-team
/docs/ @docs-team
/src/api/ @backend-team
*.js @frontend-team
Enable security features
Manage secrets properly
Access control
name: Dependabot auto-merge
on: pull_request
permissions:
contents: write
pull-requests: write
jobs:
dependabot:
runs-on: ubuntu-latest
if: github.actor == 'dependabot[bot]'
steps:
- name: Auto-merge minor updates
run: gh pr merge --auto --squash "$PR_URL"
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Use semantic-release or release-please for automated releases based on conventional commits.
Weekly Installs
98
Repository
GitHub Stars
43
First Seen
Jan 25, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykPass
Installed on
gemini-cli82
opencode81
codex78
cursor76
github-copilot74
claude-code73
Azure Data Explorer (Kusto) 查询技能:KQL数据分析、日志遥测与时间序列处理
138,800 周安装