gh-actions
Made by JeffConfigure GitHub Actions CI/CD for Go, Rust, TypeScript, Bash projects. Use when creating workflows, release automation, signing, checksums, cross-platform builds, or .github/workflows files.
Works With
Quality and Utility come from canonical skill metadata. Community ratings appear separately as stars when subscriber reviews exist.
Subscribe to download
Public previews are available, but downloads, CLI sync, and premium content require an active subscription.
Sign In to Subscribe- Full skill content with deterministic versioning
- CLI sync + local search index
- Access to Jeffrey’s premium library
Save to your account
Saved skills live in your cloud list. Run jsm sync on each machine to pull them locally.
What's New with this Skill
2Updates, enhancements, and release notes for this skill.
Updated: gh-actions, release and lint actions pinned to versions that work together
goreleaser-action@v5 with version: latest silently installs GoReleaser v1, which rejects the version: 2 config the skill ships, and golangci-lint-action@v4 cannot run the golangci-lint v2 that latest now installs. Both are fixed, along with cosign v3 flags, attestation permissions, CI signing with minisign, and several workflow snippets that could not work.
- goreleaser-action@v5 with latest installs GoReleaser v1, which rejects version: 2 configs; now @v6 with ~> v2
- golangci-lint-action@v9, since v4 cannot run golangci-lint v2
- Attestation workflow gains attestations: write; labelled SLSA Build Level 2, not 3
- cosign v3 signing uses --bundle; minisign CI keys use -W and the job installs minisign
- Fixed fuzz, coverage-gate, matrix-exclude, minio-service and repository_dispatch snippets
Checked against each action's action.yml and source at the pinned tag, the GitHub workflow syntax docs, and the installed gh, cosign and minisign.
- GoReleaser.
goreleaser-action@v5lockslatestto~> v1, which rejects the skill'sversion: 2config. The release workflow now uses@v6with"~> v2", andarchives.formatisformats. - golangci-lint.
golangci-lint-action@v4cannot run golangci-lint v2; the templates use@v9.
New: GitHub Actions, CI workflows that aren't held together by tape
Production-tested patterns for GitHub Actions in 2026: minimal default permissions (contents: read), concurrency groups that cancel stale runs except on releases, explicit timeout-minutes because the default 6-hour ceiling silently burns credit when something hangs, setup templates for Go, Rust, TypeScript/Bun, Bash, and Python/uv, plus signed and checksummed release workflows. 20 reference docs covering CI core, advanced patterns, browser tests, coverage, and release builds.
- Core invariants in every workflow: contents: read permissions by default, concurrency cancels in-progress runs for branches but not releases, every job has an explicit timeout-minutes so a hang doesn't burn six hours of credit
- Four workflows: ci.yml (push/PR), release.yml (tags), fuzz.yml (nightly fuzz and benchmarks), dependabot.yml (deps). Each links to its reference: CI-CORE, RELEASE-BUILD, TESTING and DEPENDABOT
- Per-language templates name the setup action and its cache: dtolnay/rust-toolchain with Swatinem/rust-cache, actions/setup-go with its built-in module cache, oven-sh/setup-bun, astral-sh/setup-uv for Python
- Release checklist: sha256sum checksums, minisign or cosign signatures, a syft SBOM, and SLSA provenance via actions/attest-build-provenance
- Cross-platform release matrix: Linux x86_64/arm64, macOS x86_64/arm64, Windows x64 on native ARM runners instead of QEMU. Matrix include/exclude for the platforms that don't apply per project
- 20 reference docs covering CI core, advanced patterns, browser tests with Playwright, coverage upload, release-build details, ACFS patterns. Pick the references for the workflow shape you need
Every workflow starts from the core invariants. permissions: contents: read minimal by default; escalate per-job for the few that need write. concurrency: cancel-in-progress: true for branches so a fresh push cancels the stale run, but false for releases so a tag push doesn't kill an in-flight release build. Every job has an explicit timeout-minutes because the default 6-hour ceiling burns credit silently when something hangs.