github-actions

# GitHub Actions CI/CD Standard Canonical CI/CD workflows for GitHub repositories. The CI workflow delegates to the canonical [mise](../mise/SKILL.md) `all` task, which composes format, check, test, and build from the same tasks used by local [lefthook](../lefthook/SKILL.md) hooks. The CD workflow provides templates for building and deploying applications based on the project's language stack. ## Principles - **Single canonical gate**: CI runs `mise run all`; that task composes the same format, check, and test tasks used by local pre-commit/pre-push hooks plus the production build. Driving both from one mise task set eliminates drift between local checks and CI; workflow syntax and first-party skill contracts belong inside `check`, not in parallel CI-only steps. - **Workflows are linted too**: a `check:actions` task runs `actionlint` (correctness: workflow schema, expression types, `shellcheck` on `run:` scripts) and `zizmor` (security: template injection, credential persistence, cache poisoning, unpinned actions), so workflow regressions fail the same gate as code. zizmor runs offline by default, so the task needs no GitHub token; [zizmor.yml](references/zizmor.yml) relaxes its hash-pin default to the tag-pinning policy from [upgrade-tools](../upgrade-tools/SKILL.md). - **Tools from `mise.toml`**: `jdx/mise-action` installs and caches the project toolchain, ensuring that the CI runner runs the identical tool versions pinned locally. - **Least privilege**: Default to `perm...