github-actions-securitylisted

# github-actions-security ## Purpose Produce GitHub Actions workflows and actions that grant the smallest permission set the job needs, resist the attack patterns CI/CD systems are actually compromised through, and stay maintainable when the same pattern is repeated across many repositories. This skill is a triage layer: it states the baseline every workflow must meet, routes the change to the detail that applies, then holds the result to a bounded verify loop built on `actionlint` and `zizmor`. A workflow is remote code execution with access to repository credentials. Treat a workflow file as production code, not configuration. ## When to use this - Creating or editing any file under `.github/workflows/`. - Creating or editing an `action.yml` or `action.yaml`, whether composite, Docker, or JavaScript. - Creating or editing a reusable workflow, or a caller that invokes one. - Reviewing or changing `permissions`, secrets, OIDC trust conditions, action versions, triggers, runner labels, caching, or concurrency in a workflow. - Editing `.github/dependabot.yml` for the `github-actions` ecosystem. - Designing workflow structure for an organization: shared workflows, action allowlists, rulesets. ## When NOT to use this - CI systems other than GitHub Actions. - Changes to application code that only happen to be built by a workflow, with no workflow file touched. ## Steps 1. Orient before changing anything. Read the workflows already in the repository, plus `.github/d