github-actionslisted

# GitHub Actions workflow engineering Build the smallest auditable workflow graph that proves the repository contract without moving untrusted code across a privileged boundary. GitHub Actions syntax, runner images, action releases, security controls, plan limits, and CLI behavior change. Inspect installed tooling and current official documentation before relying on volatile details. Project scripts, lockfiles, repository settings, and observed runs win. Read `references/source-ledger.md` for primary sources. ## Scope and ownership This skill owns: - GitHub Actions events, permissions, job graphs, runner selection, matrices, reuse, concurrency, caches, artifacts, environments, and run diagnosis. - Actions-specific trust boundaries: fork PRs, workflow events, `GITHUB_TOKEN`, action dependencies, OIDC, and privileged promotion gates. - Static/local workflow checks and the hosted-run evidence needed to prove Actions behavior. Handoffs: - `testing-engineering` owns automated behavioral test strategy and the commands CI should execute. - `application-security` owns cross-stack AppSec; this skill owns how workflow execution can expose or mutate trusted resources. - `observability-engineering` owns application logs, metrics, traces, and SLOs; workflow logs and run diagnosis stay here. - `full-stack-development` selects the end-to-end evidence gates; this skill implements their GitHub workflow graph. - `nextjs-development`, `astro-development`, `workers-best-practices`, and ot