GitHub Actions CI/CD AI Skill Guide (Claude)

Overview & Engine Architecture

GitHub Actions runs workflows (YAML under .github/workflows/) on events (push, pull_request, workflow_dispatch, …). Jobs execute on runners; steps use run: or actions from the marketplace. Security is the product: explicit permissions, OIDC federation instead of long-lived cloud keys, pinned action SHAs for high assurance, and fork PR rules that block secrets and OIDC by design.

┌─────────────────────────────────────────────────────────────┐
│                 GitHub Actions trust model                  │
│                                                             │
│  Event → workflow → job(s) → steps                          │
│  ├── GITHUB_TOKEN (scoped by permissions: block)            │
│  ├── Repository / environment secrets                       │
│  └── OIDC JWT (id-token: write) → cloud IAM role            │
│                                                             │
│  Reusable workflow: caller permissions CAP callee           │
│  Fork pull_request: read-only token; NO OIDC injection      │
└─────────────────────────────────────────────────────────────┘