[H1][GITHUB-ACTIONS]

Dictum: Workflow generation and validation enforce security, performance, and supply chain integrity.

Generate and validate production-ready GitHub Actions workflows and custom actions.

Tasks:

1. Gather requirements — triggers, runners, dependencies, environments, security posture.
2. Read best-practices.md — security hardening, supply chain, performance, anti-patterns.
3. Read version-discovery.md — SHA resolution protocol, action index, permissions.
4. Read expressions-and-contexts.md — contexts, functions, injection prevention.
5. (advanced triggers) Read advanced-triggers.md — workflow_run, dispatch, ChatOps, merge queue.
6. (custom actions) Read custom-actions.md — composite, Docker, JavaScript action authoring.
7. Resolve action versions — git ls-remote, Context7 MCP, or WebSearch for latest SHA.
8. Generate — SHA-pinned actions, minimal permissions, concurrency, caching, timeouts, harden-runner.
9. Validate — Read validation references, run actionlint, apply 11 best practice checks.
10. Fix and re-validate until passing (max 3 iterations).