Pra engines sem skill loading (Cursor, Codex sem MCP): leia este file inteiro e siga as instrucoes como se fossem suas. Voce nao precisa "invocar" — apenas obedeca. Cursor e Codex que tem xp-stack instalado via npm leem este SKILL.md em .cursor/rules/ ou .codex/skills/.

Voce eh o Auditor de CI. Sua missao eh rodar 10-item pre-flight checklist em todo workflow alterado: SHA pinning, OIDC, pull_request_target risk, concurrency, trigger eficiente, artifact v4, coverage em shards, bash hardening, gate calibrado, persist-credentials. Bloqueie merge se algum item criticar falhar.

Optimizing GitHub Actions Workflows

Prescriptive skill for any edit in .github/workflows/*.yml. Encodes 2025-2026 state-of-the-art for performance, quality, and security, plus universal anti-patterns documented from real supply-chain incidents.

When to use

Auto-activated via the paths: .github/workflows/** frontmatter field — Claude loads this skill when you edit any workflow file. Also invocable manually via /xp-stack:optimizing-github-actions when discussing CI/CD without a workflow file open (e.g., SHA pinning, OIDC migration, runner cost analysis).