Codex skills for GitHub Actions
GitHub Actions skills cover CI workflow design, workflow security, repository bots, release pipelines, CI speed and running Codex itself inside a job. Codex starts workflows at contents: read and grants more per job, pins third-party actions to full commit SHAs, swaps stored cloud keys for OIDC, adds timeouts and concurrency groups, and checks every file with actionlint.
Start with these 3
- GitHub Actions Security Read-only tokens, SHA pins, no injected titles Codex audits .github/workflows with a bundled offline scanner, then sets permissions to nothing by default and grants per job, swaps stored cloud keys for OIDC roles scoped to a branch or environment, pins third-party actions by full commit SHA, and moves github.event fields out of run scripts into env. Fork PR code never shares a job with secrets or a write token.
- GitHub Actions Workflows Fast PR signal, shared pipelines, guarded deploys Codex designs .github/workflows files around the commands in AGENTS.md: lint and test jobs with fail-fast off, lockfile-keyed caches, concurrency groups that cancel stale PR runs but never main, and timeouts on every job. Repeated YAML becomes reusable workflows or composite actions, path filters never strand required checks, deploys go through protected environments, and actionlint checks everything first.
- GitHub Actions Automation Repo housekeeping bots with least privilege Codex writes housekeeping workflows for labels, stale issues, greetings, triage, Dependabot auto-merge and release notes, each with explicit per-job permissions and a manual dry-run trigger. It keeps pull_request_target away from fork code, routes untrusted titles through env or github-script instead of shell, and explains why GITHUB_TOKEN events never start a second workflow.
5 more GitHub Actions skills
-
Codex GitHub Action
Codex in workflows without leaking the key -
Mobile CI with fastlane
Signed builds from a clean runner, every time -
CI Speedup
Measure the critical path, then cut it -
Release Automation
Versions, changelogs and publishes nobody types -
Secrets in CI
Short-lived OIDC over long-lived keys
General skills with GitHub Actions guidance
Not built around GitHub Actions, but they include steps or tools for it. Not part of the install-all command.
-
Cron Scheduling
Scheduled jobs that run once, on time, visibly -
Jenkins Pipelines
Declarative Jenkinsfiles that stay boring -
AWS IAM Policies
Least privilege you can prove, not promise -
Google Cloud IAM
Least privilege without JSON key files -
Azure App Service
Ship through the staging slot, never around it -
Microsoft Entra ID
Right OAuth flow, zero client secrets -
Vercel Deployment
Previews, env scopes and one-command rollbacks -
Firebase Hosting
Static sites, API rewrites and preview channels -
Supply Chain Security
Install what you reviewed, ship what you can prove -
Lighthouse Audits
Median-of-five runs and CI assertions that hold -
Docs as Code
Docs that ship in the same PR as the code -
Scheduled Reports
Recurring reports that send once, on the right day
Every GitHub Actions skill in one command
Installs these 8 into ~/.agents/skills/. Add --project after -- to install into the current repository instead.
The installer is a 104-line POSIX shell script. It fetches the skills you name from codexskills.dev and unpacks each into its own folder in your skills directory. No sudo, no telemetry, and every skill page shows the full SKILL.md first. Read install.sh
curl -fsSL codexskills.dev/install.sh | sh -s -- github-actions-security github-actions-workflows github-actions-automation codex-github-action mobile-ci-fastlane ci-speedup release-automation secrets-in-ci GitHub Actions FAQ
Can Codex audit GitHub Actions workflows for security problems?
GitHub Actions Security runs a bundled offline scanner, scripts/audit_workflows.py, over .github/workflows, plus actionlint and zizmor when they are installed. It grants GITHUB_TOKEN permissions per job, pins third-party actions to a full 40-character SHA with the version in a comment, moves github.event fields out of run scripts into env, and replaces stored cloud keys with OIDC. Secrets in CI applies the same thinking to OIDC trust policies, fork PRs and log leakage.
How do I run Codex in a GitHub Actions workflow safely?
Codex GitHub Action builds jobs around openai/codex-action@v1, where the API key stays inside the action's Responses API proxy and the Codex job has only read access. Comments, branches and pull requests are created by a later job that never sees the key, and safety-strategy stays on drop-sudo. It avoids pull_request_target jobs that check out the PR head, because they run fork code next to secrets.
Is there a skill to speed up slow GitHub Actions CI?
CI Speedup times the slowest required checks first, then applies the fix for the real bottleneck: lockfile-keyed caches, Docker layer caching with Buildx, timing-balanced shards for pytest, Jest, Vitest or Playwright, and Nx or Turborepo affected builds. Its bundled junit_timings.py script finds slow tests and proposes shards from JUnit reports. Every change is proven with before and after numbers and an equal test count, so faster never means checking less.
How do I install all 8 GitHub Actions skills at once?
Pass every name to the installer in one command: curl -fsSL https://codexskills.dev/install.sh | sh -s -- github-actions-security github-actions-workflows github-actions-automation codex-github-action mobile-ci-fastlane ci-speedup release-automation secrets-in-ci. Add --project right after -- to put them in the current repository's .agents/skills/ so your team gets them too.
Which GitHub Actions skill should I try first?
GitHub Actions Security is the closest fit for most GitHub Actions work. Mention it with $github-actions-security in a prompt to load it on purpose; after that, Codex picks it up on its own whenever a task matches.