# In issue templates
assignees:
- secondsky # ← Change to your GitHub username
# In dependabot.yml
reviewers:
- "secondsky" # ← Change to your username
Adjust languages (CodeQL):
# In security-codeql.yml
matrix:
language: ['javascript-typescript'] # ← Add your languages
# Options: c-cpp, csharp, go, java-kotlin, python, ruby, swift
Update package manager (Dependabot):
# In dependabot.yml
- package-ecosystem: "npm" # ← Change if using yarn/pnpm/pip/etc
Set deployment URL (Cloudflare):
# In ci-cloudflare-workers.yml
echo "Worker URL: https://your-worker.your-subdomain.workers.dev"
# ← Update with your actual Worker URL
# Use yamllint or GitHub's workflow validator
yamllint .github/workflows/*.yml
✅ Test workflows on feature branch first
git checkout -b test/github-actions
# Push and verify CI runs before merging to main
Never Do
❌ Don't use @latest for action versions
Breaks without warning when actions update
Security risk (unvetted versions auto-adopted)
❌ Don't hardcode secrets in workflows
# ❌ NEVER DO THIS
env:
API_TOKEN: "sk_live_abc123..." # Secret exposed in repo!
❌ Don't skip build steps for compiled languages (CodeQL)
# ❌ WRONG - CodeQL fails for Java without build
- name: Perform CodeQL Analysis # No .class files to analyze
# ✅ CORRECT - Include build
- name: Build project
run: ./mvnw clean install
- name: Perform CodeQL Analysis # Now has .class files
❌ Don't ignore devDependencies in Dependabot
DevDependencies run during build, can execute malicious code
Include both prod and dev dependencies
❌ Don't use single ISSUE_TEMPLATE.md file
# ❌ OLD WAY
.github/ISSUE_TEMPLATE.md
# ✅ NEW WAY
.github/ISSUE_TEMPLATE/
bug_report.yml
feature_request.yml
Known Issues Prevention (Top 5)
This skill prevents 18 documented issues. Here are the top 5 most critical:
Issue #1: YAML Indentation Errors ⚠️ MOST COMMON
Error: workflow file is invalid. mapping values are not allowed in this contextSource: Stack Overflow (most common GitHub Actions error)
Why It Happens: Spaces vs tabs, missing spaces after colons, inconsistent indentation
Prevention: Use skill templates with validated 2-space indentation
Impact: Workflow fails to parse, CI doesn't run
Issue #2: Action Version Pinning Issues 🔒 SECURITY
Error: Workflow breaks unexpectedly after action updates
Source: GitHub Security Best Practices 2025
Why It Happens: Using @latest or @v4 instead of specific SHA
Prevention: All templates pin to SHA with version comment
Impact: Unexpected breaking changes, security vulnerabilities
Issue #3: Secrets Not Available 🔑
Error: Secret not found or empty variable
Source: GitHub Actions Debugging Guides
Why It Happens: Wrong syntax ($secrets.NAME instead of ${{ secrets.NAME }})
Prevention: Templates demonstrate correct context syntax
Impact: Deployment failures, broken CI/CD pipelines
Issue #4: CodeQL Not Running on Dependabot PRs 🛡️
Error: Security scans skipped on dependency updates
Source: GitHub Community Discussion #121836
Why It Happens: Default trigger limitations
Prevention: Templates include push: branches: [dependabot/**]Impact: Vulnerable dependencies merged without scanning
Issue #5: Missing Required Fields in Issue Templates 📋
Error: Incomplete issues, missing critical info
Source: Community Feedback
Why It Happens: Markdown templates don't validate
Prevention: YAML templates with required: true validation
Impact: Can't reproduce bugs, wasted triage time
For complete error documentation with all 18 issues: Load references/common-errors.md when debugging GitHub Actions issues or configuring workflows.
When to Load References
Load reference files when working on specific aspects of GitHub automation:
Common Errors (references/common-errors.md)
Load when:
Encountering workflow syntax errors
Debugging failed GitHub Actions runs
Setting up CodeQL or Dependabot for first time
Resolving "Secret not found" errors
Understanding why matrix builds fail
Need detailed solutions for any of the 18 documented errors
