Skip to content
Back to skills

Github Actions Ci

ASecurity

Set up GitHub Actions CI pipeline with test, lint, type-check, and build jobs for a Node.js/TypeScript project. Includes output grouping, error annotations, and job summary patterns.

  • 2 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added September 10, 2026
devopstypescriptgonodegitsecurity

Security analysis

A96/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro shows the line behind each finding and how to fix it

Scanned September 10, 2026

npx -y skills add krafteq/infraglue --skill github-actions-ci --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Github Actions Ci?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Github Actions Ci
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/krafteq-github-actions-ci/badge)](https://www.skillsdirectory.com/skills/krafteq-github-actions-ci)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: github-actions-ci
description: Set up GitHub Actions CI pipeline with test, lint, type-check, and build jobs for a Node.js/TypeScript project. Includes output grouping, error annotations, and job summary patterns.
---

# GitHub Actions CI Pipeline

## Goal

Set up a comprehensive CI pipeline for a Node.js/TypeScript project with GitHub Actions output integration.

## CI Workflow

Create `.github/workflows/ci.yml`:

```yaml
name: CI
on:
  push:
    branches: [master]
  pull_request:
    branches: [master]

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [22]
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm ts:check
      - run: pnpm lint
      - run: pnpm test
      - run: pnpm build

  format:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm format:check
```

Adapt branch names, package manager (pnpm/npm/yarn), and script names to match the project.

## Output Grouping

Group related output in CI logs for cleaner display:

```ts
function startGroup(label: string): void {
  if (process.env['GITHUB_ACTIONS']) {
    console.error(`::group::${label}`)
  }
}

function endGroup(): void {
  if (process.env['GITHUB_ACTIONS']) {
    console.error('::endgroup::')
  }
}

// Usage:
startGroup(`Processing: ${taskName}`)
await doWork()
endGroup()
```

## Error Annotations

Surface errors as inline annotations on the PR diff:

```ts
function annotateError(message: string, file?: string, line?: number): void {
  if (process.env['GITHUB_ACTIONS']) {
    const location = file ? ` file=${file}${line ? `,line=${line}` : ''}` : ''
    console.error(`::error${location}::${message}`)
  }
}
```

## Job Summary

Write a markdown summary after execution:

```ts
function writeSummary(markdown: string): void {
  const summaryFile = process.env['GITHUB_STEP_SUMMARY']
  if (summaryFile) {
    fs.appendFileSync(summaryFile, markdown + '\n')
  }
}
```

## Security

Pin third-party action versions by SHA for supply chain security:

```yaml
- uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
```

For first-party GitHub actions (`actions/*`), tags are acceptable.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.