gh-actions-validator
Audits GitHub Actions to replace static service account keys with secure Workload Identity Federation.
Install
mkdir -p .claude/skills/gh-actions-validator && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/7747" && unzip -o skill.zip -d .claude/skills/gh-actions-validator && rm skill.zipInstalls to .claude/skills/gh-actions-validator
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Validate use when validating GitHub Actions workflows for Google CloudKey capabilities
- →Audit GitHub Actions workflows for security risks
- →Enforce Workload Identity Federation for GCP authentication
- →Validate OIDC permissions and id-token usage
- →Review IAM roles for least-privilege compliance
- →Implement post-deployment health checks
How it works
The skill scans workflow files to ensure secure authentication patterns and IAM configurations, replacing long-lived keys with OIDC-based identity federation.
Inputs & outputs
When to use gh-actions-validator
- →Audit existing GitHub Actions workflows
- →Setup Workload Identity Federation
- →Implement least-privilege IAM roles
- →Automate Vertex AI deployment security
About this skill
Gh Actions Validator
Overview
Validate and harden GitHub Actions workflows that deploy to Google Cloud (especially Vertex AI) using Workload Identity Federation (OIDC) instead of long-lived service account keys. Use this to audit existing workflows, propose a secure replacement, and add CI checks that prevent common credential and permission mistakes.
Prerequisites
Before using this skill, ensure:
- GitHub repository with Actions enabled
- Google Cloud project with billing enabled
- gcloud CLI authenticated with admin permissions
- Understanding of Workload Identity Federation concepts
- GitHub repository secrets configured
- Appropriate IAM roles for CI/CD automation
Instructions
- Audit Existing Workflows: Scan .github/workflows/ for security issues
- Validate WIF Usage: Ensure no JSON service account keys are used
- Check OIDC Permissions: Verify id-token: write is present
- Review IAM Roles: Confirm least privilege (no owner/editor roles)
- Add Security Scans: Include secret detection and vulnerability scanning
- Validate Deployments: Add post-deployment health checks
- Configure Monitoring: Set up alerts for deployment failures
- Document WIF Setup: Provide one-time WIF configuration commands
Output
- uses: actions/checkout@v4
- name: Authenticate to GCP (WIF)
- name: Deploy to Vertex AI
--project=${{ secrets.GCP_PROJECT_ID }} \
--region=us-central1
- name: Validate Deployment
Error Handling
See ${CLAUDE_SKILL_DIR}/references/errors.md for comprehensive error handling.
Examples
See ${CLAUDE_SKILL_DIR}/references/examples.md for detailed examples.
Resources
- Workload Identity Federation: https://cloud.google.com/iam/docs/workload-identity-federation
- GitHub OIDC: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments
- Vertex AI Agent Engine: https://cloud.google.com/vertex-ai/docs/agent-engine
- google-github-actions/auth: https://github.com/google-github-actions/auth
- WIF setup guide in ${CLAUDE_SKILL_DIR}/docs/wif-setup.md
When not to use it
- →Validating non-GCP deployment workflows
- →Managing GitHub repository settings unrelated to CI/CD
Prerequisites
Limitations
- →Requires existing understanding of Workload Identity Federation concepts
How it compares
It enforces specific security standards like WIF and least-privilege IAM rather than performing generic syntax validation.
Compared to similar skills
gh-actions-validator side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| gh-actions-validator (this skill) | 1 | 27d | Review | Advanced |
| terraform-module-library | 7 | 5mo | No flags | Advanced |
| azure-deployment-preflight | 7 | 6mo | Review | Advanced |
| aws-advisor | 5 | 5mo | Review | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by jeremylongshore
View all by jeremylongshore →You might also like
terraform-module-library
wshobson
Build reusable Terraform modules for AWS, Azure, and GCP infrastructure following infrastructure-as-code best practices. Use when creating infrastructure modules, standardizing cloud provisioning, or implementing reusable IaC components.
azure-deployment-preflight
github
Performs comprehensive preflight validation of Bicep deployments to Azure, including template syntax validation, what-if analysis, and permission checks. Use this skill before any deployment to Azure to preview changes, identify potential issues, and ensure the deployment will succeed. Activate when users mention deploying to Azure, validating Bicep files, checking deployment permissions, previewing infrastructure changes, running what-if, or preparing for azd provision.
aws-advisor
tech-leads-club
Expert AWS Cloud Advisor for architecture design, security review, and implementation guidance. Leverages AWS MCP tools for accurate, documentation-backed answers. Use when user asks about AWS architecture, security, service selection, migrations, troubleshooting, or learning AWS. Triggers on AWS, Lambda, S3, EC2, ECS, EKS, DynamoDB, RDS, CloudFormation, CDK, Terraform, Serverless, SAM, IAM, VPC, API Gateway, or any AWS service.
deployment-engineer
sickn33
Expert deployment engineer specializing in modern CI/CD pipelines, GitOps workflows, and advanced deployment automation. Masters GitHub Actions, ArgoCD/Flux, progressive delivery, container security, and platform engineering. Handles zero-downtime deployments, security scanning, and developer experience optimization. Use PROACTIVELY for CI/CD design, GitOps implementation, or deployment automation.
devops
mrgoonie
Deploy to Cloudflare (Workers, R2, D1), Docker, GCP (Cloud Run, GKE), Kubernetes (kubectl, Helm). Use for serverless, containers, CI/CD, GitOps, security audit.
genkit-infra-expert
jeremylongshore
Execute use when deploying Genkit applications to production with Terraform. Trigger with phrases like "deploy genkit terraform", "provision genkit infrastructure", "firebase functions terraform", "cloud run deployment", or "genkit production infrastructure". Provisions Firebase Functions, Cloud Run services, GKE clusters, monitoring dashboards, and CI/CD for AI workflows.