configure-workflows

/configure:workflows

Check and configure GitHub Actions CI/CD workflows against project standards.

When to Use This Skill

Use this skill when...	Use another approach when...
Checking GitHub Actions workflows for compliance with project standards	Debugging a failing CI run (use github-actions-inspection skill)
Setting up container build, test, or release-please workflows	Installing Claude-powered reusable workflows (use /configure:reusable-workflows)
Updating outdated action versions (checkout, build-push, etc.)	Writing a custom workflow from scratch (use ci-workflows skill)
Adding multi-platform builds or GHA caching to existing workflows	Configuring security-specific workflows (use /configure:security)
Auditing which required workflows are missing from a project	Managing GitHub repository settings or branch protection rules

Context

• Workflows dir: !find . -maxdepth 2 -type d -path './.github/workflows'
• Workflow files: !find . -path '*/.github/workflows/*' -maxdepth 3 \( -name '*.yml' -o -name '*.yaml' \)
• Package files: !find . -maxdepth 1 \( -name 'package.json' -o -name 'pyproject.toml' -o -name 'Cargo.toml' -o -name 'go.mod' \)
• Dockerfile: !find . -maxdepth 1 -name 'Dockerfile*'
• Release-please config: !find . -maxdepth 1 -name 'release-please-config.json'

Skills referenced: ci-workflows, github-actions-auth-security

Display name convention: Every generated or repaired workflow's name: follows <Domain>: <Action> [<target>] (quoted, since YAML treats : as a key separator). See .claude/rules/workflow-naming.md for the full rule and active domains.

Parameters

Parse from command arguments:

• --check-only: Report status without offering fixes
• --fix: Apply fixes automatically

Execution

Execute this GitHub Actions workflow configuration check:

Step 1: Fetch latest action versions

Verify latest versions before reporting outdated actions:

1. actions/checkout - releases
2. actions/setup-node - releases
3. actions/cache - releases
4. docker/setup-buildx-action - releases
5. docker/build-push-action - releases
6. docker/login-action - releases
7. docker/metadata-action - releases
8. reproducible-containers/buildkit-cache-dance - releases
9. googleapis/release-please-action - releases

Use WebSearch or WebFetch to verify current versions.

Step 2: Detect project type and list workflows

1. Check for .github/workflows/ directory
2. List all workflow files (*.yml, *.yaml)
3. Categorize workflows by purpose (container build, test, release, renovate)
4. Read the repo owner from git remote get-url origin. An owner of laurigates means the account-wide laurigates-renovate App autodiscovers the repo and already runs Renovate for it

Determine required workflows based on project type:

Project Type	Required Workflows
Frontend	container-build, release-please (optional: claude-auto-fix)
Python	container-build, release-please, test (optional: claude-auto-fix)
Infrastructure	release-please (optional: docs, claude-auto-fix)

Renovate is not a per-project-type requirement; where it runs depends on the repo owner (see the Renovate Workflow Checks table). A repo the laurigates-renovate App covers needs no Renovate workflow at all. A repo in an org the App does not cover gets the reusable Renovate caller from REFERENCE.md.

Step 3: Analyze workflow compliance

Container Build Workflow Checks:

Check	Standard	Severity
checkout action	v6	WARN if older
build-push action	v7	WARN if older
Multi-platform	amd64 + arm64	WARN if missing
Registry	GHCR (ghcr.io)	INFO
Caching	GHA cache enabled	WARN if missing
Permissions	Explicit	WARN if missing
id-token: write	Required when provenance/SBOM enabled	WARN if missing
Cache scope	Explicit scope= when multiple build jobs	WARN if missing
Dead metadata tags	No type=schedule without schedule trigger	INFO
Semver regex escaping	Dots escaped in type=match patterns (\d+\.\d+)	WARN if unescaped
Hardcoded image names	Derive from ${{ github.repository }}	INFO if hardcoded
Digest output	Capture build-push digest via id: for traceability	INFO if missing
Job summary	Write image/digest/tags to $GITHUB_STEP_SUMMARY	INFO if missing
Duplicated job conditions	Identical if: on sibling jobs; suggest gate job	INFO

Release Please Workflow Checks:

Check	Standard	Severity
Action version	v5	WARN if older
Token	MY_RELEASE_PLEASE_TOKEN	WARN if GITHUB_TOKEN
Permissions	contents: write, pull-requests: write	FAIL if missing

Test Workflow Checks:

Check	Standard	Severity
Node version	22	WARN if older
Linting	npm run lint	WARN if missing
Type check	npm run typecheck	WARN if missing
Coverage	Coverage upload	INFO

Renovate Workflow Checks:

Decide coverage first, from the owner read in Step 2:

Repo owner	Per-repo Renovate workflow	Verdict
laurigates (App-covered)	Absent	PASS — the laurigates-renovate App runs Renovate
laurigates (App-covered)	Present (renovatebot/github-action or a reusable Renovate caller)	WARN: duplicate Renovate identity — two dependency dashboards contend on the same renovate/* branches; recommend removing the workflow
Any other org	Absent	INFO — recommend the reusable caller
Any other org	Present	Run the per-repo checks

Per-repo checks, only for a repo the App does not cover:

Check	Standard	Severity
RENOVATE_REPOSITORIES env var	Must be set (${{ github.repository }})	FAIL if missing
checkout action	v6	WARN if older
renovatebot/github-action	Minor-pinned (e.g., v46.1.0), not major tag	WARN if major-only
Uses reusable workflow	Preferred (except infrastructure)	INFO if standalone

Claude Auto-Fix Workflow Checks (if present):

Check	Standard	Severity
workflow_run trigger	Monitors at least one workflow	WARN if misconfigured
Loop prevention	Skips fix(auto): commits	FAIL if missing
Deduplication	Caps open auto-fix PRs	WARN if missing
Claude Code Action	anthropics/claude-code-action@v1	WARN if older
OAuth token	CLAUDE_CODE_OAUTH_TOKEN secret	FAIL if missing
Permissions	Minimal required set	WARN if excessive

Step 4: Generate compliance report

Print a formatted compliance report showing workflow status, per-workflow check results, and missing workflows.

If --check-only is set, stop here.

For the report format, see REFERENCE.md.

Step 5: Apply configuration (if --fix or user confirms)

1. Missing workflows: Create from standard templates
2. Outdated actions: Update version numbers
3. Missing multi-platform: Add platforms to build-push
4. Missing caching: Add GHA cache configuration
5. Duplicate Renovate identity: Delete the per-repo Renovate workflow only after the user confirms, since --fix never removes a workflow on its own

For standard templates (container build, test workflow), see REFERENCE.md.

Step 6: Update standards tracking

Update .project-standards.yaml:

components:
  workflows: "2025.1"

Agentic Optimizations

Context	Command
Quick compliance check	/configure:workflows --check-only
Auto-fix all issues	/configure:workflows --fix
List workflow files	find .github/workflows -name '*.yml' -o -name '*.yaml'
Check action versions	rg 'uses:' .github/workflows/ --no-heading
Verify release-please config	test -f release-please-config.json && echo "EXISTS"

Flags

Flag	Description
--check-only	Report status without offering fixes
--fix	Apply fixes automatically

See Also

• /configure:container - Comprehensive container infrastructure (builds, registry, scanning)
• /configure:dockerfile - Dockerfile configuration and security
• /configure:release-please - Release automation specifics
• /configure:all - Run all compliance checks
• ci-workflows skill - Workflow patterns
• github-actions-inspection skill - Workflow debugging