$npx -y skills add thomast1906/github-copilot-agent-skills --skill gh-aw-operationsComprehensive skills for creating, compiling, debugging, and managing GitHub Agentic Workflows (gh-aw) with best practices and common patterns
| 1 | # GitHub Agentic Workflows Operations Skill |
| 2 | |
| 3 | This skill provides expertise in creating, managing, and troubleshooting GitHub Agentic Workflows (gh-aw framework). |
| 4 | |
| 5 | ## When to Use |
| 6 | |
| 7 | - Creating new GitHub Agentic Workflows from scratch |
| 8 | - Configuring frontmatter fields (triggers, permissions, tools, safe-outputs, MCP servers) |
| 9 | - Debugging compilation errors or runtime failures in gh-aw workflows |
| 10 | - Adding safe-outputs or network allowlists to existing workflows |
| 11 | - Importing reusable agents and skills from external repositories |
| 12 | - Testing and deploying workflows to GitHub Actions |
| 13 | |
| 14 | ## Skill 1: Frontmatter Configuration |
| 15 | |
| 16 | ### Description |
| 17 | Configure workflow frontmatter with all required and optional fields following gh-aw specifications. |
| 18 | |
| 19 | ### Implementation Pattern |
| 20 | |
| 21 | ```yaml |
| 22 | --- |
| 23 | # ===== REQUIRED FIELDS ===== |
| 24 | on: |
| 25 | workflow_dispatch: |
| 26 | inputs: |
| 27 | parameter_name: |
| 28 | description: 'Clear description of parameter' |
| 29 | required: false |
| 30 | type: string|boolean|choice|number |
| 31 | default: "default_value" # Boolean: "true"/"false" as strings |
| 32 | schedule: |
| 33 | - cron: '0 9 * * 1' # Monday 9 AM UTC |
| 34 | issues: |
| 35 | types: [opened, labeled] |
| 36 | pull_request: |
| 37 | types: [opened, synchronize] |
| 38 | |
| 39 | engine: copilot # GitHub Copilot as AI engine |
| 40 | |
| 41 | permissions: |
| 42 | contents: read # NEVER use write — strict mode blocks it |
| 43 | pull-requests: read # All writes go through safe-outputs |
| 44 | issues: read |
| 45 | |
| 46 | # ===== TOOLS CONFIGURATION ===== |
| 47 | tools: |
| 48 | edit: # bare key — enables file read AND edit |
| 49 | bash: # bare key — default safe commands |
| 50 | github: |
| 51 | toolsets: [pull_requests] # Only include toolsets your workflow needs |
| 52 | |
| 53 | # ===== MCP SERVERS (if needed) ===== |
| 54 | mcp-servers: |
| 55 | terraform: |
| 56 | container: "hashicorp/terraform-mcp-server:0.5.1" |
| 57 | env: |
| 58 | TF_LOG: "INFO" |
| 59 | allowed: ["*"] |
| 60 | |
| 61 | # ===== SAFE OUTPUTS ===== |
| 62 | safe-outputs: |
| 63 | create-pull-request: |
| 64 | title-prefix: "[automated] " |
| 65 | labels: [automation] |
| 66 | draft: true |
| 67 | reviewers: [copilot] |
| 68 | expires: 14 |
| 69 | fallback-as-issue: true |
| 70 | create-issue: |
| 71 | title-prefix: "[bot] " |
| 72 | labels: [automation] |
| 73 | expires: 7 |
| 74 | update-issue: null |
| 75 | add-comment: null |
| 76 | |
| 77 | # ===== NETWORK ACCESS ===== |
| 78 | network: |
| 79 | allowed: |
| 80 | - defaults |
| 81 | - registry.terraform.io |
| 82 | - releases.hashicorp.com |
| 83 | - api.github.com |
| 84 | |
| 85 | # ===== IMPORTS (if using reusable agents/skills) ===== |
| 86 | imports: |
| 87 | - owner/repo/.github/agents/agent-name.agent.md@main |
| 88 | - owner/repo/.github/skills/skill-name/SKILL.md@main |
| 89 | --- |
| 90 | ``` |
| 91 | |
| 92 | ### Key Rules |
| 93 | - **`edit:` is a bare key** (no value) — enables both reading and writing files. `edit: null` and `edit: true` both fail compilation. |
| 94 | - **`read:` is not a valid tool** — file reading is provided by `edit:`. |
| 95 | - **`bash:` is a bare key** (no value) for default safe commands, or `bash: ["cmd"]` for specific commands. |
| 96 | - **`contents: write` / `pull-requests: write` / `issues: write` are blocked by strict mode** — use `safe-outputs:` for all write operations instead. |
| 97 | - **`pull_request:` trigger requires `types:`** — bare `pull_request:` fails compilation. |
| 98 | - **`workflow_dispatch:` is a bare key** — `workflow_dispatch: null` fails compilation. |
| 99 | - **Toolsets and permissions must align** — `toolsets: [default]` includes the `issues` toolset which requires `issues: read`; only declare the toolsets you actually need. |
| 100 | - Boolean defaults must be strings: `default: "true"` not `default: true` |
| 101 | - Safe-output fields use hyphens: `create-pull-request` not `create_pull_request` |
| 102 | - Imports use `owner/repo/path@ref` format, not raw GitHub URLs |
| 103 | - Safe-outputs can be bare key (default config) or object (custom config) |
| 104 | |
| 105 | --- |
| 106 | |
| 107 | ## Skill 2: Safe-Outputs Configuration |
| 108 | |
| 109 | ### Description |
| 110 | Configure safe-outputs for GitHub operations (PRs, issues, comments) with proper validation and best practices. |
| 111 | |
| 112 | ### Common Safe-Output Patterns |
| 113 | |
| 114 | #### Pattern: Pull Request Creation |
| 115 | ```yaml |
| 116 | safe-outputs: |
| 117 | create-pull-request: |
| 118 | title-prefix: "[type] " |
| 119 | labels: [automation, bot-generated] |
| 120 | draft: true |
| 121 | reviewers: [copilot] |
| 122 | expires: 14 # Auto-close after 14 days |
| 123 | fallback-as-issue: true # Create issue if PR fails |
| 124 | base-branch: main # Target branch |
| 125 | ``` |
| 126 | |
| 127 | **When to use:** |
| 128 | - Automated code changes |
| 129 | - Dependency upgrades |
| 130 | - Code generation |
| 131 | - Refactoring |
| 132 | |
| 133 | #### Pattern: Issue Creation |
| 134 | ```yaml |
| 135 | safe-outputs: |
| 136 | create-issue: |
| 137 | title-prefix: "[report] " |
| 138 | labels: [automation, needs-review] |
| 139 | assignees: [copilot] |
| 140 | expires: 7 |
| 141 | group: true # Group multiple issues as sub-issues |
| 142 | close-older-issues: true # Close previous issues from same workflow |
| 143 | ``` |
| 144 | |
| 145 | **When to use:** |
| 146 | - Reporting findings |
| 147 | - Tracking tasks |
| 148 | - Alerting on issues |
| 149 | - Documentat |