Инструменты

GitHub's official CLI: manage pull requests, issues, releases and Actions workflows from the terminal. Most commands support --json output that agents can parse, and an official agent skill is available. Run gh auth login first.

GitHub's official MCP server: lets agents read and write repositories and code, manage issues and pull requests, and check Actions workflows and code-scanning alerts. Use the hosted remote server or run it locally in Docker; needs a personal access token or OAuth.

Runs GitHub Actions workflows locally in Docker, so you can test .github/workflows changes without repeated commits and pushes, or use workflows as a local task runner. Needs Docker installed.

Trail of Bits skill that audits GitHub Actions workflows wired to AI coding agents (Claude Code Action, Codex, Gemini CLI and others) for prompt injection, env-variable relays, dangerous sandbox settings, wildcard allowlists and other privilege risks.

Static security analysis for CI/CD config: finds template injection, credential leaks, excessive permissions and more in GitHub Actions workflows, also covers Dependabot and pre-commit configs, and auto-fixes some findings.

GitHub's official gh extension for writing Actions workflows in Markdown that AI agents execute, compiled into standard Actions. Choose engines like Copilot, Claude Code or Codex; runs in a read-only sandbox by default. Requires gh.