github-project-automation

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

GitHub Project Automation

GitHub 项目自动化

Status: Production Ready ✅ Last Updated: 2025-12-17 Version: 2.0.0 (Optimized with progressive disclosure) Dependencies: None (git and gh CLI recommended) Latest Versions: actions/checkout@v4.2.2, actions/setup-node@v4.1.0, github/codeql-action@v3.27.4

状态：已就绪可用于生产环境 ✅ 最后更新时间：2025-12-17 版本：2.0.0（采用渐进式披露优化） 依赖项：无（推荐安装 git 和 gh CLI） 最新版本组件：actions/checkout@v4.2.2, actions/setup-node@v4.1.0, github/codeql-action@v3.27.4

Quick Start (15 Minutes)

快速开始（15分钟）

1. Choose Your Framework

1. 选择适配的框架

Select the workflow template that matches your project:

bash

undefined

选择与你的项目匹配的工作流模板：

bash

undefined

For React/Vite projects

适用于 React/Vite 项目

cp templates/workflows/ci-react.yml .github/workflows/ci.yml

For Node.js libraries (matrix testing)

适用于 Node.js 库（多版本矩阵测试）

cp templates/workflows/ci-node.yml .github/workflows/ci.yml

For Python projects

适用于 Python 项目

cp templates/workflows/ci-python.yml .github/workflows/ci.yml

For Cloudflare Workers

适用于 Cloudflare Workers

cp templates/workflows/ci-cloudflare-workers.yml .github/workflows/deploy.yml

For basic projects (any framework)

适用于基础项目（任意框架）

cp templates/workflows/ci-basic.yml .github/workflows/ci.yml


**Why this matters:**
- Pre-validated YAML prevents syntax errors
- SHA-pinned actions for security
- Explicit runner versions (ubuntu-24.04)
- All 8 GitHub Actions errors prevented

cp templates/workflows/ci-basic.yml .github/workflows/ci.yml


**为什么这很重要：**
- 预先验证的 YAML 文件可避免语法错误
- 基于 SHA 固定版本的组件提升安全性
- 明确指定运行器版本（ubuntu-24.04）
- 可避免 GitHub Actions 的全部8类常见错误

2. Add Issue Templates

2. 添加 Issue 模板

bash

undefined

bash

undefined

Create directory structure

创建目录结构

mkdir -p .github/ISSUE_TEMPLATE

Copy YAML templates (with validation)

复制带验证功能的 YAML 模板

cp templates/issue-templates/bug_report.yml .github/ISSUE_TEMPLATE/ cp templates/issue-templates/feature_request.yml .github/ISSUE_TEMPLATE/


**Why YAML over Markdown:**
- Required field validation (Error #12 prevented)
- Consistent data structure
- Better user experience
- No incomplete issues

cp templates/issue-templates/bug_report.yml .github/ISSUE_TEMPLATE/ cp templates/issue-templates/feature_request.yml .github/ISSUE_TEMPLATE/


**为什么选择 YAML 而非 Markdown：**
- 必填字段验证（可避免第12类错误）
- 数据结构一致
- 用户体验更优
- 不会出现信息缺失的 Issue

3. Enable Security Scanning

3. 启用安全扫描

bash

undefined

bash

undefined

CodeQL for code analysis

使用 CodeQL 进行代码分析

cp templates/workflows/security-codeql.yml .github/workflows/codeql.yml

Dependabot for dependency updates

使用 Dependabot 进行依赖更新

cp templates/security/dependabot.yml .github/dependabot.yml


**CRITICAL:**
- CodeQL requires specific permissions (security-events: write)
- Dependabot has 10 PR limit per ecosystem
- Both must run on Dependabot PRs (Error #13 prevention)

---

cp templates/security/dependabot.yml .github/dependabot.yml


**关键注意事项：**
- CodeQL 需要特定权限（security-events: write）
- Dependabot 每个生态系统最多生成10个 PR
- 两者都必须在 Dependabot PR 上运行（避免第13类错误）

---

The 5-Step Complete Setup Process

完整搭建流程（5步骤）

Step 1: Repository Structure

步骤1：仓库结构

Create the standard GitHub automation directory structure:

bash

undefined

创建标准的 GitHub 自动化目录结构：

bash

undefined

Create all required directories

创建所有必需目录

mkdir -p .github/{workflows,ISSUE_TEMPLATE}

Verify structure

验证结构

tree .github/

.github/

├── workflows/ # GitHub Actions workflows

├── workflows/ # GitHub Actions 工作流

├── ISSUE_TEMPLATE/ # Issue templates

├── ISSUE_TEMPLATE/ # Issue 模板

└── dependabot.yml # Dependabot config (root of .github/)

└── dependabot.yml # Dependabot 配置文件（位于 .github/ 根目录）


**Key Points:**
- workflows/ is plural
- ISSUE_TEMPLATE/ is singular (legacy naming)
- dependabot.yml goes in .github/, NOT workflows/


**核心要点：**
- workflows/ 为复数形式
- ISSUE_TEMPLATE/ 为单数形式（历史命名规则）
- dependabot.yml 需放在 .github/ 目录下，而非 workflows/

Step 2: Select Workflow Templates

步骤2：选择工作流模板

Choose workflows based on your project needs:

Continuous Integration (pick ONE):

```
ci-basic.yml
```
- Generic test/lint/build (all frameworks)
```
ci-node.yml
```
- Node.js with matrix testing (18, 20, 22)
```
ci-python.yml
```
- Python with matrix testing (3.10, 3.11, 3.12)
```
ci-react.yml
```
- React/TypeScript with type checking

Deployment (optional): 5.

ci-cloudflare-workers.yml

- Deploy to Cloudflare Workers

Security (recommended): 6.

security-codeql.yml

- Code scanning 7.

dependabot.yml

- Dependency updates

Copy selected templates:

bash

undefined

根据项目需求选择工作流：

持续集成（选其一）：

```
ci-basic.yml
```
- 通用测试/代码检查/构建（支持所有框架）
```
ci-node.yml
```
- Node.js 多版本矩阵测试（18、20、22）
```
ci-python.yml
```
- Python 多版本矩阵测试（3.10、3.11、3.12）
```
ci-react.yml
```
- React/TypeScript 类型检查

部署（可选）： 5.

ci-cloudflare-workers.yml

- 部署到 Cloudflare Workers

安全（推荐）： 6.

security-codeql.yml

- 代码扫描 7.

dependabot.yml

- 依赖更新

复制选中的模板：

bash

undefined

Example: React app with security

示例：带安全功能的 React 应用

cp templates/workflows/ci-react.yml .github/workflows/ci.yml cp templates/workflows/security-codeql.yml .github/workflows/codeql.yml cp templates/security/dependabot.yml .github/dependabot.yml

undefined

cp templates/workflows/ci-react.yml .github/workflows/ci.yml cp templates/workflows/security-codeql.yml .github/workflows/codeql.yml cp templates/security/dependabot.yml .github/dependabot.yml

undefined

Step 3: Configure Secrets (if deploying)

步骤3：配置密钥（若需部署）

For deployment workflows (Cloudflare, AWS, etc.), add secrets:

bash

undefined

对于部署类工作流（Cloudflare、AWS 等），添加密钥：

bash

undefined

Using gh CLI

使用 gh CLI

gh secret set CLOUDFLARE_API_TOKEN

Paste your token when prompted

提示时粘贴你的令牌

Verify

验证

gh secret list


**Critical Syntax:**
```yaml

gh secret list


**关键语法：**
```yaml

✅ CORRECT

✅ 正确写法

env: API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

❌ WRONG - Missing double braces

❌ 错误写法 - 缺少双大括号

env: API_TOKEN: $secrets.CLOUDFLARE_API_TOKEN


Prevents Error #6 (secrets syntax).

env: API_TOKEN: $secrets.CLOUDFLARE_API_TOKEN


可避免第6类错误（密钥语法错误）。

Step 4: Add Issue/PR Templates

步骤4：添加 Issue/PR 模板

Issue templates (YAML format):

bash

cp templates/issue-templates/bug_report.yml .github/ISSUE_TEMPLATE/
cp templates/issue-templates/feature_request.yml .github/ISSUE_TEMPLATE/

PR template (Markdown format):

bash

cp templates/pr-templates/PULL_REQUEST_TEMPLATE.md .github/

Why separate formats:

Issue templates: YAML for validation
PR template: Markdown (GitHub limitation)

Issue 模板（YAML 格式）：

bash

cp templates/issue-templates/bug_report.yml .github/ISSUE_TEMPLATE/
cp templates/issue-templates/feature_request.yml .github/ISSUE_TEMPLATE/

PR 模板（Markdown 格式）：

bash

cp templates/pr-templates/PULL_REQUEST_TEMPLATE.md .github/

为什么使用不同格式：

Issue 模板：YAML 支持验证功能
PR 模板：Markdown（GitHub 平台限制）

Step 5: Customize for Your Project

步骤5：针对项目自定义配置

Required customizations:

Update usernames/emails:

yaml

# In issue templates
assignees:
  - secondsky  # ← Change to your GitHub username

# In dependabot.yml
reviewers:
  - "secondsky"  # ← Change to your username

Adjust languages (CodeQL):

yaml

# In security-codeql.yml
matrix:
  language: ['javascript-typescript']  # ← Add your languages
  # Options: c-cpp, csharp, go, java-kotlin, python, ruby, swift

Update package manager (Dependabot):

yaml

# In dependabot.yml
- package-ecosystem: "npm"  # ← Change if using yarn/pnpm/pip/etc

Set deployment URL (Cloudflare):

yaml

# In ci-cloudflare-workers.yml
echo "Worker URL: https://your-worker.your-subdomain.workers.dev"
# ← Update with your actual Worker URL

必需的自定义项：

更新用户名/邮箱：

yaml

# 在 Issue 模板中
assignees:
  - secondsky  # ← 修改为你的 GitHub 用户名

# 在 dependabot.yml 中
reviewers:
  - "secondsky"  # ← 修改为你的用户名

调整语言配置（CodeQL）：

yaml

# 在 security-codeql.yml 中
matrix:
  language: ['javascript-typescript']  # ← 添加你的项目语言
  # 可选值：c-cpp, csharp, go, java-kotlin, python, ruby, swift

更新包管理器（Dependabot）：

yaml

# 在 dependabot.yml 中
- package-ecosystem: "npm"  # ← 若使用 yarn/pnpm/pip 等请修改

设置部署 URL（Cloudflare）：

yaml

# 在 ci-cloudflare-workers.yml 中
echo "Worker URL: https://your-worker.your-subdomain.workers.dev"
# ← 更新为你的实际 Worker URL

Critical Rules

关键规则

Always Do

必须遵守

✅ Pin actions to SHA, not @latest

yaml

undefined

✅ 将组件版本固定到 SHA，而非 @latest

yaml

undefined

✅ CORRECT

✅ 正确写法

uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

❌ WRONG

❌ 错误写法

uses: actions/checkout@latest


✅ **Use explicit runner versions**
```yaml

uses: actions/checkout@latest


✅ **使用明确的运行器版本**
```yaml

✅ CORRECT

✅ 正确写法

runs-on: ubuntu-24.04 # Locked to specific LTS

runs-on: ubuntu-24.04 # 锁定到特定 LTS 版本

❌ RISKY

❌ 存在风险

runs-on: ubuntu-latest # Changes over time


✅ **Include secrets in context syntax**
```yaml

runs-on: ubuntu-latest # 版本会随时间变化


✅ **使用上下文语法引用密钥**
```yaml

✅ CORRECT

✅ 正确写法

${{ secrets.API_TOKEN }}

❌ WRONG

❌ 错误写法

$secrets.API_TOKEN


✅ **Validate YAML before committing**
```bash

$secrets.API_TOKEN


✅ **提交前验证 YAML 语法**
```bash

Use yamllint or GitHub's workflow validator

使用 yamllint 或 GitHub 的工作流验证工具

yamllint .github/workflows/*.yml


✅ **Test workflows on feature branch first**
```bash
git checkout -b test/github-actions

yamllint .github/workflows/*.yml


✅ **先在特性分支测试工作流**
```bash
git checkout -b test/github-actions

Push and verify CI runs before merging to main

推送代码并验证 CI 运行正常后，再合并到主分支

undefined

undefined

Never Do

绝对禁止

❌ Don't use @latest for action versions

Breaks without warning when actions update
Security risk (unvetted versions auto-adopted)

❌ Don't hardcode secrets in workflows

yaml

undefined

❌ 不要使用 @latest 作为组件版本

组件更新时会无预警地导致工作流崩溃
存在安全风险（自动采用未经验证的版本）

❌ 不要在工作流中硬编码密钥

yaml

undefined

❌ NEVER DO THIS

❌ 绝对禁止

env: API_TOKEN: "sk_live_abc123..." # Secret exposed in repo!


❌ **Don't skip build steps for compiled languages (CodeQL)**
```yaml

env: API_TOKEN: "sk_live_abc123..." # 密钥会在仓库中暴露！


❌ **编译型语言不要跳过构建步骤（CodeQL）**
```yaml

❌ WRONG - CodeQL fails for Java without build

❌ 错误写法 - Java 项目未构建时 CodeQL 会失败

name: Perform CodeQL Analysis # No .class files to analyze

name: Perform CodeQL Analysis # 没有可分析的 .class 文件

✅ CORRECT - Include build

✅ 正确写法 - 包含构建步骤

name: Build project run: ./mvnw clean install
name: Perform CodeQL Analysis # Now has .class files


❌ **Don't ignore devDependencies in Dependabot**
- DevDependencies run during build, can execute malicious code
- Include both prod and dev dependencies

❌ **Don't use single ISSUE_TEMPLATE.md file**

name: Build project run: ./mvnw clean install
name: Perform CodeQL Analysis # 现在有 .class 文件可分析


❌ **不要忽略 Dependabot 中的 devDependencies**
- devDependencies 会在构建阶段运行，可能执行恶意代码
- 需同时包含生产依赖和开发依赖

❌ **不要使用单一的 ISSUE_TEMPLATE.md 文件**

❌ OLD WAY

❌ 旧方式

.github/ISSUE_TEMPLATE.md

✅ NEW WAY

✅ 新方式

.github/ISSUE_TEMPLATE/ bug_report.yml feature_request.yml

---

.github/ISSUE_TEMPLATE/ bug_report.yml feature_request.yml

---

Known Issues Prevention (Top 5)

已知问题预防（Top 5）

This skill prevents 18 documented issues. Here are the top 5 most critical:

本技能可预防18类已记录的问题。以下是最关键的5类：

Issue #1: YAML Indentation Errors ⚠️ MOST COMMON

问题 #1：YAML 缩进错误 ⚠️ 最常见

Error:

workflow file is invalid. mapping values are not allowed in this context

Source: Stack Overflow (most common GitHub Actions error) Why It Happens: Spaces vs tabs, missing spaces after colons, inconsistent indentation Prevention: Use skill templates with validated 2-space indentation Impact: Workflow fails to parse, CI doesn't run

错误信息：

workflow file is invalid. mapping values are not allowed in this context

来源：Stack Overflow（GitHub Actions 最常见错误）原因：空格与制表符混用、冒号后缺少空格、缩进不一致 预防措施：使用本技能提供的预验证模板（统一使用2空格缩进）影响：工作流解析失败，CI 无法运行

Issue #2: Action Version Pinning Issues 🔒 SECURITY

问题 #2：组件版本固定问题 🔒 安全相关

Error: Workflow breaks unexpectedly after action updates Source: GitHub Security Best Practices 2025 Why It Happens: Using

@latest

@v4

instead of specific SHA Prevention: All templates pin to SHA with version comment Impact: Unexpected breaking changes, security vulnerabilities

错误表现：组件更新后工作流意外崩溃来源：GitHub 2025安全最佳实践原因：使用

@latest

或

@v4

而非具体 SHA 预防措施：所有模板都通过 SHA 固定版本，并附带版本注释影响：意外的破坏性变更、安全漏洞

Issue #3: Secrets Not Available 🔑

问题 #3：密钥不可用 🔑

Error:

Secret not found

or empty variable Source: GitHub Actions Debugging Guides Why It Happens: Wrong syntax (

$secrets.NAME

instead of

${{ secrets.NAME }}

) Prevention: Templates demonstrate correct context syntax Impact: Deployment failures, broken CI/CD pipelines

错误信息：

Secret not found

或变量为空来源：GitHub Actions 调试指南原因：语法错误（

$secrets.NAME

而非

${{ secrets.NAME }}

） 预防措施：模板演示了正确的上下文语法影响：部署失败、CI/CD 流水线中断

Issue #4: CodeQL Not Running on Dependabot PRs 🛡️

问题 #4：CodeQL 未在 Dependabot PR 上运行 🛡️

Error: Security scans skipped on dependency updates Source: GitHub Community Discussion #121836 Why It Happens: Default trigger limitations Prevention: Templates include

push: branches: [dependabot/**]

Impact: Vulnerable dependencies merged without scanning

错误表现：依赖更新时跳过安全扫描来源：GitHub 社区讨论 #121836 原因：默认触发规则限制 预防措施：模板包含

push: branches: [dependabot/**]

触发规则影响：易受攻击的依赖被合并而未经过扫描

Issue #5: Missing Required Fields in Issue Templates 📋

问题 #5：Issue 模板缺少必填字段 📋

Error: Incomplete issues, missing critical info Source: Community Feedback Why It Happens: Markdown templates don't validate Prevention: YAML templates with

required: true

validation Impact: Can't reproduce bugs, wasted triage time

For complete error documentation with all 18 issues: Load

references/common-errors.md

when debugging GitHub Actions issues or configuring workflows.

错误表现：Issue 信息不完整，缺少关键内容来源：社区反馈原因：Markdown 模板不支持验证 预防措施：使用带

required: true

验证的 YAML 模板影响：无法复现 bug、浪费分类处理时间

完整错误文档（包含全部18类问题）：调试 GitHub Actions 问题或配置工作流时，可查看

references/common-errors.md

。

When to Load References

何时加载参考文档

Load reference files when working on specific aspects of GitHub automation:

处理 GitHub 自动化的特定环节时，可加载对应参考文件：

Common Errors (

references/common-errors.md

)

常见错误（

references/common-errors.md

）

Load when:

Encountering workflow syntax errors
Debugging failed GitHub Actions runs
Setting up CodeQL or Dependabot for first time
Resolving "Secret not found" errors
Understanding why matrix builds fail
Need detailed solutions for any of the 18 documented errors

加载场景：

遇到工作流语法错误
调试失败的 GitHub Actions 运行
首次配置 CodeQL 或 Dependabot
解决「Secret not found」错误
排查矩阵构建失败原因
需要18类已记录错误的详细解决方案

Workflow Patterns (

references/workflow-patterns.md

)

工作流模式（

references/workflow-patterns.md

）

Load when:

Implementing multi-version testing (Node.js 18/20/22)
Setting up conditional deployments (main vs PR)
Sharing build artifacts between jobs
Integrating GitHub automation with other skills (cloudflare-worker-base, project-planning)
Optimizing workflow performance
Need examples of matrix strategies, artifact upload/download

加载场景：

实现多版本测试（Node.js 18/20/22）
设置条件部署（主分支 vs PR）
在任务间共享构建产物
将 GitHub 自动化与其他技能集成（cloudflare-worker-base、project-planning）
优化工作流性能
需要矩阵策略、产物上传/下载的示例

Configuration Examples (

references/configuration-examples.md

)

配置示例（

references/configuration-examples.md

）

Load when:

Creating dependabot.yml from scratch
Configuring CodeQL for specific languages
Setting up GitHub Actions secrets correctly
Need complete working configuration files
Understanding branch protection rules
Creating issue/PR templates with proper validation

加载场景：

从零创建 dependabot.yml
为特定语言配置 CodeQL
正确设置 GitHub Actions 密钥
需要完整可运行的配置文件
理解分支保护规则
创建带正确验证的 Issue/PR 模板

Troubleshooting Guide (

references/troubleshooting-guide.md

)

故障排除指南（

references/troubleshooting-guide.md

）

Load when:

Workflows not triggering despite pushing code
CodeQL reports "No code found to analyze"
Matrix builds all failing with same error
Dependabot PRs consistently failing CI
Permissions errors ("Resource not accessible by integration")
Need step-by-step debugging procedures

加载场景：

推送代码后工作流未触发
CodeQL 提示「No code found to analyze」
矩阵构建全部因相同错误失败
Dependabot PR 持续触发 CI 失败
权限错误（「Resource not accessible by integration」）
需要分步调试流程

Advanced Configurations (

references/advanced-configurations.md

)

高级配置（

references/advanced-configurations.md

）

Load when:

Setting up multi-environment deployments (staging/production)
Creating reusable workflows or composite actions
Optimizing CI/CD pipeline performance
Implementing advanced matrix strategies
Using OIDC for cloud authentication (no long-lived secrets)
Need workflow optimization techniques

加载场景：

设置多环境部署（预发布/生产）
创建可复用工作流或复合组件
优化 CI/CD 流水线性能
实现高级矩阵策略
使用 OIDC 进行云认证（无需长期密钥）
需要工作流优化技巧

Integration with Existing Skills

与现有技能集成

cloudflare-worker-base → Add CI/CD

cloudflare-worker-base → 添加 CI/CD

When user creates new Worker project:

bash

undefined

当用户创建新 Worker 项目时：

bash

undefined

User: "Create Cloudflare Worker with CI/CD"

用户：「创建带 CI/CD 的 Cloudflare Worker」

This skill runs AFTER cloudflare-worker-base

本技能在 cloudflare-worker-base 之后运行

cp templates/workflows/ci-cloudflare-workers.yml .github/workflows/deploy.yml

Configure secrets

配置密钥

gh secret set CLOUDFLARE_API_TOKEN


**Result**: New Worker with automated deployment on push to main

gh secret set CLOUDFLARE_API_TOKEN


**结果**：新 Worker 项目在推送到主分支时自动部署

project-planning → Generate Automation

project-planning → 生成自动化配置

When user uses project-planning skill:

bash

undefined

当用户使用 project-planning 技能时：

bash

undefined

User: "Plan new React app with GitHub automation"

用户：「规划带 GitHub 自动化的新 React 应用」

project-planning generates IMPLEMENTATION_PHASES.md

project-planning 生成 IMPLEMENTATION_PHASES.md

Then this skill sets up GitHub automation

然后本技能设置 GitHub 自动化

cp templates/workflows/ci-react.yml .github/workflows/ci.yml cp templates/issue-templates/*.yml .github/ISSUE_TEMPLATE/


**Result**: Planned project with complete GitHub automation

cp templates/workflows/ci-react.yml .github/workflows/ci.yml cp templates/issue-templates/*.yml .github/ISSUE_TEMPLATE/


**结果**：规划完成的项目已配置完整的 GitHub 自动化

open-source-contributions → Setup Contributor Experience

open-source-contributions → 搭建贡献者体验

When preparing project for open source:

bash

undefined

准备项目开源时：

bash

undefined

User: "Prepare repo for open source contributions"

用户：「准备仓库以接受开源贡献」

open-source-contributions skill handles CONTRIBUTING.md

open-source-contributions 技能处理 CONTRIBUTING.md

This skill adds issue templates and CODEOWNERS

本技能添加 Issue 模板和 CODEOWNERS

cp templates/issue-templates/*.yml .github/ISSUE_TEMPLATE/ cp templates/misc/CODEOWNERS .github/


**Result**: Contributor-friendly repository

---

cp templates/issue-templates/*.yml .github/ISSUE_TEMPLATE/ cp templates/misc/CODEOWNERS .github/


**结果**：仓库对贡献者更友好

---

Dependencies

依赖项

Required:

Git 2.0+ - Version control
GitHub CLI (gh) 2.0+ - Secret management, PR creation (optional but recommended)

Optional:

yamllint 1.20+ - YAML validation before commit
act (local GitHub Actions runner) - Test workflows locally

Install gh CLI:

bash

undefined

必需：

Git 2.0+ - 版本控制
GitHub CLI (gh) 2.0+ - 密钥管理、PR 创建（可选但推荐）

可选：

yamllint 1.20+ - 提交前验证 YAML 语法
act（本地 GitHub Actions 运行器）- 本地测试工作流

安装 gh CLI：

bash

undefined

macOS

brew install gh

Ubuntu

sudo apt install gh

Verify

验证

gh --version

---

gh --version

---

Official Documentation

官方文档

GitHub Actions: https://docs.github.com/en/actions
Workflow Syntax: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
CodeQL: https://codeql.github.com/docs/
Dependabot: https://docs.github.com/en/code-security/dependabot
Issue Templates: https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests

Context7 Library ID: Search for

/websites/github

/github/

in Context7 MCP

GitHub Actions：https://docs.github.com/en/actions
工作流语法：https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
CodeQL：https://codeql.github.com/docs/
Dependabot：https://docs.github.com/en/code-security/dependabot
Issue 模板：https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests

Context7 库 ID：在 Context7 MCP 中搜索

/websites/github

或

/github/

Complete Setup Checklist

完整搭建检查清单

Use this checklist to verify your GitHub automation setup:

Workflows:

Created
```
.github/workflows/
```
directory
Copied appropriate CI workflow template
Updated usernames in workflow files
Configured secrets (if deploying)
SHA-pinned all actions (not @latest)
Explicit runner version (ubuntu-24.04)
Workflow triggers match branches (main/master)

Issue Templates:

Created
```
.github/ISSUE_TEMPLATE/
```
directory
Copied bug_report.yml
Copied feature_request.yml
Updated assignees to your GitHub username
YAML templates use
```
required: true
```
for critical fields

PR Template:

Copied PULL_REQUEST_TEMPLATE.md to
```
.github/
```
Customized checklist for your project needs

Security:

Copied security-codeql.yml
Added correct languages to CodeQL matrix
Set
```
security-events: write
```
permission
Copied dependabot.yml
Updated package-ecosystem (npm/pip/etc.)
Set reviewers in dependabot.yml

Testing:

Pushed to feature branch first (not main)
Verified CI runs successfully
Checked Actions tab for any errors
Validated YAML syntax locally
Tested secret access (if applicable)

Documentation:

Added badge to README.md (optional)
Documented required secrets in README
Updated CONTRIBUTING.md (if open source)

Questions? Issues?

Check
```
references/common-errors.md
```
for all 18 errors
Verify workflow YAML is valid:
```
yamllint .github/workflows/*.yml
```
Check GitHub Actions tab for detailed error messages
Review official docs: https://docs.github.com/en/actions
Ensure secrets are configured:
```
gh secret list
```

Last Updated: 2025-12-17 Version: 2.0.0 (Optimized with progressive disclosure) Status: Production Ready

使用此清单验证你的 GitHub 自动化配置：

工作流：

创建了
```
.github/workflows/
```
目录
复制了合适的 CI 工作流模板
更新了工作流文件中的用户名
配置了密钥（若需部署）
所有组件都通过 SHA 固定版本（未使用 @latest）
指定了明确的运行器版本（ubuntu-24.04）
工作流触发规则匹配目标分支（main/master）

Issue 模板：

创建了
```
.github/ISSUE_TEMPLATE/
```
目录
复制了 bug_report.yml
复制了 feature_request.yml
更新了模板中的 assignees 为你的 GitHub 用户名
YAML 模板对关键字段设置了
```
required: true
```

PR 模板：

将 PULL_REQUEST_TEMPLATE.md 复制到
```
.github/
```
根据项目需求自定义了检查清单

安全：

复制了 security-codeql.yml
为 CodeQL 矩阵添加了正确的语言
设置了
```
security-events: write
```
权限
复制了 dependabot.yml
更新了 package-ecosystem（npm/pip 等）
在 dependabot.yml 中设置了 reviewers

测试：

先推送到特性分支（而非主分支）
验证 CI 运行成功
检查 Actions 标签页的错误信息
本地验证了 YAML 语法
测试了密钥访问（若适用）

文档：

为 README.md 添加了徽章（可选）
在 README 中记录了必需的密钥
更新了 CONTRIBUTING.md（若开源）

有疑问？遇到问题？

查看
```
references/common-errors.md
```
中的全部18类错误
验证工作流 YAML 有效性：
```
yamllint .github/workflows/*.yml
```
查看 GitHub Actions 标签页的详细错误信息
查阅官方文档：https://docs.github.com/en/actions
确保密钥已配置：
```
gh secret list
```

最后更新时间：2025-12-17 版本：2.0.0（采用渐进式披露优化）状态：已就绪可用于生产环境