Configure Reusable Workflows

/configure:reusable-workflows

Install Claude-powered reusable GitHub Actions workflows from claude-plugins into a project.

When to Use This Skill

Context

• Workflows dir: !find . -maxdepth 1 -type d -name \'.github/workflows\'
• Existing callers: !find . -path '*/.github/workflows/*' -maxdepth 3 -name 'claude-*'
• Package files: !find . -maxdepth 1 \( -name 'package.json' -o -name 'pyproject.toml' -o -name 'Cargo.toml' -o -name 'go.mod' \) -print -quit
• TypeScript files: !find . -maxdepth 2 \( -name '*.ts' -o -name '*.tsx' \) -print -quit
• Component files: !find . -maxdepth 3 \( -name '*.jsx' -o -name '*.vue' -o -name '*.svelte' \) -print -quit

Parameters

Parse from command arguments:

• --all: Install all workflows
• --security: Install security workflows only
• --quality: Install quality workflows only
• --a11y: Install accessibility workflows only
• --list: List available workflows without installing

Available Workflows

Security

Quality

Accessibility

Execution

Execute this reusable workflow installation:

Step 1: Detect current state

1. Check for .github/workflows/ directory (create if missing) 2. List any existing Claude-powered workflow callers 3. Determine project type from files present

Step 2: Select workflows

If no flags provided, ask the user which categories to install:

Available workflow categories:
  [1] Security (secrets, owasp, deps)
  [2] Quality (typescript, code-smell, async)
  [3] Accessibility (wcag, aria)
  [4] All workflows

Which categories? (comma-separated, e.g., 1,2):

If --list is set, print the Available Workflows tables above and stop.

Step 3: Generate caller workflows

For each selected workflow, create a caller file in .github/workflows/.

Filename convention: claude-<category>-<name>.yml

Example: claude-security-secrets.yml

Display name convention: The workflow's name: follows <Domain>: <Action> [<target>] (quoted because YAML treats : as a key separator). For these reusable callers, Claude: is the right domain. See .claude/rules/workflow-naming.md for the canonical rule and active domains. Example: name: "Claude: Security secrets".

Use the caller workflow template:

name: "Claude: <Action> <target>"

on:
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: write
  id-token: write

jobs:
  check:
    uses: laurigates/.github/.github/workflows/reusable-<category>-<name>.yml@main
    with:
      # Default inputs - customize as needed
      max-turns: 5
    secrets: inherit

For complete caller workflow files per category, see REFERENCE.md.

Step 4: Remind about secrets

After installation, print the required secret configuration:

Required secret: CLAUDE_CODE_OAUTH_TOKEN

To configure:
1. Go to repository Settings > Secrets and variables > Actions
2. Add secret: CLAUDE_CODE_OAUTH_TOKEN
3. Value: Your Claude Code OAuth token

Get token from: https://console.anthropic.com/

Customization

After installation, users can customize:

Post-Installation

1. Configure secret: Add CLAUDE_CODE_OAUTH_TOKEN to repository secrets 2. Customize patterns: Edit file-patterns to match project structure 3. Adjust triggers: Modify paths filters for relevant file types 4. Test manually: Use workflow_dispatch to test before PR triggers

Agentic Optimizations

Flags

See Also

• /configure:workflows - Standard CI/CD workflows (container, release-please)
• /configure:security - Security tooling configuration
• ci-workflows skill - Workflow patterns

configure-reusable-workflows Reference

Security Caller Workflows

.github/workflows/claude-security-secrets.yml

name: Claude Security - Secrets Detection

on:
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: write
  id-token: write

jobs:
  scan:
    uses: laurigates/.github/.github/workflows/reusable-security-secrets.yml@main
    with:
      file-patterns: '**/*'
      max-turns: 5
    secrets: inherit

.github/workflows/claude-security-owasp.yml

name: Claude Security - OWASP

on:
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: write
  id-token: write

jobs:
  scan:
    uses: laurigates/.github/.github/workflows/reusable-security-owasp.yml@main
    with:
      file-patterns: '**/*.{js,ts,jsx,tsx,py}'
      max-turns: 6
      fail-on-critical: true
    secrets: inherit

.github/workflows/claude-security-deps.yml

name: Claude Security - Dependencies

on:
  pull_request:
    branches: [main]
    paths:
      - 'package*.json'
      - 'requirements*.txt'
      - 'Pipfile*'
      - 'poetry.lock'
      - 'go.sum'
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: write
  id-token: write

jobs:
  audit:
    uses: laurigates/.github/.github/workflows/reusable-security-deps.yml@main
    with:
      package-manager: 'auto'
      max-turns: 5
      fail-on-high: true
    secrets: inherit

Quality Caller Workflows

.github/workflows/claude-quality-typescript.yml

name: Claude Quality - TypeScript

on:
  pull_request:
    branches: [main]
    paths:
      - '**/*.ts'
      - '**/*.tsx'
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: write
  id-token: write

jobs:
  analyze:
    uses: laurigates/.github/.github/workflows/reusable-quality-typescript.yml@main
    with:
      file-patterns: '**/*.{ts,tsx}'
      max-turns: 6
      strict-mode: true
    secrets: inherit

.github/workflows/claude-quality-code-smell.yml

name: Claude Quality - Code Smell

on:
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: write
  id-token: write

jobs:
  analyze:
    uses: laurigates/.github/.github/workflows/reusable-quality-code-smell.yml@main
    with:
      file-patterns: '**/*.{js,ts,jsx,tsx,py}'
      max-turns: 5
      severity-threshold: 'medium'
    secrets: inherit

.github/workflows/claude-quality-async.yml

name: Claude Quality - Async Patterns

on:
  pull_request:
    branches: [main]
    paths:
      - '**/*.ts'
      - '**/*.tsx'
      - '**/*.js'
      - '**/*.jsx'
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: write
  id-token: write

jobs:
  analyze:
    uses: laurigates/.github/.github/workflows/reusable-quality-async.yml@main
    with:
      file-patterns: '**/*.{js,ts,jsx,tsx}'
      max-turns: 5
    secrets: inherit

Accessibility Caller Workflows

.github/workflows/claude-a11y-wcag.yml

name: Claude A11y - WCAG

on:
  pull_request:
    branches: [main]
    paths:
      - '**/*.tsx'
      - '**/*.jsx'
      - '**/*.vue'
      - '**/*.svelte'
      - '**/*.html'
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: write
  id-token: write

jobs:
  check:
    uses: laurigates/.github/.github/workflows/reusable-a11y-wcag.yml@main
    with:
      file-patterns: '**/*.{tsx,jsx,vue,svelte,html}'
      max-turns: 6
      wcag-level: 'AA'
    secrets: inherit

.github/workflows/claude-a11y-aria.yml

name: Claude A11y - ARIA

on:
  pull_request:
    branches: [main]
    paths:
      - '**/*.tsx'
      - '**/*.jsx'
      - '**/*.vue'
      - '**/*.svelte'
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: write
  id-token: write

jobs:
  check:
    uses: laurigates/.github/.github/workflows/reusable-a11y-aria.yml@main
    with:
      file-patterns: '**/*.{tsx,jsx,vue,svelte}'
      max-turns: 5
    secrets: inherit