New skill for upgrading github workflow actions

.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
     {
       "name": "cc-ai-dev",
       "source": "./skills/development",
-      "description": "Requirement-to-code workflow skills: interview-driven specifications, traceable development plans, plan-driven implementation, plan-less direct implementation, workflow runs under a user-confirmed skill selection, root-cause bug diagnosis, evidence-driven refactoring, unattended goal-driven iteration loops, and CLAUDE.md synchronisation with the shared upstream template. All skills load on explicit invocation only (/cc-ai-dev:<skill> in Claude Code, /<skill> in Copilot, or the skill name in the prompt).",
+      "description": "Requirement-to-code workflow skills: interview-driven specifications, traceable development plans, plan-driven implementation, plan-less direct implementation, workflow runs under a user-confirmed skill selection, root-cause bug diagnosis, design-driven code writing, evidence-driven refactoring, unattended goal-driven iteration loops, CLAUDE.md synchronisation with the shared upstream template, and age-gated, SHA-pinned GitHub Actions upgrades. All skills except upgrade-gh-wf-actions load on explicit invocation only (/cc-ai-dev:<skill> in Claude Code, /<skill> in Copilot, or the skill name in the prompt); upgrade-gh-wf-actions also activates on requests to upgrade or pin GitHub Actions.",
       "author": {
         "name": "CreativeCodersTeam",
         "url": "https://github.com/CreativeCodersTeam"

.github/workflows/validate-skills.yml

@@ -2,7 +2,6 @@ name: Validate skills and plugins
 
 on:
   push:
-    branches: [main]
   pull_request:
   workflow_dispatch:
 

CLAUDE.md

@@ -22,8 +22,9 @@ bash scripts/validate-skills.sh                # 0 ok / 1 validation failures /
 bash scripts/validate-skills.sh --warn-at 800  # lower the "approaching the limit" warning threshold
 ```
 
-Two skills have an automated test suite for their scripts, both living under `skills/tests/`, not
-inside the skill: `dotnet-reviewer` and `claude-md-downstream`. Run from the repository root:
+Three skills have an automated test suite for their scripts, all living under `skills/tests/`, not
+inside the skill: `dotnet-reviewer`, `claude-md-downstream`, and `upgrade-gh-wf-actions`. Run from the
+repository root:
 
 ```bash
 S=skills/tests/dotnet/dotnet-reviewer/scripts
@@ -54,6 +55,16 @@ fixture on purpose). A new test file therefore calls `fixtures/make-fixtures.sh`
 assuming a fixture exists; `KEEP_FIXTURES=1` suspends the cleanup for debugging, and running a
 single test file directly leaves the fixtures behind for you to `clean-fixtures.sh`.
 
+```bash
+S=skills/tests/development/upgrade-gh-wf-actions/scripts
+bash $S/run-tests.sh                 # all unit tests; static fixtures, nothing to clean up
+```
+
+The `upgrade-gh-wf-actions` suite replaces `gh` with `$S/mock-gh/gh` (responses from
+`$S/fixtures/gh-data/`), so it needs neither network nor a GitHub login. Its fixture `action.yml`
+files are found by `scan-actions.sh` when the skill runs on this repository — exclude
+`skills/tests`.
+
 The `angular-reviewer` and `gherkin-bdd-reviewer` scripts have no test suite; verify them by hand.
 
 ## Skill anatomy

README.md

@@ -2,7 +2,7 @@
 
 A curated collection of [Agent Skills](https://code.claude.com/docs/en/skills) for Claude Code and compatible AI coding agents, organized by technology stack.
 
-Each skill is a self-contained `SKILL.md` file that teaches the agent a specific workflow or set of best practices — from implementing .NET features and reviewing Angular code to writing Gherkin scenarios and refactoring safely. Skills are loaded automatically when relevant, or can be invoked explicitly by name. The [Development](skills/development) category loads on explicit invocation only.
+Each skill is a self-contained `SKILL.md` file that teaches the agent a specific workflow or set of best practices — from implementing .NET features and reviewing Angular code to writing Gherkin scenarios and refactoring safely. Skills are loaded automatically when relevant, or can be invoked explicitly by name. The [Development](skills/development) category loads on explicit invocation only, except `upgrade-gh-wf-actions`.
 
 The repository's skills are organized in the following categories:
 
@@ -11,7 +11,7 @@ The repository's skills are organized in the following categories:
 | [Angular](skills/angular) | 11 | Angular development, testing, reviews, libraries |
 | [.NET](skills/dotnet) | 11 | .NET/C# development, ASP.NET Core, EF Core, NuGet |
 | [General](skills/general) | 7 | Language-agnostic workflows: reviews, BDD, docs, prompts |
-| [Development](skills/development) | 10 | Requirement engineering, diagnosis, and code quality: interview-driven specifications, traceable development plans, plan-driven and plan-less direct implementation, workflow runs under a user-confirmed skill selection, root-cause bug diagnosis, design-driven code writing, evidence-driven refactoring, unattended goal-driven iteration loops, and CLAUDE.md synchronisation with the shared upstream template (explicit invocation only) |
+| [Development](skills/development) | 11 | Requirement engineering, diagnosis, and code quality: interview-driven specifications, traceable development plans, plan-driven and plan-less direct implementation, workflow runs under a user-confirmed skill selection, root-cause bug diagnosis, design-driven code writing, evidence-driven refactoring, unattended goal-driven iteration loops, CLAUDE.md synchronisation with the shared upstream template, and age-gated, SHA-pinned GitHub Actions upgrades (explicit invocation only, except `upgrade-gh-wf-actions`) |
 | [Java](skills/java) | 4 | Spring Boot, JUnit 5, Javadoc |
 | [TypeScript](skills/typescript) | 2 | Jest, RxJS |
 
@@ -26,7 +26,7 @@ work in both **Claude Code** and the **GitHub Copilot CLI** — the two read the
 |---|---|---|
 | `cc-ai-angular` | 11 | The complete [Angular](skills/angular) category: `angular`, `angular-dev`, `angular-fundamentals`, `angular-components`, `angular-state`, `angular-rxjs`, `angular-library-builder`, `angular-tester`, `angular-reviewer`, `angular-package-manager`, `angular-tsdoc` |
 | `cc-ai-dotnet` | 11 | The complete [.NET](skills/dotnet) category: `dotnet`, `dotnet-dev`, `dotnet-fundamentals`, `dotnet-aspnet`, `dotnet-ef-core`, `dotnet-sdk-builder`, `dotnet-tester`, `dotnet-reviewer`, `dotnet-inspect`, `dotnet-nuget-manager`, `dotnet-xmldocs` |
-| `cc-ai-dev` | 10 | The complete [Development](skills/development) category: `create-dev-spec`, `create-dev-plan`, `implement-dev-plan`, `implement-direct`, `run-with-skills`, `diagnose-bug`, `code-design`, `refactor`, `auto-loop`, `claude-md-downstream` |
+| `cc-ai-dev` | 11 | The complete [Development](skills/development) category: `create-dev-spec`, `create-dev-plan`, `implement-dev-plan`, `implement-direct`, `run-with-skills`, `diagnose-bug`, `code-design`, `refactor`, `auto-loop`, `claude-md-downstream`, `upgrade-gh-wf-actions` |
 
 ### Claude Code
 
@@ -231,10 +231,12 @@ Restart Claude Code afterwards and run `/skills` to confirm the skills are loade
 
 ### Development
 
-Every skill in this category loads on **explicit invocation only** — `/name` (`/cc-ai-dev:name` when
-installed as a plugin in Claude Code) or the skill name in the prompt. None of them activates from a
-task description alone; "spec this out", "why does this test fail", or "clean this up" are answered
-as ordinary requests.
+Every skill in this category except `upgrade-gh-wf-actions` loads on **explicit invocation only** —
+`/name` (`/cc-ai-dev:name` when installed as a plugin in Claude Code) or the skill name in the prompt.
+None of them activates from a task description alone; "spec this out", "why does this test fail", or
+"clean this up" are answered as ordinary requests. `upgrade-gh-wf-actions` also activates on a
+request to upgrade or SHA-pin a repository's GitHub Actions; it writes nothing before the user has
+picked the upgrades.
 
 | Skill | Description |
 |---|---|
@@ -248,6 +250,7 @@ as ordinary requests.
 | `refactor` | Improves the structure of existing code in a defined scope without changing behaviour: smell analysis with `file:line` evidence, a prioritised report in `docs/refactoring/`, user-selected candidates, a coverage gate per candidate, then one named refactoring per step with build, test, and lint verification and rollback on red. Never fixes bugs along the way, never commits |
 | `auto-loop` | Runs an explicitly requested goal as an unattended iteration loop: a setup interview fixes criteria, verification commands, budget, scope limits, and Git strategy, then every round takes one step against `docs/auto-loop/<slug>.md` as its only memory, commits on green and rolls back on red. Stops on met criteria, exhausted budget, stagnation, a needed scope violation, or a contradiction, always with a closing report. Commits to its own branch, never merges or pushes |
 | `claude-md-downstream` | Synchronises a `CLAUDE.md` with the shared template published in this repository, in `repo` mode (the working repository's root `CLAUDE.md`) or `user` mode (`~/.claude/CLAUDE.md`): finds the template version the file grew out of, so local additions and upstream changes can be told apart, classifies every difference, checks the merged result for contradictions, resolves each conflict with the user, and writes only after approval — with a backup, and never a commit |
+| `upgrade-gh-wf-actions` | Upgrades the GitHub Actions used in `.github/workflows` and composite actions: finds every remote action with a newer release that is at least a minimum age old (default 7 days, adjustable) to sit out freshly compromised releases, lists action, current version, new version, and age — newest same-major and newest overall side by side, plus pin-only rows for mutable tags — flags rows whose release notes mention breaking changes or deprecations and targets that still declare a runtime GitHub removed, lets the user multi-select, rewrites the chosen lines to `@<commit-sha> # vX.Y.Z` with the SHA resolved from the action's own tags, and summarises what the release notes of the applied upgrades mean for the repository. Never commits |
 
 ### Java
 

skills/development/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-ai-dev",
-  "description": "Requirement-to-code workflow skills: interview-driven specifications, traceable development plans, plan-driven implementation, plan-less direct implementation, workflow runs under a user-confirmed skill selection, root-cause bug diagnosis, design-driven code writing, evidence-driven refactoring, unattended goal-driven iteration loops, and CLAUDE.md synchronisation with the shared upstream template. All skills load on explicit invocation only (/cc-ai-dev:<skill> in Claude Code, /<skill> in Copilot, or the skill name in the prompt).",
+  "description": "Requirement-to-code workflow skills: interview-driven specifications, traceable development plans, plan-driven implementation, plan-less direct implementation, workflow runs under a user-confirmed skill selection, root-cause bug diagnosis, design-driven code writing, evidence-driven refactoring, unattended goal-driven iteration loops, CLAUDE.md synchronisation with the shared upstream template, and age-gated, SHA-pinned GitHub Actions upgrades. All skills except upgrade-gh-wf-actions load on explicit invocation only (/cc-ai-dev:<skill> in Claude Code, /<skill> in Copilot, or the skill name in the prompt); upgrade-gh-wf-actions also activates on requests to upgrade or pin GitHub Actions.",
   "author": {
     "name": "CreativeCodersTeam",
     "url": "https://github.com/CreativeCodersTeam"
@@ -17,7 +17,9 @@
     "code-design",
     "workflow",
     "autonomy",
-    "claude-md"
+    "claude-md",
+    "github-actions",
+    "supply-chain"
   ],
   "skills": [
     "./create-dev-spec",
@@ -29,6 +31,7 @@
     "./code-design",
     "./refactor",
     "./auto-loop",
-    "./claude-md-downstream"
+    "./claude-md-downstream",
+    "./upgrade-gh-wf-actions"
   ]
 }