Name: uinaf/gh-setup
Rating: 97.6 (1 reviews)
Author: uinaf

uinaf/gh-setup

Set up or align GitHub repo settings, branch/ruleset policy, templates, Actions hardening, Environments, release workflows, and deploy workflows for continuously publishable or deployable repositories.

1.35x

Quality

100%

Does it follow best practices?

Impact

96%

1.35x

Average score across 7 eval scenarios

Securityby

Passed

No known issues

Evaluation results

97%

33%

Automate Binary Releases for a Go CLI Tool

Criteria

Without context

With context

Tag-only SR plugins

100%

GoReleaser conditional

70%

100%

GoReleaser --clean flag

100%

Tap repo naming

100%

TAP_GITHUB_TOKEN scope

50%

100%

Attestation permissions

100%

Attest step conditional

100%

GoReleaser brews block

100%

No non-Go Homebrew action for Go

100%

fetch-depth: 0

50%

100%

skip ci guards

100%

Release concurrency

100%

Secrets on step

100%

SR action version

50%

98%

54%

Set Up Automated Release Pipeline for npm Library

Criteria

Without context

With context

fetch-depth verify

100%

fetch-depth release

100%

Verify concurrency group

100%

Release concurrency group

100%

skip ci on verify

100%

skip ci on release

100%

Bot identity in step env

100%

Bot uses noreply address

100%

Release permissions

50%

66%

semantic-release action version

100%

Plugin order

62%

100%

Matching preset

100%

git plugin message

100%

No registry token auth

100%

release needs verify

100%

GitHub token on step

100%

Checkout credential boundary

83%

100%

npm package metadata

100%

37%

Publish a TypeScript GitHub Action to the Marketplace with Automated Releases

Criteria

Without context

With context

action.yml uses dist/index.js

100%

dist built in verify

100%

Moving major tag step

66%

100%

Major tag step is conditional

75%

100%

No npm publish plugin

100%

SR plugins for action

100%

git before github

100%

skip ci on both jobs

100%

Release concurrency non-cancellable

100%

fetch-depth: 0

50%

100%

Bot identity in step env

100%

SR action current major

100%

94%

Preserve the Working Homebrew Tap Pattern

Criteria

Without context

With context

Uses sibling action

100%

Removes incompatible action

100%

No inline tap hack

100%

Direct tap inputs

100%

Conditional on release

100%

Token scope documented

100%

Preserves semantic-release

100%

No broad PAT advice

100%

Mentions sibling precedent

No manual PR requirement

100%

94%

30%

GitHub Actions Pipeline for a Two-App Monorepo

Criteria

Without context

With context

paths-filter for detection

25%

Lockfile in filter

100%

fetch-depth 0 on changes job

22%

100%

Lane conditional build

100%

Deploy non-cancellable

100%

Verify/e2e cancellable

100%

Concurrency group lane-scoped

100%

Shared concurrency key

100%

Explicit result check

100%

Manual deploy workflow

100%

validated redeploy ref

62%

100%

Independent lane verification

100%

95%

21%

Reliable GitHub Actions Deploy Pipeline for a React SPA

Criteria

Without context

With context

No rebuild in deploy

100%

Exact payload tested in e2e

88%

100%

Payload boundary justified

85%

100%

Missing output fails

100%

Framework output covered

83%

100%

Lane-specific payload identity

20%

100%

Separate stages

100%

Monitoring handoff present

80%

100%

No cheap smoke substitute

100%

GITHUB_STEP_SUMMARY

100%

Deploy needs both verify and e2e

60%

100%

Post-deploy handoff has no deploy credentials

33%

100%

Timeouts set

100%

Artifact exception hygiene

60%

80%

Stable no-op result

33%

Matrix controls

50%

100%

98%

-1%

Secure Secrets and Credentials Wiring for a GitHub Actions Deploy Pipeline

Criteria

Without context

With context

Environment-scoped runtime env

100%

91%

op:// references in template

100%

OIDC for cloud credentials

100%

id-token write at job level

100%

Root permissions minimal

100%

Production environment declared

100%

Post-deploy handoff credential isolation

100%

No secrets as CLI flags

100%

No env file dump

100%

non-sensitive ids in vars

100%

Fine-grained PAT

100%

GitHub secrets only for bootstrap

80%

Evaluated: 6 days ago
Agent: Claude Code
Model: Claude Sonnet 4.6

Table of Contents

Automate Binary Releases for a Go CLI Tool Set Up Automated Release Pipeline for npm Library Publish a TypeScript GitHub Action to the Marketplace with Automated Releases Preserve the Working Homebrew Tap Pattern GitHub Actions Pipeline for a Two-App Monorepo Reliable GitHub Actions Deploy Pipeline for a React SPA Secure Secrets and Credentials Wiring for a GitHub Actions Deploy Pipeline