Workflow Skill Extraction Report — top 3 reusable-component opportunities

[github-actions[bot]]

Workflow Skill Extraction Report

Analysis of all 275 workflows in .github/workflows/ to identify high-impact, reusable shared-component opportunities (prompt skills, tool configurations, setup steps, data-processing patterns).

Method: Loaded /tmp/gh-aw/agent/workflow-index.json (per-workflow imports, engine, tool/safe-output flags, and frontmatter preview) to map usage at scale, then verified exact-substring frequency of candidate patterns directly against .github/workflows/*.md, and cross-checked against existing components under .github/workflows/shared/ to avoid duplicate recommendations.

Coverage summary

• 275 total workflows scanned.
• 232 already import shared/otlp.md, 53 import shared/reporting.md — these two are the most successful existing shared components and were excluded as candidates.
• Existing .github/workflows/shared/ already covers ~80 components (engines, MCP servers, reporting, network/otlp bundles, etc.), so this pass focused on frontmatter configuration blocks that are still duplicated inline rather than imported.

Top opportunities (priority-ranked)

1. High priority — Copilot high-privilege sandbox/engine bundle

engine.id: copilot + engine.copilot-sdk: true + max-tool-denials: 3 + sandbox.agent.sudo: false + tools.cli-proxy: true appear together as an exact block in 48 workflows, with the individual sub-fields reused far more broadly (sandbox.agent.sudo: false in 195 files, tools.cli-proxy: true in 206 files). This is the largest unextracted duplication pattern found. Proposed: shared/copilot-sandbox-standard.md.

2. High priority — network.allowed defaults baseline

112 workflows use the exact 3-line block network:\n allowed:\n - defaults, independent of the shared/otlp.md import (which adds its own network entries for Sentry/Grafana). Proposed: shared/network-defaults.md, composable alongside otlp.md.

3. Medium priority — slash-command status-comment/reaction preamble

34 workflows combine on.slash_command with status-comment: true (often plus reaction:) to give immediate UX feedback on command-triggered workflows. Values are workflow-specific (command name, events) so this is lower line-savings but valuable as a documented best-practice reference to prevent UX drift (e.g. some workflows have reaction:, some don't). Proposed: shared/slash-command-status-preamble.md as a documentation-style import.

Impact summary

Opportunity	Priority	Workflows affected	Est. line savings
Copilot sandbox/engine bundle	High	48 (exact) / up to ~200 (sub-fields)	200–1000+
network.allowed defaults	High	112	~336
slash-command status preamble	Medium	34	Low (consistency win)

Issues created

Three issues were filed with full details, migration plans, and example imports: usage:

• Copilot high-privilege sandbox/engine bundle (shared/copilot-sandbox-standard.md)
• network.allowed defaults baseline (shared/network-defaults.md)
• slash-command status-comment/reaction preamble guidance (shared/slash-command-status-preamble.md)

Next actions

• Prioritize the sandbox/engine bundle and network-defaults extractions first (highest impact, low risk — pure frontmatter merges verifiable via gh aw compile diff).
• Verify gh-aw's array-merge semantics for network.allowed before extracting the network-defaults component, since it must compose with shared/otlp.md's own network entries.
• Treat the slash-command preamble as a documentation/consistency cleanup rather than a literal frontmatter merge, given per-workflow command names/events.

Generated by 🔍 Workflow Skill Extractor · auto · 90.2 AIC · ⌖ 2.7 AIC · ⊞ 7K · ◷

• expires on Aug 12, 2026, 8:48 PM UTC-08:00