feat: add github-actions-workflow-linter skill and cloud-finops-advisor

[Venchoes]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the main branch for this pull request.

---

Description

This PR adds two related contributions covering DevOps CI/CD security and cloud cost management, both aligned with the course's Full Cycle Development practices.

🧰 Skill: github-actions-workflow-linter

Teaches Copilot to perform a security- and best-practice-focused lint pass over CI/CD workflow definitions (primarily GitHub Actions .yml/.yaml files under .github/workflows/, with secondary support for GitLab CI .gitlab-ci.yml). The skill automatically activates whenever a user asks to review, audit, harden, or fix a workflow file, or when the active file matches a workflow path.

It checks for:

• Action pinning — flags actions pinned to mutable tags (e.g. @v4, @main) instead of a full commit SHA, treating unpinned third-party actions as Critical severity due to supply-chain risk.
• Secrets handling — flags secrets interpolated directly into run: shell commands instead of passed via env:, and flags unsafe pull_request_target + secrets combinations that enable privilege escalation.
• Permissions — flags missing or overly broad permissions: blocks (e.g. write-all), recommending least-privilege scoping.
• Deprecated commands — flags legacy workflow commands (::set-output, ::set-env, etc.) and outdated runner images/action versions.
• General pipeline hygiene — missing timeout-minutes, missing dependency caching, self-hosted runners exposed to fork PRs, and missing concurrency: groups on deploy workflows.

Output is a structured, severity-ranked report (Critical/High/Medium/Low) with concrete fixed YAML snippets for each finding, or Copilot can apply fixes directly when asked.

🎭 Agent: cloud-finops-advisor

A FinOps-focused persona that turns Copilot Chat into a specialist for cloud cost analysis and optimization across AWS, GCP, and Azure. Structures its work around the FinOps Foundation's Inform → Optimize → Operate phases.

Core responsibilities:

• Bill/cost analysis — breaks down billing exports (AWS CUR, GCP Billing Export, Azure Cost Management) by service/region/tag, flags anomalies, and identifies idle or "zombie" resources (unattached volumes, unused Elastic IPs, orphaned snapshots).
• Right-sizing & commitment strategy — recommends instance right-sizing based on utilization data, and quantifies Reserved Instance / Savings Plan / Committed Use Discount recommendations with estimated break-even periods, explicitly flagging over-commitment risk.
• Architecture review — reviews Terraform/CloudFormation/Bicep/Pulumi for cost-inefficient patterns (over-provisioned databases, cross-AZ data transfer, always-on infra for spiky workloads) and suggests cost-aware alternatives, always disclosing reliability/latency trade-offs.
• Governance — recommends tagging strategy, budget alerts, anomaly detection tooling, and embedding cost checks (e.g. Infracost) into CI/CD.

Recommendations are always output as a prioritized, quantified action list (quick wins vs. structural changes vs. governance), and the agent never fabricates dollar figures without real billing data — it uses clearly marked placeholders instead.

Why together

Both contributions target the DevOps/Cloud practices covered in the course (CI/CD pipeline security and cloud cost management under a Full Cycle Development approach), and are submitted together as a themed bundle per the CONTRIBUTING.md guidance encouraging Skill + Agent pairs.

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• New canvas extension.
• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.
• Other (please specify):

---

Additional Notes

Tested both in GitHub Copilot Chat:

• github-actions-workflow-linter: validated against sample workflows containing unpinned uses: references, hardcoded secrets in run: steps, and missing permissions: blocks — the skill correctly flagged all seeded issues with accurate severity and suggested concrete fixes.
• cloud-finops-advisor: validated with a sample AWS Cost and Usage Report summary and a small Terraform config — the agent correctly identified an unattached EBS volume and an over-provisioned RDS instance, and produced a Savings Plan break-even estimate.

Both files passed npm run skill:validate and npm run build locally, with README.md regenerated accordingly.

[github-actions]

🔒 PR Risk Scan Results

Scanned 4 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	1
ℹ️ Info	0

Severity	Rule	File	Line	Match
🟠	package-exec-command	docs/README.skills.md	31	| [acreadiness-assess](../skills/acreadiness-assess/SKILL.md)<br />`gh skills install github/awesome-copilot acreadiness-assess` | Run the AgentRC readiness assessment on the curre

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🔍 Vally Lint Results

⚠️ Warnings or advisories found

Scope	Checked
Skills	1
Agents	1
Total	2

Severity	Count
❌ Errors	0
⚠️ Warnings	0
ℹ️ Advisories	1

Summary

Level	Finding
ℹ️	Vally currently lints SKILL.md content. Agent files were detected but skipped:

Full linter output

### Linting skills/github-actions-workflow-linter
npm warn EBADENGINE Unsupported engine {
npm warn EBADENGINE   package: 'commander@15.0.0',
npm warn EBADENGINE   required: { node: '>=22.12.0' },
npm warn EBADENGINE   current: { node: 'v20.20.2', npm: '10.8.2' }
npm warn EBADENGINE }
npm warn deprecated prebuild-install@7.1.3: No longer maintained. Please contact the author of the relevant native addon; alternatives are available.
✅ github-actions-workflow-linter (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

### Agent files detected (not linted by vally)
ℹ️ Vally currently lints SKILL.md content. Agent files were detected but skipped:
agents/cloud-finops-advisor.agent.md

[Copilot]

Pull request overview

This pull request adds two new Copilot resources to the Awesome Copilot repository: a new skill for linting CI workflow YAML (GitHub Actions / GitLab CI) with a security/best-practice focus, and a new agent for FinOps-style cloud cost analysis and optimization, plus the corresponding documentation index updates.

Changes:

• Added github-actions-workflow-linter skill describing checks for action pinning, secret handling, permissions, deprecated commands, and pipeline hygiene.
• Added cloud-finops-advisor agent defining a structured FinOps approach (Inform → Optimize → Operate) and a standardized findings/report format.
• Registered both additions in the generated docs tables (docs/README.skills.md, docs/README.agents.md).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
skills/github-actions-workflow-linter/SKILL.md	New skill definition and guidance for reviewing/linting CI workflow YAML with security best practices.
agents/cloud-finops-advisor.agent.md	New FinOps-focused agent definition for cloud cost analysis and optimization across AWS/GCP/Azure.
docs/README.skills.md	Adds the new skill to the skills documentation index table.
docs/README.agents.md	Adds the new agent to the agents documentation index table.

[aaronpowell]

We already have several contributions for GitHub Actions across skills, instructions, and agents. Please review whether your changes can be incorporated in those rather than another standalone skill.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.