Introducing auto-gha: Instant GitHub Actions & Security Workflows for Any Repo

The Problem

Setting up GitHub Actions CI/CD for a new project usually means copying YAML snippets from previous projects, forgetting to configure dependency caching, missing job timeouts, or manually tweaking security scanners.

In polyglot projects or monorepos, this gets tedious and error-prone very quickly.

Enter auto-gha

Today, I'm excited to share auto-gha, a zero-configuration policy compiler and CLI that generates production-grade, hardened GitHub Actions workflows for any repository in seconds.

Built with TypeScript and a modular monorepo architecture, auto-gha doesn't guess with AI prompts—it uses deterministic filesystem detectors to discover your runtimes, package managers, and Docker infrastructure, then resolves official GitHub Actions starter patterns.

What it generates automatically

• .github/workflows/ci.yml

  • Parallel test matrix
  • Native dependency caching (cache-dependency-path)
  • 15-minute job timeouts
  • Concurrency cancellations

• .github/workflows/security.yml

  • Lockfile audits (npm audit, pip-audit, cargo audit, govulncheck)
  • Trivy filesystem/manifest scanning
  • Hadolint

• .github/workflows/codeql.yml

  • Deep static application security testing (SAST) for supported languages

• .github/dependabot.yml

  • Automated dependency update configurations
  • PR grouping to prevent repository spam

How to Get Started

You don't even need to install it:

bash
# Run in your current project
npx auto-gha

# Or inspect any remote GitHub URL
npx auto-gha https://github.com/expressjs/express