These loadouts cover both sides of agents and CI. One runs Claude Code or Codex headless in a workflow with a read-only token, a spend cap and pinned versions. Another is for agents that write workflows: actions pinned to commit SHAs, permissions: {} by default, untrusted event text kept out of run scripts, and zizmor as the check. The rest ship a workflow for their stack: swift test on Linux with the views built on macOS, EAS Update to preview only when the native fingerprint matches, and Electron tests under xvfb.
Every one installs for Claude Code, Codex CLI, Cursor, Gemini CLI, Antigravity CLI and GitHub Copilot unless its card says otherwise.
Playwright tests that drive the real Electron app: secure webPreferences, no Node in the renderer, IPC round trips, input validation and blocked navigation.
Checks whether an Expo change can ship as an EAS Update or needs a new build, using the native fingerprint; preview by CI, production rollouts by a person.
Rules and a zizmor skill for agents editing GitHub Actions: SHA-pinned actions, permissions: {}, no template injection, no pull_request_target, read-only agent jobs.
Rules and a GitHub Actions template for unattended claude -p or codex exec: bare mode, read-only, a spend cap, pinned versions, PR text as untrusted data.
SwiftUI screens as thin views over @Observable view models in a Swift package, tested with Swift Testing by swift test on Linux and macOS CI.
Looking for something narrower? Search within GitHub Actions or filter everything.