workflow-audit

name	workflow-audit
description	Audit GitHub Actions workflows for correctness, security, and unattended reliability. Use when asked to audit workflows, check CI health, review workflow security, or before committing workflow changes.

Workflow Audit

Comprehensive audit of .github/workflows/*.yml files against GitHub Actions best practices, security hardening guidelines, and project conventions.

When to Use

• User asks to audit, review, or check workflows
• Before committing changes to any workflow file
• After a workflow failure that needs root-cause analysis
• Periodic health check (e.g., monthly)

Workflow

1. Discover — Glob .github/workflows/*.yml and list all workflow files.
2. Parse — Read each file; validate YAML syntax.
3. Audit — Run every check in the checklist below against each file.
4. Cross-check — Run cross-workflow consistency checks.
5. Report — Output a findings table sorted by severity (critical > high > medium > low).
6. Fix offer — For each finding, suggest a concrete fix (diff or instruction).

Audit Checklist

1. YAML Validity

• File parses as valid YAML.
• No duplicate keys at the same level.
• No tabs (GitHub Actions requires spaces).

2. Action Version Currency

Check every uses: line.

Pattern	Severity	Rule
actions/checkout@v4 or lower	critical