code-review-infra

Étoiles1

Forks0

Mis à jour13 juillet 2026 à 10:10

Reviews infrastructure changes: GitHub Actions workflows, Terraform, Dockerfiles, docker-compose, IaC. Focuses on supply-chain pinning, secret handling, least-privilege permissions, action versions, and CI failure modes. Always verifies action hash pins when present.

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Source

gsarig

gsarig/skills

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Métiers associésSOC

Basé sur la classification professionnelle SOC

Analystes en assurance qualité des logiciels et testeursProfessions informatiques et mathématiques·SOC 15-1253

SKILL.md

readonly

name	code-review-infra
description	Reviews infrastructure changes: GitHub Actions workflows, Terraform, Dockerfiles, docker-compose, IaC. Focuses on supply-chain pinning, secret handling, least-privilege permissions, action versions, and CI failure modes. Always verifies action hash pins when present.
when_to_use	Use for reviews of infrastructure files (`.github/`, `.tf`, `Dockerfile`, `docker-compose`). Invoked directly with a PR URL or diff file path, or dispatched by `/code-review`. Follow all steps in order; do not shortcut based on this description.
argument-hint	[PR URL \| path to diff file] [--source=...] [--pr=<URL>] [--file=<path>]
effort	xhigh
allowed-tools	Bash(git ) Bash(gh ) Read Grep

Steps

1. Source and diff

Read ~/.claude/skills/code-review/references/review-shared.md and follow its source detection and diff fetching sections. If --source and the corresponding identifier args were passed, use those and skip any prompting.

2. GitHub Actions hash verification

If the diff contains any line matching ^\+\s*uses:\s+\S+@[0-9a-f]{40}, run the verification per the shared doc for every pinned action. Infra reviews always run this step when pins are present.

3. Review

Read ~/.claude/skills/code-review/references/review-checklist.md first.

Focus on:

Supply-chain pinning: third-party actions pinned to a 40-char hash, comments accurately name the corresponding tag, dependabot configured if appropriate.
Secret handling: no secrets in plain text, no secrets echoed or set-output, scoped via repository secrets or OIDC, redacted in logs.
Least-privilege permissions: explicit permissions: blocks at the job or workflow level, GITHUB_TOKEN scope minimised, no blanket write-all.
Action version recency: pin against a current major; flag deprecated actions (e.g. set-output, save-state).
Dockerfile hygiene: non-root user, image pinning (digest or specific tag, not latest), layer-cache friendliness, no secrets baked into image, multi-stage builds where appropriate.
IaC drift risk: missing state backend lock, destructive operations (forced replacements, deletions), unbounded blast radius.
CI failure modes that block deploys: missing fallbacks, single points of failure, flaky external dependencies, missing timeouts.

Apply the common review rules from the shared doc.

4. Output

Format per the output section of ~/.claude/skills/code-review/references/review-shared.md. The linter section does not apply; do not run a linter.

Plus depuis ce dépôt

même dépôt

claude-windows

gsarig/skills

Computes the optimal Claude usage-window ping schedule from work hours and creates or reconciles the scheduled cloud routines that pin the window boundaries.

2026-07-131

code-review-content

gsarig/skills

Reviews changes to prose files (markdown, text, blog posts, docs). Focuses on voice, grammar, factual claims, dead links, and structure. Loads the project's voice or style guide when one exists. Skips linter and Actions hash verification.

2026-07-131

code-review-deep

gsarig/skills

Full code review for large or security-sensitive changes. Gathers requirements first, loads all relevant language references, runs the linter where applicable, applies the full review checklist with security as the top priority.

2026-07-131

code-review-lite

gsarig/skills

Abbreviated code review for small or low-stakes code changes. Skips requirements gathering. Skips the linter in PR mode (CI runs it). Focuses on correctness against obvious intent, readability, and pattern consistency. For large or security-sensitive diffs, use code-review-deep instead.

2026-07-131

code-review

gsarig/skills

Orchestrator. Triages a PR, local diff, patch file, or staged/branch changes into one of four review types (content, code-lite, code-deep, infra) and dispatches to the matching child skill. Use this when you don't already know which depth or type of review you want. For a known type, invoke the child skill directly.

2026-07-131

devils-advocate

gsarig/skills

Produces a one-shot devil's-advocate critique of a plan, design, or decision: steel-manned strengths first, then severity-tagged findings each with a concrete alternative, then a verdict.

2026-07-131

name	code-review-infra
description	Reviews infrastructure changes: GitHub Actions workflows, Terraform, Dockerfiles, docker-compose, IaC. Focuses on supply-chain pinning, secret handling, least-privilege permissions, action versions, and CI failure modes. Always verifies action hash pins when present.
when_to_use	Use for reviews of infrastructure files (`.github/`, `.tf`, `Dockerfile`, `docker-compose`). Invoked directly with a PR URL or diff file path, or dispatched by `/code-review`. Follow all steps in order; do not shortcut based on this description.
argument-hint	[PR URL \| path to diff file] [--source=...] [--pr=<URL>] [--file=<path>]
effort	xhigh
allowed-tools	Bash(git ) Bash(gh ) Read Grep

Steps

1. Source and diff

2. GitHub Actions hash verification

If the diff contains any line matching ^\+\s*uses:\s+\S+@[0-9a-f]{40}, run the verification per the shared doc for every pinned action. Infra reviews always run this step when pins are present.

3. Review

Read ~/.claude/skills/code-review/references/review-checklist.md first.

Focus on:

Supply-chain pinning: third-party actions pinned to a 40-char hash, comments accurately name the corresponding tag, dependabot configured if appropriate.
Secret handling: no secrets in plain text, no secrets echoed or set-output, scoped via repository secrets or OIDC, redacted in logs.
Least-privilege permissions: explicit permissions: blocks at the job or workflow level, GITHUB_TOKEN scope minimised, no blanket write-all.
Action version recency: pin against a current major; flag deprecated actions (e.g. set-output, save-state).
Dockerfile hygiene: non-root user, image pinning (digest or specific tag, not latest), layer-cache friendliness, no secrets baked into image, multi-stage builds where appropriate.
IaC drift risk: missing state backend lock, destructive operations (forced replacements, deletions), unbounded blast radius.
CI failure modes that block deploys: missing fallbacks, single points of failure, flaky external dependencies, missing timeouts.

Apply the common review rules from the shared doc.

4. Output

Format per the output section of ~/.claude/skills/code-review/references/review-shared.md. The linter section does not apply; do not run a linter.