github-actions-review

name	github-actions-review
description	Review GitHub Actions workflows for correctness, security, and maintainability. Use when reviewing GitHub Actions workflow PRs, checking workflow security, evaluating CI/CD pipeline design, or assessing permissions and secret handling.
license	Apache-2.0
metadata	{"author":"y-miyazaki","version":"1.0.1"}

Input

• Workflow YAML and/or composite action YAML (action.yml) + PR context (required)

Output Specification

Return structured Markdown in accordance with references/common-output-format.md.

Minimal inline contract (used if reference file is unavailable):

## Checks Summary

- Total: <n>, Passed: <n>, Failed: <n>, Deferred: <n>

## Checks (Failed/Deferred Only)

| ItemID | Status | Evidence | Fix |

## Issues

1. <ItemID>: <title>
   - File: <path>#L<line>
   - Problem: <specific>
   - Recommendation: <fix>

Execution Scope

• Systematically apply review checklist from references/common-checklist.md
• Do not run github-actions-validation or execute actionlint/ghalint/zizmor
• Do not modify workflow files or approve/merge PRs

USE FOR:

• review workflow security and correctness after validation output is available
• assess trigger design, permissions, and secrets handling with human judgment
• review multi-workflow PRs for policy and maintainability risks

DO NOT USE FOR:

• execute syntax/security validators (actionlint, ghalint, zizmor)
• auto-fix workflow YAML files
• replace github-actions-validation for deterministic checks

Reference Files Guide

• common-checklist.md (always read)
• common-output-format.md (always read)
• category-global.md (always read)
• category-security.md (always read)
• category-best-practices.md (always read)
• category-error-handling.md (always read)
• category-performance.md (always read)
• category-tool-integration.md (always read)
• common-troubleshooting.md (read on failure)

Workflow

1. Read PR context and workflow intent; extract events, permissions, secret usage, and external action references.
2. Confirm github-actions-validation results are attached. If missing, inform user that validation should run first, then proceed with partial review: evaluate security and permissions checks directly from YAML, defer syntax/lint-dependent checks (mark as Deferred with reason "validation evidence unavailable").
3. Review relevant checklist categories and collect failed/deferred items.
4. Order issues in output by severity: SEC-* first, then correctness, then maintainability.
5. Output report with the required sections per references/common-output-format.md. Include file path, line reference, and remediation step for each issue.

Error Handling

Condition	Severity	Action
github-actions-validation output missing	Recoverable	Defer lint-dependent checks, review security/permissions directly
common-checklist.md unavailable	Fatal	Stop, report missing dependency
common-output-format.md unavailable	Recoverable	Use inline output contract
PR contains no workflow YAML files	Recoverable	Report "no reviewable workflows" and stop

Examples

• Prompt: Review workflow PR and report failed/deferred checks.
• Output: ## Checks Summary + ## Checks (Failed/Deferred Only) + ## Issues, with each issue including file path, line, and remediation.