ravelact

Run `ravelact` to perform static analysis on a GitHub Actions workflow estate — forward/reverse graph queries (trace, callers), trigger discovery, PR-diff impact, orphan detection, permissions/secrets propagation auditing across reusable-workflow chains, refactor helpers (composite extraction, near-duplicate clusters), and IR export (JSON, Mermaid). Use when working with `.github/workflows/*.{yml,yaml}` and `action.{yml,yaml}` files — for PR impact analysis, dependency-graph questions ("who calls this reusable workflow?", "what runs on push?"), permissions auditing, or refactoring a large GitHub Actions estate. Requires the `ravelact` binary on PATH first.

Use BEFORE any work touching GitHub Actions semantics in src/parser/, src/ir/, or src/query/ — including new EventKind variants, TriggerSpec fields, workflow_call inputs/outputs/secrets, SecretsPass logic, Permissions (Coarse/Scopes), CallsWorkflow, Composite actions, UsesRef, WorkflowRef, Step uses references, expressions and ${{}} contexts (github/env/vars/secrets/inputs/needs/matrix/steps/runner/job), GITHUB_TOKEN scopes, concurrency, environments, workflow commands (GITHUB_OUTPUT/GITHUB_ENV). Applies during both planning (/plan) and implementation (/impl). WebFetch the catalog URL before claiming spec behavior — never rely on memorized GA semantics.