github-actions

Mode Detection

Determine the mode based on context:

• Create mode: No .github/workflows/ directory exists, or user explicitly asks to create/add a workflow
• Audit mode: .github/workflows/*.yml files exist, or user explicitly asks to audit/review/fix workflows

Create Mode

1. Detect Project Type

Scan for project indicators:

• package.json → Node.js/JS/TS
• go.mod → Go
• requirements.txt / pyproject.toml / setup.py → Python
• Cargo.toml → Rust
• Gemfile → Ruby

2. Detect Package Manager (JS/TS projects)

• pnpm-lock.yaml → pnpm
• bun.lock / bun.lockb → bun
• yarn.lock → yarn
• package-lock.json → npm

3. Generate Workflow

Apply all rules from the rules/ directory when generating workflows. Read each rule file for detailed requirements and examples.

4. Workflow Template

Adapt this CI template to the detected project type and package manager (replace <pm> with the detected package manager):

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  ci:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 'lts/*'
          cache: '<pm>'
      - run: <pm> install --frozen-lockfile
      - run: <pm> check
      - run: <pm> test
      - run: <pm> build

Audit Mode

1. Scan Workflows

Read all files in .github/workflows/*.yml and audit against every rule in the rules/ directory.

2. Report Format

## GitHub Actions Audit Results

### HIGH Severity
- `.github/workflows/ci.yml:15` - `codecov/codecov-action@v4` → pin to commit SHA

### MEDIUM Severity
- `.github/workflows/ci.yml` - Missing concurrency group → add concurrency block

### Summary
- High: X
- Medium: Y
- Low: Z
- Files scanned: N

3. Auto-Fix

After reporting, apply fixes. Look up commit SHAs for pinning using gh api.

Rules

Read individual rule files for detailed checks and examples:

Assumptions

• GitHub CLI (gh) is available for looking up action commit SHAs
• The project is hosted on GitHub