mirror of
https://github.com/VibedByKaKi/t3-code-android-nightly.git
synced 2026-10-11 21:01:16 +02:00
48 lines
2.6 KiB
Markdown
48 lines
2.6 KiB
Markdown
---
|
|
name: ci-maintenance
|
|
description: GitHub Actions maintenance. Use when authoring or reviewing workflows or composite actions, especially event, permission, action-reference, artifact, setup, or concurrency changes.
|
|
---
|
|
|
|
Audit the trust boundary before editing. This skill owns Actions event
|
|
semantics, workflow security, permissions, action pinning, setup reuse,
|
|
untrusted inputs, timeouts, concurrency, and artifact trust boundaries.
|
|
|
|
## Workflow
|
|
|
|
1. Decide whether this is a review or an implementation. Reviews produce
|
|
evidence-backed findings without editing; implementations continue through
|
|
the smallest boundary-preserving change.
|
|
2. Inspect every affected workflow, composite action, and caller. List all
|
|
affected jobs and actions before proceeding.
|
|
3. For each job, record the trigger, actor/fork status, workflow revision,
|
|
checked-out revision, permissions, credentials, and every external input and
|
|
consumer. Include artifacts, caches, outputs, PR fields, refs, dispatch
|
|
inputs, generated files, and called actions.
|
|
4. Consult current GitHub documentation for every platform-sensitive decision.
|
|
Repository examples establish local convention, not platform semantics.
|
|
5. Apply every applicable rule:
|
|
- Default workflow permissions to empty and grant minimal job permissions.
|
|
- Reuse the repository's shared setup action unless the environment must differ.
|
|
- Give executable jobs intentional matrices and realistic timeouts.
|
|
- Pin external actions and reusable workflows to full commit SHAs with
|
|
readable release comments; verify each SHA belongs to that upstream release.
|
|
- Analyze event choice, checkout revision, and credential persistence
|
|
together.
|
|
- Pass untrusted expressions through environment variables; validate and
|
|
quote them before use.
|
|
- Derive concurrency from interruption safety.
|
|
6. For forks, privileged credentials, publication, or cross-run data, read
|
|
[privileged-workflows.md](privileged-workflows.md).
|
|
7. Run the narrowest syntax and repository checks, inspect the complete diff,
|
|
and identify behavior testable only on GitHub-hosted runners.
|
|
|
|
For local patterns, inspect the current shared setup action and the nearest
|
|
workflow with the same trust boundary. Use ordinary check workflows for routine
|
|
precedent and privileged publication workflows only for equivalent trust
|
|
boundaries.
|
|
|
|
The task is complete when every affected job and caller has a recorded trust
|
|
boundary, every applicable rule has evidence or a compensating control, local
|
|
checks pass, and GitHub-only verification is identified. Reviews report every
|
|
failure with evidence; implementations resolve every failure and contain only
|
|
intended behavior.
|