ci-maintenance

1---2name: ci-maintenance3description: GitHub Actions maintenance. Use when authoring or reviewing workflows or composite actions, especially event, permission, action-reference, artifact, setup, or concurrency changes.4---5 6Audit the trust boundary before editing. This skill owns Actions event7semantics, workflow security, permissions, action pinning, setup reuse,8untrusted inputs, timeouts, concurrency, and artifact trust boundaries.9 10## Workflow11 121. Decide whether this is a review or an implementation. Reviews produce13   evidence-backed findings without editing; implementations continue through14   the smallest boundary-preserving change.152. Inspect every affected workflow, composite action, and caller. List all16   affected jobs and actions before proceeding.173. For each job, record the trigger, actor/fork status, workflow revision,18   checked-out revision, permissions, credentials, and every external input and19   consumer. Include artifacts, caches, outputs, PR fields, refs, dispatch20   inputs, generated files, and called actions.214. Consult current GitHub documentation for every platform-sensitive decision.22   Repository examples establish local convention, not platform semantics.235. Apply every applicable rule:24   - Default workflow permissions to empty and grant minimal job permissions.25   - Reuse the repository's shared setup action unless the environment must differ.26   - Give executable jobs intentional matrices and realistic timeouts.27   - Pin external actions and reusable workflows to full commit SHAs with28     readable release comments; verify each SHA belongs to that upstream release.29   - Analyze event choice, checkout revision, and credential persistence30     together.31   - Pass untrusted expressions through environment variables; validate and32     quote them before use.33   - Derive concurrency from interruption safety.346. For forks, privileged credentials, publication, or cross-run data, read35   [privileged-workflows.md](privileged-workflows.md).367. Run the narrowest syntax and repository checks, inspect the complete diff,37   and identify behavior testable only on GitHub-hosted runners.38 39For local patterns, inspect the current shared setup action and the nearest40workflow with the same trust boundary. Use ordinary check workflows for routine41precedent and privileged publication workflows only for equivalent trust42boundaries.43 44The task is complete when every affected job and caller has a recorded trust45boundary, every applicable rule has evidence or a compensating control, local46checks pass, and GitHub-only verification is identified. Reviews report every47failure with evidence; implementations resolve every failure and contain only48intended behavior.49