{"slug":"yaml","title":"YAML and CI workflows","extensions":[".yml",".yaml"],"entry_languages":["Yaml"],"prompts":295,"repos":12,"sample":[{"repository":"EbookFoundation/free-programming-books","slug":"ebookfoundation-free-programming-books","checks":0},{"repository":"TheAlgorithms/Python","slug":"thealgorithms-python","checks":7},{"repository":"Kong/kong","slug":"kong-kong","checks":0},{"repository":"prisma/prisma","slug":"prisma-prisma","checks":7},{"repository":"istio/istio","slug":"istio-istio","checks":1},{"repository":"QwenLM/qwen-code","slug":"qwenlm-qwen-code","checks":13},{"repository":"anthropics/claude-code","slug":"anthropics-claude-code","checks":1},{"repository":"SWE-agent/SWE-agent","slug":"swe-agent-swe-agent","checks":6},{"repository":"astral-sh/ty","slug":"astral-sh-ty","checks":10},{"repository":"openai/codex-security","slug":"openai-codex-security","checks":15},{"repository":"bridgecrewio/checkov","slug":"bridgecrewio-checkov","checks":8},{"repository":"Azure/Azure-Sentinel","slug":"azure-azure-sentinel","checks":6}],"tools":[{"id":"ci-matrix","method":"testing","kind":"version-matrix","languages":["*"],"upstream":"https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations","docs":null,"autofix":false,"exit_codes":{},"repos":5,"share":42,"commands":["analyze (language: 5)","analyze (ref: 2, language: 1)","behavior (node: 2)"],"run":"analyze (language: 5)","via":null,"triggers":["ci"],"examples":[{"repository":"prisma/prisma","slug":"prisma-prisma"},{"repository":"QwenLM/qwen-code","slug":"qwenlm-qwen-code"},{"repository":"openai/codex-security","slug":"openai-codex-security"},{"repository":"bridgecrewio/checkov","slug":"bridgecrewio-checkov"},{"repository":"Azure/Azure-Sentinel","slug":"azure-azure-sentinel"}]},{"id":"prettier","method":"formatting","kind":"formatting","languages":["javascript","typescript","yaml","config","docs"],"upstream":"https://github.com/prettier/prettier","docs":"https://prettier.io/docs/cli#exit-codes","autofix":true,"exit_codes":{"0":"everything formatted","1":"something was not formatted (--check)","2":"prettier error"},"repos":5,"share":42,"commands":["prettier --experimental-cli --write .","pre-commit hook prettier"],"run":"prettier --experimental-cli --write .","via":"pre-commit hook prettier","triggers":["pre_commit","ci","local"],"examples":[{"repository":"QwenLM/qwen-code","slug":"qwenlm-qwen-code"},{"repository":"SWE-agent/SWE-agent","slug":"swe-agent-swe-agent"},{"repository":"astral-sh/ty","slug":"astral-sh-ty"},{"repository":"openai/codex-security","slug":"openai-codex-security"},{"repository":"Azure/Azure-Sentinel","slug":"azure-azure-sentinel"}]},{"id":"codeql","method":"static_analysis","kind":"security-scanning","languages":["*"],"upstream":"https://github.com/github/codeql","docs":null,"autofix":false,"exit_codes":{},"repos":4,"share":33,"commands":["uses github/codeql-action/analyze"],"run":null,"via":"GitHub Action github/codeql-action/analyze","triggers":["ci"],"examples":[{"repository":"prisma/prisma","slug":"prisma-prisma"},{"repository":"QwenLM/qwen-code","slug":"qwenlm-qwen-code"},{"repository":"bridgecrewio/checkov","slug":"bridgecrewio-checkov"},{"repository":"Azure/Azure-Sentinel","slug":"azure-azure-sentinel"}]},{"id":"pre-commit-hooks","method":"formatting","kind":"file-hygiene","languages":["*"],"upstream":"https://github.com/pre-commit/pre-commit-hooks","docs":null,"autofix":true,"exit_codes":{},"repos":4,"share":33,"commands":["pre-commit hook check-merge-conflict","pre-commit hook trailing-whitespace","pre-commit hook check-added-large-files"],"run":null,"via":"pre-commit hook trailing-whitespace","triggers":["pre_commit","ci"],"examples":[{"repository":"TheAlgorithms/Python","slug":"thealgorithms-python"},{"repository":"SWE-agent/SWE-agent","slug":"swe-agent-swe-agent"},{"repository":"astral-sh/ty","slug":"astral-sh-ty"},{"repository":"bridgecrewio/checkov","slug":"bridgecrewio-checkov"}]},{"id":"actionlint","method":"static_analysis","kind":"workflow-linting","languages":["yaml"],"upstream":"https://github.com/rhysd/actionlint","docs":null,"autofix":false,"exit_codes":{},"repos":2,"share":17,"commands":["actionlint -color","actionlint -color github-action/examples/*.yml","pre-commit hook actionlint"],"run":"actionlint -color","via":"pre-commit hook actionlint","triggers":["pre_commit","ci"],"examples":[{"repository":"astral-sh/ty","slug":"astral-sh-ty"},{"repository":"openai/codex-security","slug":"openai-codex-security"}]},{"id":"zizmor","method":"static_analysis","kind":"workflow-linting","languages":["yaml"],"upstream":"https://github.com/zizmorcore/zizmor","docs":null,"autofix":false,"exit_codes":{},"repos":2,"share":17,"commands":["zizmor --offline --strict-collection --min-severity medium --format github --config .github/zizmor.yml .github","pre-commit hook zizmor"],"run":"zizmor --offline --strict-collection --min-severity medium --format github --config .github/zizmor.yml .github","via":"pre-commit hook zizmor","triggers":["pre_commit","ci"],"examples":[{"repository":"astral-sh/ty","slug":"astral-sh-ty"},{"repository":"openai/codex-security","slug":"openai-codex-security"}]},{"id":"codespell","method":"formatting","kind":"spelling","languages":["*"],"upstream":"https://github.com/codespell-project/codespell","docs":null,"autofix":false,"exit_codes":{},"repos":1,"share":8,"commands":["pre-commit hook codespell"],"run":null,"via":"pre-commit hook codespell","triggers":["pre_commit","ci"],"examples":[{"repository":"TheAlgorithms/Python","slug":"thealgorithms-python"}]},{"id":"semgrep","method":"static_analysis","kind":"security-scanning","languages":["*"],"upstream":"https://github.com/semgrep/semgrep","docs":null,"autofix":false,"exit_codes":{},"repos":1,"share":8,"commands":["semgrep scan --severity ERROR --error --sarif --config auto --exclude-rule javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection --exclude-rule javascript.express.security.audit.remote-property-injection.remote-property-injection . --output=semgrep-results.sarif $BASELINE_ARG"],"run":"semgrep scan --severity ERROR --error --sarif --config auto --exclude-rule javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection --exclude-rule javascript.express.security.audit.remote-property-injection.remote-property-injection . --output=semgrep-results.sarif $BASELINE_ARG","via":null,"triggers":["ci"],"examples":[{"repository":"prisma/prisma","slug":"prisma-prisma"}]}],"headline":["prettier"],"raw_md":"https://awesomereviewers.com/raw/verify/yaml.md","raw_json":"https://awesomereviewers.com/raw/verify/yaml.json","url":"https://awesomereviewers.com/verify/yaml/","baseline":{"slug":"every-change","title":"Any change","topics":["Code Style","Naming Conventions"],"checks":[{"kind":"formatting","title":"Formatting","method":"formatting","method_slug":"formatting","catches":"Layout drift that buries the real change in the diff.","tool":{"id":"prettier","method":"formatting","kind":"formatting","languages":["javascript","typescript","yaml","config","docs"],"upstream":"https://github.com/prettier/prettier","docs":"https://prettier.io/docs/cli#exit-codes","autofix":true,"exit_codes":{"0":"everything formatted","1":"something was not formatted (--check)","2":"prettier error"},"repos":5,"share":42,"commands":["prettier --experimental-cli --write .","pre-commit hook prettier"],"run":"prettier --experimental-cli --write .","via":"pre-commit hook prettier","triggers":["pre_commit","ci","local"],"examples":[{"repository":"QwenLM/qwen-code","slug":"qwenlm-qwen-code"},{"repository":"SWE-agent/SWE-agent","slug":"swe-agent-swe-agent"},{"repository":"astral-sh/ty","slug":"astral-sh-ty"},{"repository":"openai/codex-security","slug":"openai-codex-security"},{"repository":"Azure/Azure-Sentinel","slug":"azure-azure-sentinel"}]},"alternatives":[],"note":null},{"kind":"linting","title":"Linting","method":"static_analysis","method_slug":"static-analysis","catches":"Bug-prone patterns, unused code and conventions the formatter does not cover.","tool":null,"alternatives":[],"note":null},{"kind":"type-checking","title":"Type checking","method":"static_analysis","method_slug":"static-analysis","catches":"Wrong types, unhandled null or None, call signatures broken across modules.","tool":null,"alternatives":[],"note":null},{"kind":"unit-tests","title":"Unit and integration tests","method":"testing","method_slug":"testing","catches":"Behaviour regressions on the paths the tests exercise.","tool":null,"alternatives":[],"note":null}],"prompts":[{"slug":"azure-sentinel-use-standard-entity-identifiers","title":"Use Standard Entity Identifiers","description":"When creating `entityMappings`, use semantically strong, standard identifier fields as the mapped `columnName`. Avoid “legacy/weak” intermediary names like `AccountCustomEntity` (and avoid unnecessary wrapper columns like `IPCustomEntity`) when a direct standard field already exists.","repository":"Azure/Azure-Sentinel","domain":"cloud-infra","topic":"Naming Conventions","language":"Yaml","updated":"2023-03-23","comments":6,"stars":6042,"raw":"https://awesomereviewers.com/raw/azure-sentinel-use-standard-entity-identifiers.md"},{"slug":"grafana-proper-shell-quoting","title":"Proper shell quoting","description":"Always use proper quoting in shell scripts (especially GitHub Actions workflows) to prevent word splitting, globbing, and ensure correct variable expansion:","repository":"grafana/grafana","domain":"observability","topic":"Code Style","language":"Yaml","updated":"2025-07-03","comments":5,"stars":68825,"raw":"https://awesomereviewers.com/raw/grafana-proper-shell-quoting.md"},{"slug":"mastodon-use-accessible-terminology","title":"Use accessible terminology","description":"Choose clear, understandable names and terminology that are appropriate for your intended audience, avoiding technical jargon or obscure references that may not be widely understood. This is especially important for user-facing strings, error messages, and interface labels.","repository":"mastodon/mastodon","domain":"app-frameworks","topic":"Naming Conventions","language":"Yaml","updated":"2025-07-28","comments":4,"stars":48691,"raw":"https://awesomereviewers.com/raw/mastodon-use-accessible-terminology.md"},{"slug":"azure-sentinel-prefer-explicit-projection","title":"Prefer Explicit Projection","description":"When normalizing/querying, keep output schemas deterministic and readable: - Prefer explicit output selection (`project` / `project-keep`) over `project-away`, so adding new columns later won’t accidentally change results.","repository":"Azure/Azure-Sentinel","domain":"cloud-infra","topic":"Code Style","language":"Yaml","updated":"2026-06-05","comments":3,"stars":6042,"raw":"https://awesomereviewers.com/raw/azure-sentinel-prefer-explicit-projection.md"},{"slug":"istio-maintain-consistent-naming-patterns","title":"maintain consistent naming patterns","description":"Ensure naming consistency across related components and throughout the codebase to prevent developer confusion and maintenance issues. When similar concepts use different naming variations, choose one pattern and apply it consistently.","repository":"istio/istio","domain":"orchestration","topic":"Naming Conventions","language":"Yaml","updated":"2025-08-05","comments":3,"stars":37192,"raw":"https://awesomereviewers.com/raw/istio-maintain-consistent-naming-patterns.md"},{"slug":"alacritty-choose-familiar-intuitive-names","title":"Choose familiar, intuitive names","description":"When naming variables, methods, or configuration options, prioritize terms that are both intuitive to users and familiar within the relevant domain. Avoid technical jargon when simpler, more natural alternatives exist, while also preferring established terminology that the target audience already knows.","repository":"alacritty/alacritty","domain":"devtools","topic":"Naming Conventions","language":"Yaml","updated":"2023-05-20","comments":3,"stars":59675,"raw":"https://awesomereviewers.com/raw/alacritty-choose-familiar-intuitive-names.md"},{"slug":"chef-remove-commented-code","title":"Remove commented code","description":"Avoid leaving commented-out code in the codebase. Version control systems already track the history of changes, making commented-out code unnecessary. Removing unused commented code improves readability, reduces confusion, and keeps the codebase clean.","repository":"chef/chef","domain":"cloud-infra","topic":"Code Style","language":"Yaml","updated":"2023-04-19","comments":3,"stars":7860,"raw":"https://awesomereviewers.com/raw/chef-remove-commented-code.md"},{"slug":"azure-cli-canonical-naming-semantics","title":"Canonical naming semantics","description":"When configuring or referencing named entities, use the *canonical identifier* required by the consuming system and ensure the identifier’s *semantic type* matches what the field expects (e.g., “team” vs “label”). If a system normalizes names, reference the normalized form—not the on-disk/path form—and don’t substitute a label for a team.","repository":"Azure/azure-cli","domain":"cloud-infra","topic":"Naming Conventions","language":"Yaml","updated":"2026-07-27","comments":2,"stars":4592,"raw":"https://awesomereviewers.com/raw/azure-cli-canonical-naming-semantics.md"},{"slug":"kong-yaml-message-folding","title":"YAML Message Folding","description":"When writing YAML string fields intended for one-line or sentence-like messages, prefer folded block scalars (`>`) so embedded newlines render as spaces. Use literal block scalars (`|`) only when you explicitly need to preserve line breaks.","repository":"Kong/kong","domain":"cloud-infra","topic":"Code Style","language":"Yaml","updated":"2025-09-09","comments":2,"stars":43871,"raw":"https://awesomereviewers.com/raw/kong-yaml-message-folding.md"},{"slug":"python-avoid-stray-commas","title":"Avoid stray commas","description":"When running linters/formatters in CI or scripts, keep command arguments syntactically precise and standardized—remove any stray or meaningless punctuation (like a standalone comma) and normalize whitespace so commands are unambiguous.","repository":"TheAlgorithms/Python","domain":"docs","topic":"Code Style","language":"Yaml","updated":"2025-08-23","comments":2,"stars":220912,"raw":"https://awesomereviewers.com/raw/python-avoid-stray-commas.md"},{"slug":"python-use-semantic-names","title":"Use semantic names","description":"Use intention-revealing, consistent, and unique names for CI workflow, jobs, and steps (avoid generic labels like `build`). Names should tell the reader what the unit actually does.","repository":"TheAlgorithms/Python","domain":"docs","topic":"Naming Conventions","language":"Yaml","updated":"2025-08-23","comments":2,"stars":220912,"raw":"https://awesomereviewers.com/raw/python-use-semantic-names.md"},{"slug":"discourse-self-documenting-identifiers","title":"Self-documenting identifiers","description":"Choose names that are immediately understandable without requiring additional context, documentation lookup, or guessing. Identifiers should clearly communicate their purpose, units, and behavior to reduce cognitive load for developers.","repository":"discourse/discourse","domain":"app-frameworks","topic":"Naming Conventions","language":"Yaml","updated":"2025-08-19","comments":2,"stars":44898,"raw":"https://awesomereviewers.com/raw/discourse-self-documenting-identifiers.md"}],"prompt_count":21},"changes":[{"slug":"security","title":"Authentication, input handling, secrets, permissions","topics":["Security"],"checks":[{"kind":"security-scanning","title":"Security scanning","method":"static_analysis","method_slug":"static-analysis","catches":"Injection, unsafe APIs and tainted data reaching a sink.","tool":{"id":"codeql","method":"static_analysis","kind":"security-scanning","languages":["*"],"upstream":"https://github.com/github/codeql","docs":null,"autofix":false,"exit_codes":{},"repos":4,"share":33,"commands":["uses github/codeql-action/analyze"],"run":null,"via":"GitHub Action github/codeql-action/analyze","triggers":["ci"],"examples":[{"repository":"prisma/prisma","slug":"prisma-prisma"},{"repository":"QwenLM/qwen-code","slug":"qwenlm-qwen-code"},{"repository":"bridgecrewio/checkov","slug":"bridgecrewio-checkov"},{"repository":"Azure/Azure-Sentinel","slug":"azure-azure-sentinel"}]},"alternatives":[{"id":"semgrep","repos":1,"share":8}],"note":null},{"kind":"secret-scanning","title":"Secret scanning","method":"static_analysis","method_slug":"static-analysis","catches":"Credentials and tokens committed to the repository.","tool":null,"alternatives":[],"note":null},{"kind":"dependency-audit","title":"Dependency audit","method":"supply_chain","method_slug":"supply-chain","catches":"Known-vulnerable or disallowed dependencies and licenses.","tool":null,"alternatives":[],"note":null}],"prompts":[{"slug":"qwen-code-security-invariants-testing","title":"Security Invariants Testing","description":"Treat CI/workflow security like production security code: define explicit invariants, enforce them defensively, and lock them with executable regression tests—especially in workflows that run in privileged contexts (e.g., pull_request_target) or execute untrusted PR code.","repository":"QwenLM/qwen-code","domain":"ai-agents","topic":"Security","language":"Yaml","updated":"2026-07-28","comments":14,"stars":26407,"raw":"https://awesomereviewers.com/raw/qwen-code-security-invariants-testing.md"},{"slug":"chef-limit-token-permissions","title":"Limit token permissions","description":"Always specify the minimum required permissions for the GITHUB_TOKEN in GitHub Actions workflows to enhance security. By default, the GITHUB_TOKEN has broad permissions that could potentially be exploited if a workflow is compromised.","repository":"chef/chef","domain":"cloud-infra","topic":"Security","language":"Yaml","updated":"2025-07-01","comments":12,"stars":7860,"raw":"https://awesomereviewers.com/raw/chef-limit-token-permissions.md"},{"slug":"codex-security-fail-closed-release-security","title":"Fail-Closed Release Security","description":"Any security-sensitive release/publish workflow must be deterministic, run only on trusted code, validate against authoritative data, and fail closed.","repository":"openai/codex-security","domain":"security","topic":"Security","language":"Yaml","updated":"2026-07-30","comments":4,"stars":9394,"raw":"https://awesomereviewers.com/raw/codex-security-fail-closed-release-security.md"},{"slug":"bifrost-secure-configs-across-environments","title":"Secure configs across environments","description":"When making security-related changes, ensure the configuration is (1) least-privilege/scoped, (2) actually enforced by the platform, and (3) consistent across code/docs.","repository":"maximhq/bifrost","domain":"llm-infra","topic":"Security","language":"Yaml","updated":"2026-07-04","comments":4,"stars":6862,"raw":"https://awesomereviewers.com/raw/bifrost-secure-configs-across-environments.md"},{"slug":"azure-sentinel-cross-service-permission-hardening","title":"Cross-service Permission Hardening","description":"When granting permissions across AWS services (S3→SQS, EventBridge→Lambda, etc.), use the correct permission model and apply least-privilege constraints to prevent confused-deputy and silent authorization failures.","repository":"Azure/Azure-Sentinel","domain":"cloud-infra","topic":"Security","language":"Yaml","updated":"2026-06-25","comments":4,"stars":6042,"raw":"https://awesomereviewers.com/raw/azure-sentinel-cross-service-permission-hardening.md"},{"slug":"express-harden-cicd-workflows","title":"Harden CI/CD workflows","description":"Treat GitHub Actions workflows as part of the security attack surface, since they can run with repository write access and secrets. When referencing third-party actions, pin them to a specific commit SHA rather than a mutable tag (e.g. `v1`) to prevent supply-chain attacks if the upstream action is compromised or updated maliciously; document how pinned...","repository":"expressjs/Express","domain":"app-frameworks","topic":"Security","language":"Yaml","updated":"2025-10-08","comments":3,"stars":69579,"raw":"https://awesomereviewers.com/raw/express-harden-cicd-workflows.md"},{"slug":"n8n-never-commit-credentials","title":"Never commit credentials","description":"Credentials, passwords, API tokens, and database connection strings must never be committed to version control in any form, even in configuration files or Kubernetes manifests. This practice exposes sensitive information to anyone with repository access and creates security vulnerabilities.","repository":"n8n-io/n8n","domain":"ai-agents","topic":"Security","language":"Yaml","updated":"2025-07-01","comments":3,"stars":122978,"raw":"https://awesomereviewers.com/raw/n8n-never-commit-credentials.md"},{"slug":"checkov-comprehensive-security-scanning","title":"Comprehensive security scanning","description":"Always configure security scanning tools with comprehensive coverage and readable output to maximize vulnerability detection. This includes: 1. **Enable scanning across all files**: Use flags like `--enable-secret-scan-all-files` to ensure no potential vulnerability is missed.","repository":"bridgecrewio/checkov","domain":"security","topic":"Security","language":"Yaml","updated":"2023-11-02","comments":3,"stars":7667,"raw":"https://awesomereviewers.com/raw/checkov-comprehensive-security-scanning.md"},{"slug":"agentcore-samples-enforce-boundary-least-privilege","title":"Enforce Boundary Least-Privilege","description":"Security-sensitive controls must be enforced at the boundary (before business logic) and granted with the minimum required scope. Avoid designs where access is only checked after the request reaches handlers or where automation receives broad credentials.","repository":"awslabs/agentcore-samples","domain":"ai-agents","topic":"Security","language":"Yaml","updated":"2026-08-03","comments":2,"stars":3244,"raw":"https://awesomereviewers.com/raw/agentcore-samples-enforce-boundary-least-privilege.md"},{"slug":"last30days-skill-secure-actions-inputs","title":"Secure Actions Inputs","description":"In GitHub Actions, treat workflow inputs/expressions as potentially unsafe and follow two rules: (1) avoid interpolating `${{ ... }}` directly inside shell-script logic, and (2) do not persist Git credentials from `checkout`; instead, scope tokens to only the step that needs to push.","repository":"mvanhorn/last30days-skill","domain":"security","topic":"Security","language":"Yaml","updated":"2026-07-24","comments":2,"stars":57799,"raw":"https://awesomereviewers.com/raw/last30days-skill-secure-actions-inputs.md"},{"slug":"aidlc-workflows-ci-security-defaults","title":"CI Security Defaults","description":"Default CI/security configuration to minimize risk while keeping automated findings meaningful. Apply these rules: 1) Enforce least-privilege GitHub Actions permissions","repository":"awslabs/aidlc-workflows","domain":"orchestration","topic":"Security","language":"Yaml","updated":"2026-05-28","comments":2,"stars":3849,"raw":"https://awesomereviewers.com/raw/aidlc-workflows-ci-security-defaults.md"},{"slug":"goose-immutable-setup-pinning","title":"Immutable Setup Pinning","description":"When your tooling downloads/execut es external installers or scripts, treat both the *source* and the *workspace* as security-sensitive: - **Pin remote code to an immutable reference** (tag/commit SHA) before executing it, so the fetched content can’t change between reviews/runs.","repository":"aaif-goose/goose","domain":"ai-agents","topic":"Security","language":"Yaml","updated":"2026-05-28","comments":2,"stars":51876,"raw":"https://awesomereviewers.com/raw/goose-immutable-setup-pinning.md"}],"prompt_count":57},{"slug":"interfaces","title":"Public APIs, signatures, error paths, nullability","topics":["API","Error Handling","Null Handling"],"checks":[{"kind":"type-checking","title":"Type checking","method":"static_analysis","method_slug":"static-analysis","catches":"Wrong types, unhandled null or None, call signatures broken across modules.","tool":null,"alternatives":[],"note":null},{"kind":"unit-tests","title":"Unit and integration tests","method":"testing","method_slug":"testing","catches":"Behaviour regressions on the paths the tests exercise.","tool":null,"alternatives":[],"note":null},{"kind":"property-tests","title":"Property-based tests","method":"testing","method_slug":"testing","catches":"Edge-case inputs nobody wrote a test for; invariants over generated data.","tool":null,"alternatives":[],"note":null}],"prompts":[{"slug":"qwen-code-trusted-error-handling","title":"Trusted Error Handling","description":"Use strict, non-silent error handling and evidence gating across CI scripts and publish steps—especially when untrusted inputs and reruns are involved.","repository":"QwenLM/qwen-code","domain":"ai-agents","topic":"Error Handling","language":"Yaml","updated":"2026-07-28","comments":20,"stars":26407,"raw":"https://awesomereviewers.com/raw/qwen-code-trusted-error-handling.md"},{"slug":"azure-sentinel-null-safe-filters","title":"Null-safe Filters","description":"Ensure queries and ASIM parsers handle nullable/optional fields safely by (1) using type-correct null checks, (2) guarding references to optional/missing columns with `column_ifexists` (and using the same guarded form in both `summarize` and `project`), and (3) gating filters/fields that the source cannot provide so they don’t unintentionally exclude all...","repository":"Azure/Azure-Sentinel","domain":"cloud-infra","topic":"Null Handling","language":"Yaml","updated":"2026-07-29","comments":12,"stars":6042,"raw":"https://awesomereviewers.com/raw/azure-sentinel-null-safe-filters.md"},{"slug":"qwen-code-api-call-correctness","title":"API Call Correctness","description":"When automating GitHub (or similar) APIs from CI/workflows, treat API access like production client code: make it correct, complete, and safely reconcilable.","repository":"QwenLM/qwen-code","domain":"ai-agents","topic":"API","language":"Yaml","updated":"2026-07-29","comments":4,"stars":26407,"raw":"https://awesomereviewers.com/raw/qwen-code-api-call-correctness.md"},{"slug":"n8n-descriptive-parameter-names","title":"Descriptive parameter names","description":"Use specific, descriptive parameter names for API resources rather than generic identifiers. Parameter names should clearly indicate the resource type they refer to by using namespaced identifiers (e.g., `userId` instead of `id`). This improves API readability, reduces ambiguity in code, and prevents confusion when multiple resource types are used in the...","repository":"n8n-io/n8n","domain":"ai-agents","topic":"API","language":"Yaml","updated":"2025-07-10","comments":4,"stars":122978,"raw":"https://awesomereviewers.com/raw/n8n-descriptive-parameter-names.md"},{"slug":"istio-api-version-compatibility-first","title":"API version compatibility first","description":"When selecting API versions, prioritize compatibility over using the latest available version. Choose older, stable API versions when they provide the same schema but broader compatibility across Kubernetes versions. This approach minimizes breaking changes for users and reduces deployment friction.","repository":"istio/istio","domain":"orchestration","topic":"API","language":"Yaml","updated":"2022-11-22","comments":4,"stars":37192,"raw":"https://awesomereviewers.com/raw/istio-api-version-compatibility-first.md"},{"slug":"vscode-global-option-placement","title":"Global option placement","description":"When an interface defines an option/parameter as *global* (i.e., it applies across subcommands or endpoints), pass it using the interface’s established parsing contract—even if it appears after a subcommand. Do not reorder flags “by intuition” if the interface specifies global semantics; instead, align with the documented/implemented behavior and then lock...","repository":"microsoft/VSCode","domain":"devtools","topic":"API","language":"Yaml","updated":"2026-10-22","comments":3,"stars":194303,"raw":"https://awesomereviewers.com/raw/vscode-global-option-placement.md"},{"slug":"langfuse-document-data-constraints","title":"Document data constraints","description":"Explicitly document all input and output constraints directly in API definitions. For inputs, specify validation rules such as length limits, character restrictions, and value ranges. For outputs, detail the exact format of returned data structures, including array ordering, boundary conditions (inclusive/exclusive), and semantic meanings of values. This...","repository":"langfuse/langfuse","domain":"observability","topic":"API","language":"Yaml","updated":"2025-06-04","comments":3,"stars":13574,"raw":"https://awesomereviewers.com/raw/langfuse-document-data-constraints.md"},{"slug":"bifrost-explicit-null-safety","title":"Explicit Null Safety","description":"When templating, explicitly distinguish three states: **missing**, **explicit false**, and **null**. Relying on truthiness can silently drop intended configuration.","repository":"maximhq/bifrost","domain":"llm-infra","topic":"Null Handling","language":"Yaml","updated":"2026-07-16","comments":2,"stars":6862,"raw":"https://awesomereviewers.com/raw/bifrost-explicit-null-safety.md"},{"slug":"elasticsearch-specify-explicit-rest-formats","title":"Specify explicit REST formats","description":"Always specify explicit request formats in REST API tests rather than relying on default behaviors. This includes: 1. Set appropriate Content-Type headers (typically application/json for REST APIs)","repository":"elastic/elasticsearch","domain":"data-systems","topic":"API","language":"Yaml","updated":"2025-07-02","comments":2,"stars":73104,"raw":"https://awesomereviewers.com/raw/elasticsearch-specify-explicit-rest-formats.md"},{"slug":"temporal-optimize-api-consumption","title":"Optimize API consumption","description":"When interacting with APIs, minimize network requests and improve code maintainability by: 1. Extracting repetitive API call patterns into reusable functions","repository":"temporalio/temporal","domain":"orchestration","topic":"API","language":"Yaml","updated":"2025-04-24","comments":2,"stars":14953,"raw":"https://awesomereviewers.com/raw/temporal-optimize-api-consumption.md"},{"slug":"checkov-secure-api-endpoints","title":"Secure API endpoints","description":"Always configure proper authorization for API endpoints to prevent unauthorized access to back-end resources. Avoid combinations that create open access, such as using `AuthorizationType.NONE` together with `api_key_required=False` in API Gateway configurations.","repository":"bridgecrewio/checkov","domain":"security","topic":"API","language":"Yaml","updated":"2023-12-10","comments":2,"stars":7667,"raw":"https://awesomereviewers.com/raw/checkov-secure-api-endpoints.md"}],"prompt_count":11},{"slug":"services","title":"Service and framework code","topics":["Fastify","NestJS","Spring","Axum","Celery","Temporal"],"checks":[{"kind":"unit-tests","title":"Unit and integration tests","method":"testing","method_slug":"testing","catches":"Behaviour regressions on the paths the tests exercise.","tool":null,"alternatives":[],"note":null},{"kind":"version-matrix","title":"Version and platform matrix","method":"testing","method_slug":"testing","catches":"Breakage on a runtime version, OS or feature combination you did not run locally.","tool":{"id":"ci-matrix","method":"testing","kind":"version-matrix","languages":["*"],"upstream":"https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations","docs":null,"autofix":false,"exit_codes":{},"repos":5,"share":42,"commands":["analyze (language: 5)","analyze (ref: 2, language: 1)","behavior (node: 2)"],"run":"analyze (language: 5)","via":null,"triggers":["ci"],"examples":[{"repository":"prisma/prisma","slug":"prisma-prisma"},{"repository":"QwenLM/qwen-code","slug":"qwenlm-qwen-code"},{"repository":"openai/codex-security","slug":"openai-codex-security"},{"repository":"bridgecrewio/checkov","slug":"bridgecrewio-checkov"},{"repository":"Azure/Azure-Sentinel","slug":"azure-azure-sentinel"}]},"alternatives":[],"note":null}],"prompts":[],"prompt_count":0},{"slug":"algorithms","title":"Algorithms, parsers, data transforms","topics":["Algorithms"],"checks":[{"kind":"property-tests","title":"Property-based tests","method":"testing","method_slug":"testing","catches":"Edge-case inputs nobody wrote a test for; invariants over generated data.","tool":null,"alternatives":[],"note":null},{"kind":"fuzzing","title":"Fuzzing","method":"testing","method_slug":"testing","catches":"Crashes, panics and hangs on malformed input, especially in parsers and decoders.","tool":null,"alternatives":[],"note":null},{"kind":"mutation-testing","title":"Mutation testing","method":"testing","method_slug":"testing","catches":"Tests that keep passing whatever the code does.","tool":null,"alternatives":[],"note":null},{"kind":"proofs","title":"Proofs and specifications","method":"formal","method_slug":"formal","catches":"Design-level bugs in protocols and algorithms, checked against a specification.","tool":null,"alternatives":[],"note":null}],"prompts":[{"slug":"qwen-code-deterministic-set-reconciliation","title":"Deterministic Set Reconciliation","description":"When you correlate agent outputs, commit history, or prior workflow state across time, avoid fuzzy matching and “best-effort” heuristics. Instead: 1) Associate via stable identifiers (IDs), not text substrings.","repository":"QwenLM/qwen-code","domain":"ai-agents","topic":"Algorithms","language":"Yaml","updated":"2026-07-28","comments":5,"stars":26407,"raw":"https://awesomereviewers.com/raw/qwen-code-deterministic-set-reconciliation.md"},{"slug":"azure-sentinel-deterministic-kql-pipelines","title":"Deterministic KQL Pipelines","description":"Treat each analytics/hunting query as a deterministic algorithm: parse based on the actual encoded input, collapse repeated events by key, and use correct expand/join/re-aggregate patterns so results are complete and non-duplicative.","repository":"Azure/Azure-Sentinel","domain":"cloud-infra","topic":"Algorithms","language":"Yaml","updated":"2026-07-02","comments":5,"stars":6042,"raw":"https://awesomereviewers.com/raw/azure-sentinel-deterministic-kql-pipelines.md"}],"prompt_count":2},{"slug":"concurrency","title":"Threads, async code, locks, shared state","topics":["Concurrency"],"checks":[{"kind":"concurrency-model-checking","title":"Concurrency model checking","method":"formal","method_slug":"formal","catches":"Races and orderings that fail only under specific interleavings.","tool":null,"alternatives":[],"note":null},{"kind":"ub-detection","title":"Undefined-behaviour detection","method":"formal","method_slug":"formal","catches":"Memory-safety and aliasing violations in unsafe code.","tool":null,"alternatives":[],"note":null},{"kind":"property-tests","title":"Property-based tests","method":"testing","method_slug":"testing","catches":"Edge-case inputs nobody wrote a test for; invariants over generated data.","tool":null,"alternatives":[],"note":null}],"prompts":[{"slug":"qwen-code-concurrency-synchronization-rules","title":"Concurrency synchronization rules","description":"Design GitHub Actions concurrency so overlapping runs can’t corrupt multi-step outcomes. Rules: 1) Don’t assume `concurrency` is a durable multi-stage queue. If stage A and stage B must be serialized as one logical transaction, either:","repository":"QwenLM/qwen-code","domain":"ai-agents","topic":"Concurrency","language":"Yaml","updated":"2026-07-26","comments":4,"stars":26407,"raw":"https://awesomereviewers.com/raw/qwen-code-concurrency-synchronization-rules.md"},{"slug":"codex-security-race-safe-concurrency","title":"Race-safe concurrency","description":"When multiple workflow runs mutate or publish to the same shared external resource (labels, registries, “latest”), make synchronization explicit and resource-scoped, and handle conflicts by re-verifying state before proceeding.","repository":"openai/codex-security","domain":"security","topic":"Concurrency","language":"Yaml","updated":"2026-07-29","comments":2,"stars":9394,"raw":"https://awesomereviewers.com/raw/codex-security-race-safe-concurrency.md"}],"prompt_count":2},{"slug":"networking","title":"Network calls, retries, timeouts, protocols","topics":["Networking","Axios"],"checks":[{"kind":"unit-tests","title":"Unit and integration tests","method":"testing","method_slug":"testing","catches":"Behaviour regressions on the paths the tests exercise.","tool":null,"alternatives":[],"note":null},{"kind":"fuzzing","title":"Fuzzing","method":"testing","method_slug":"testing","catches":"Crashes, panics and hangs on malformed input, especially in parsers and decoders.","tool":null,"alternatives":[],"note":null}],"prompts":[{"slug":"istio-conservative-networking-defaults","title":"Conservative networking defaults","description":"When configuring networking components, prefer stable and permissive defaults over restrictive or experimental configurations that may not work across all environments. This approach ensures broader compatibility and reduces the risk of breaking existing deployments.","repository":"istio/istio","domain":"orchestration","topic":"Networking","language":"Yaml","updated":"2025-07-21","comments":5,"stars":37192,"raw":"https://awesomereviewers.com/raw/istio-conservative-networking-defaults.md"},{"slug":"azure-sentinel-portable-network-identity","title":"Portable network identity","description":"When implementing networking-related configuration or telemetry parsing, avoid brittle assumptions about IP/host formats and instead use portable defaults plus canonical resolution.","repository":"Azure/Azure-Sentinel","domain":"cloud-infra","topic":"Networking","language":"Yaml","updated":"2026-07-21","comments":3,"stars":6042,"raw":"https://awesomereviewers.com/raw/azure-sentinel-portable-network-identity.md"},{"slug":"checkov-lambda-cors-protection","title":"Lambda CORS protection","description":"When implementing network security checks for AWS Lambda functions, ensure that CORS (Cross-Origin Resource Sharing) policies are verified on the core Lambda function resources, not just on function URL endpoints. This prevents open CORS policies that could expose your Lambda functions to unauthorized cross-origin requests.","repository":"bridgecrewio/checkov","domain":"security","topic":"Networking","language":"Yaml","updated":"2025-04-20","comments":2,"stars":7667,"raw":"https://awesomereviewers.com/raw/checkov-lambda-cors-protection.md"},{"slug":"checkov-target-core-resources","title":"Target core resources","description":"When implementing network security checks for serverless functions like AWS Lambda, ensure you target the core function resources rather than just their endpoints. Security checks for configurations like CORS policies should be applied to the primary Lambda resources (`AWS::Lambda::Function`, `aws_lambda_function`) rather than only their URL interfaces...","repository":"bridgecrewio/checkov","domain":"security","topic":"Networking","language":"Yaml","updated":"2025-04-20","comments":2,"stars":7668,"raw":"https://awesomereviewers.com/raw/checkov-target-core-resources.md"},{"slug":"prisma-document-network-configuration","title":"Document network configuration","description":"When configuring network settings in containerized services, always document the reasoning behind specific choices, especially for port mappings and security-related flags. This helps other developers understand the configuration and prevents accidental misconfigurations.","repository":"prisma/prisma","domain":"data-systems","topic":"Networking","language":"Yaml","updated":"2024-08-02","comments":2,"stars":42967,"raw":"https://awesomereviewers.com/raw/prisma-document-network-configuration.md"},{"slug":"kubeflow-document-networking-annotations","title":"Document networking annotations","description":"When using Istio or other networking-related annotations in configuration files, always include detailed comments explaining their purpose, behavior, and effects. This makes networking constraints and logic transparent to developers and users who need to understand the system's behavior.","repository":"kubeflow/kubeflow","domain":"ml-systems","topic":"Networking","language":"Yaml","updated":"2021-04-13","comments":2,"stars":15064,"raw":"https://awesomereviewers.com/raw/kubeflow-document-networking-annotations.md"}],"prompt_count":6},{"slug":"ui","title":"UI components and pages","topics":["React","Next","Next.js","Vue","Angular"],"checks":[{"kind":"browser-tests","title":"End-to-end browser tests","method":"testing","method_slug":"testing","catches":"User flows broken across components, routing and the network.","tool":null,"alternatives":[],"note":null},{"kind":"linting","title":"Linting","method":"static_analysis","method_slug":"static-analysis","catches":"Bug-prone patterns, unused code and conventions the formatter does not cover.","tool":null,"alternatives":[],"note":null}],"prompts":[],"prompt_count":0},{"slug":"data","title":"Databases, migrations, caching","topics":["Database","Migrations","Caching"],"checks":[{"kind":"unit-tests","title":"Unit and integration tests","method":"testing","method_slug":"testing","catches":"Behaviour regressions on the paths the tests exercise.","tool":null,"alternatives":[],"note":null},{"kind":"version-matrix","title":"Version and platform matrix","method":"testing","method_slug":"testing","catches":"Breakage on a runtime version, OS or feature combination you did not run locally.","tool":{"id":"ci-matrix","method":"testing","kind":"version-matrix","languages":["*"],"upstream":"https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations","docs":null,"autofix":false,"exit_codes":{},"repos":5,"share":42,"commands":["analyze (language: 5)","analyze (ref: 2, language: 1)","behavior (node: 2)"],"run":"analyze (language: 5)","via":null,"triggers":["ci"],"examples":[{"repository":"prisma/prisma","slug":"prisma-prisma"},{"repository":"QwenLM/qwen-code","slug":"qwenlm-qwen-code"},{"repository":"openai/codex-security","slug":"openai-codex-security"},{"repository":"bridgecrewio/checkov","slug":"bridgecrewio-checkov"},{"repository":"Azure/Azure-Sentinel","slug":"azure-azure-sentinel"}]},"alternatives":[],"note":null}],"prompts":[{"slug":"azure-sentinel-stable-scoped-query-outputs","title":"Stable, Scoped Query Outputs","description":"When writing KQL for Sentinel (parsers, analytic rules, hunts), make\\ \\ query outputs and intermediate datasets stable and correct: \\n\\n- Prefer **explicit\\ \\ `project`** of the expected/normalized columns (avoid `project-away`) so newly\\ \\ added source columns won’t change the published schema.","repository":"Azure/Azure-Sentinel","domain":"cloud-infra","topic":"Database","language":"Yaml","updated":"2026-07-21","comments":7,"stars":6042,"raw":"https://awesomereviewers.com/raw/azure-sentinel-stable-scoped-query-outputs.md"},{"slug":"vscode-deterministic-ci-cache-keys","title":"Deterministic CI Cache Keys","description":"Use deterministic, content-derived cache keys and ensure every producer/consumer of that cache computes the key *identically*. Apply these rules when adding or modifying CI caching (especially GitHub Actions):","repository":"microsoft/VSCode","domain":"devtools","topic":"Caching","language":"Yaml","updated":"2026-10-22","comments":3,"stars":194303,"raw":"https://awesomereviewers.com/raw/vscode-deterministic-ci-cache-keys.md"}],"prompt_count":2},{"slug":"performance","title":"Hot paths and performance","topics":["Performance Optimization"],"checks":[],"prompts":[{"slug":"azure-sentinel-early-filter-and-cache","title":"Early Filter and Cache","description":"When writing KQL (hunting queries or ASIM parsers), optimize for fewer rows and fewer expensive computations: 1) Prefilter early (before parse/branch work)","repository":"Azure/Azure-Sentinel","domain":"cloud-infra","topic":"Performance Optimization","language":"Yaml","updated":"2026-07-10","comments":7,"stars":6042,"raw":"https://awesomereviewers.com/raw/azure-sentinel-early-filter-and-cache.md"},{"slug":"qwen-code-minimize-expensive-api-calls","title":"Minimize expensive API calls","description":"When your code depends on GitHub (or other remote) APIs, pagination and per-item mutations are often the dominant performance cost. Structure workflows/scripts to avoid redundant full scans and to prevent N+1 API patterns unless the workload is provably small.","repository":"QwenLM/qwen-code","domain":"ai-agents","topic":"Performance Optimization","language":"Yaml","updated":"2026-07-28","comments":3,"stars":26407,"raw":"https://awesomereviewers.com/raw/qwen-code-minimize-expensive-api-calls.md"},{"slug":"kubernetes-benchmark-performance-changes","title":"Benchmark performance changes","description":"Always measure and validate performance impact through benchmarking before making changes that could affect system performance, even when changes appear to be obvious optimizations. Removing seemingly redundant configurations or adding new features can have unexpected performance consequences that only surface during integration testing or production use.","repository":"kubernetes/kubernetes","domain":"orchestration","topic":"Performance Optimization","language":"Yaml","updated":"2025-07-23","comments":2,"stars":116489,"raw":"https://awesomereviewers.com/raw/kubernetes-benchmark-performance-changes.md"},{"slug":"maplibre-native-optimize-compilation-flags","title":"Optimize compilation flags","description":"When optimizing application performance, carefully select compiler flags based on your optimization goals. For size-critical applications or accurate size measurements, use `-Oz` to prevent aggressive inlining that can distort metrics. Additionally, implement compiler caching with tools like `ccache` to significantly improve build times in development and...","repository":"maplibre/maplibre-native","domain":"app-frameworks","topic":"Performance Optimization","language":"Yaml","updated":"2023-12-17","comments":2,"stars":1411,"raw":"https://awesomereviewers.com/raw/maplibre-native-optimize-compilation-flags.md"}],"prompt_count":4},{"slug":"ai","title":"Model, prompt and LLM code","topics":["AI","Pytorch"],"checks":[{"kind":"unit-tests","title":"Unit and integration tests","method":"testing","method_slug":"testing","catches":"Behaviour regressions on the paths the tests exercise.","tool":null,"alternatives":[],"note":null}],"prompts":[{"slug":"promptfoo-ai-eval-config-correctness","title":"AI eval config correctness","description":"When writing eval/test configurations for AI models and agents, make sure each run is properly isolated and uses accurate, model-specific parameters so results stay reproducible and uncontaminated:","repository":"promptfoo/promptfoo","domain":"ai-agents","topic":"AI","language":"Yaml","updated":"2026-10-17","comments":3,"stars":26565,"raw":"https://awesomereviewers.com/raw/promptfoo-ai-eval-config-correctness.md"},{"slug":"dify-responsible-ai-management","title":"Responsible AI management","description":"Ensure AI models are managed responsibly throughout their lifecycle and have appropriate boundaries on their decision-making authority. When deprecating AI models, maintain backward compatibility by marking old models as deprecated rather than removing them entirely. Additionally, prevent AI models from controlling sensitive parameters that could lead to...","repository":"langgenius/dify","domain":"llm-infra","topic":"AI","language":"Yaml","updated":"2025-02-04","comments":2,"stars":114231,"raw":"https://awesomereviewers.com/raw/dify-responsible-ai-management.md"}],"prompt_count":2},{"slug":"observability","title":"Logging, metrics, tracing","topics":["Logging","Observability"],"checks":[],"prompts":[{"slug":"istio-document-observability-rationale","title":"Document observability rationale","description":"When introducing, modifying, or removing observability features (tracing, metrics, monitoring configurations), always include clear documentation explaining the rationale, use cases, and migration guidance. Users need to understand why they would want to use a feature and how it solves their specific problems.","repository":"istio/istio","domain":"orchestration","topic":"Observability","language":"Yaml","updated":"2025-03-27","comments":4,"stars":37192,"raw":"https://awesomereviewers.com/raw/istio-document-observability-rationale.md"},{"slug":"qwen-code-warn-on-silent-failures","title":"Warn on silent failures","description":"In automation scripts/workflows, never fail or skip important work silently. If a condition decides to omit a capability/flag, or if a command fails with diagnostics discarded or a sentinel fallback is used, emit an explicit warning (or notice) that includes the relevant inputs and captured error output.","repository":"QwenLM/qwen-code","domain":"ai-agents","topic":"Logging","language":"Yaml","updated":"2026-07-29","comments":3,"stars":26407,"raw":"https://awesomereviewers.com/raw/qwen-code-warn-on-silent-failures.md"},{"slug":"azure-sentinel-triage-ready-telemetry","title":"Triage-Ready Telemetry","description":"When implementing observability detections/parsers, ensure alerts/fields are (1) schema-correct and vendor-correct, and (2) triage-ready with the exact raw context that triggered the signal.","repository":"Azure/Azure-Sentinel","domain":"cloud-infra","topic":"Observability","language":"Yaml","updated":"2025-12-11","comments":2,"stars":6042,"raw":"https://awesomereviewers.com/raw/azure-sentinel-triage-ready-telemetry.md"},{"slug":"temporal-configure-opentelemetry-programmatically","title":"Configure OpenTelemetry programmatically","description":"Configure OpenTelemetry programmatically rather than through environment variables or command-line flags. This creates a more maintainable and standardized approach to observability. Additionally, ensure all observability components like collectors are explicitly included in your deployment configurations.","repository":"temporalio/temporal","domain":"orchestration","topic":"Observability","language":"Yaml","updated":"2025-06-24","comments":2,"stars":14953,"raw":"https://awesomereviewers.com/raw/temporal-configure-opentelemetry-programmatically.md"}],"prompt_count":4},{"slug":"ci-config","title":"CI workflows and configuration files","topics":["CI/CD","Configurations"],"checks":[{"kind":"workflow-linting","title":"CI workflow linting","method":"static_analysis","method_slug":"static-analysis","catches":"Broken GitHub Actions syntax, script injection, over-broad token permissions.","tool":{"id":"actionlint","method":"static_analysis","kind":"workflow-linting","languages":["yaml"],"upstream":"https://github.com/rhysd/actionlint","docs":null,"autofix":false,"exit_codes":{},"repos":2,"share":17,"commands":["actionlint -color","actionlint -color github-action/examples/*.yml","pre-commit hook actionlint"],"run":"actionlint -color","via":"pre-commit hook actionlint","triggers":["pre_commit","ci"],"examples":[{"repository":"astral-sh/ty","slug":"astral-sh-ty"},{"repository":"openai/codex-security","slug":"openai-codex-security"}]},"alternatives":[{"id":"zizmor","repos":2,"share":17}],"note":null},{"kind":"file-hygiene","title":"File hygiene","method":"formatting","method_slug":"formatting","catches":"Invalid JSON, YAML or TOML, merge markers, trailing whitespace, oversized files.","tool":{"id":"pre-commit-hooks","method":"formatting","kind":"file-hygiene","languages":["*"],"upstream":"https://github.com/pre-commit/pre-commit-hooks","docs":null,"autofix":true,"exit_codes":{},"repos":4,"share":33,"commands":["pre-commit hook check-merge-conflict","pre-commit hook trailing-whitespace","pre-commit hook check-added-large-files"],"run":null,"via":"pre-commit hook trailing-whitespace","triggers":["pre_commit","ci"],"examples":[{"repository":"TheAlgorithms/Python","slug":"thealgorithms-python"},{"repository":"SWE-agent/SWE-agent","slug":"swe-agent-swe-agent"},{"repository":"astral-sh/ty","slug":"astral-sh-ty"},{"repository":"bridgecrewio/checkov","slug":"bridgecrewio-checkov"}]},"alternatives":[],"note":null}],"prompts":[{"slug":"framework-keep-ci-configurations-minimal","title":"Keep CI configurations minimal","description":"When configuring CI workflows, include only the extensions, tools, and settings that are necessary for the specific tests being run. Avoid adding unnecessary PHP extensions (such as `xml` or `xdebug`) to workflow configurations unless they''re explicitly required. Similarly, keep coverage disabled (`coverage: none`) in CI pipelines by default to improve...","repository":"laravel/framework","domain":"app-frameworks","topic":"CI/CD","language":"Yaml","updated":"2024-11-25","comments":14,"stars":33763,"raw":"https://awesomereviewers.com/raw/framework-keep-ci-configurations-minimal.md"},{"slug":"python-ci-workflow-correctness","title":"CI workflow correctness","description":"All CI workflows must be syntactically valid, reliably triggered, and logically non-redundant. Apply these rules: 1) Every step must be valid: each `- name:` entry must include either `uses:` or `run:` (never both missing).","repository":"TheAlgorithms/Python","domain":"docs","topic":"CI/CD","language":"Yaml","updated":"2026-03-26","comments":12,"stars":220912,"raw":"https://awesomereviewers.com/raw/python-ci-workflow-correctness.md"},{"slug":"qwen-code-workflow-state-hygiene","title":"Workflow State Hygiene","description":"CI/CD workflows should enforce *state invariants* across steps, runs, and runners: later steps must only execute when earlier phases truly produced a valid outcome, and all per-run state must be cleaned/flushed and permission-safe—especially on persistent self-hosted runners.","repository":"QwenLM/qwen-code","domain":"ai-agents","topic":"CI/CD","language":"Yaml","updated":"2026-07-28","comments":11,"stars":26407,"raw":"https://awesomereviewers.com/raw/qwen-code-workflow-state-hygiene.md"},{"slug":"nanochat-deterministic-ci-runs","title":"Deterministic CI Runs","description":"Ensure GitHub Actions CI runs are repeatable, targeted, and don’t rely on brittle hacks. 1) Run tests using the environment you just prepared - If you use `uv sync`, run pytest using the created venv/python (or otherwise guarantee `uv run` uses the synced environment without re-installing).","repository":"karpathy/nanochat","domain":"ml-systems","topic":"CI/CD","language":"Yaml","updated":"2026-02-16","comments":9,"stars":53189,"raw":"https://awesomereviewers.com/raw/nanochat-deterministic-ci-runs.md"},{"slug":"codex-security-gated-deterministic-releases","title":"Gated deterministic releases","description":"All release/publishing workflows must be deterministic, serialized safely, and strictly gated so that user-facing artifacts are published only after the release candidate has passed the final checks.","repository":"openai/codex-security","domain":"security","topic":"CI/CD","language":"Yaml","updated":"2026-07-30","comments":8,"stars":9394,"raw":"https://awesomereviewers.com/raw/codex-security-gated-deterministic-releases.md"},{"slug":"vscode-resilient-efficient-ci","title":"Resilient Efficient CI","description":"CI/CD workflows should be resilient, deterministic, and efficient: 1) Required checks should be resilient and scope-correct - Use a single “PR gate” (or equivalent) that passes when all relevant test jobs succeeded or were skipped.","repository":"microsoft/VSCode","domain":"devtools","topic":"CI/CD","language":"Yaml","updated":"2026-10-25","comments":7,"stars":194303,"raw":"https://awesomereviewers.com/raw/vscode-resilient-efficient-ci.md"},{"slug":"redis-cicd-workflow-guardrails","title":"CI/CD Workflow Guardrails","description":"When building or modifying CI/CD GitHub Actions workflows, structure them as an explicit DAG of artifact-driven jobs and guard execution to prevent fork/irrelevant-context failures.","repository":"redis/redis","domain":"data-systems","topic":"CI/CD","language":"Yaml","updated":"2026-04-30","comments":7,"stars":74261,"raw":"https://awesomereviewers.com/raw/redis-cicd-workflow-guardrails.md"},{"slug":"query-deterministic-ci-practices","title":"Deterministic CI Practices","description":"When touching CI/CD workflows, keep execution deterministic and CI stable: - **Don’t duplicate steps**: if a publish script already runs tests, avoid running `test:ci` again in the workflow.","repository":"tanstack/query","domain":"app-frameworks","topic":"CI/CD","language":"Yaml","updated":"2025-12-28","comments":7,"stars":49380,"raw":"https://awesomereviewers.com/raw/query-deterministic-ci-practices.md"},{"slug":"continue-ci-script-reliability-practices","title":"CI script reliability practices","description":"Ensure CI/CD workflows maintain reliability by following these practices: 1. **Use explicit script paths** - Always use explicit paths when invoking scripts (e.g., `./build.ps1` for PowerShell or `./build.sh` for bash) rather than relying on implicit path resolution. This ensures the runner can locate and execute scripts regardless of the current working...","repository":"continuedev/continue","domain":"ai-agents","topic":"CI/CD","language":"Yaml","updated":"2025-07-18","comments":7,"stars":27819,"raw":"https://awesomereviewers.com/raw/continue-ci-script-reliability-practices.md"},{"slug":"express-pin-and-automate-action-dependencies","title":"Pin and automate action dependencies","description":"All third-party GitHub Actions must be pinned to an immutable commit SHA (with the version as a trailing comment) rather than a mutable tag, since tags can be rewritten and immutable pins are required for supply-chain security (e.g., OSSF Scorecard). Example:","repository":"expressjs/Express","domain":"app-frameworks","topic":"CI/CD","language":"Yaml","updated":"2025-03-27","comments":7,"stars":69579,"raw":"https://awesomereviewers.com/raw/express-pin-and-automate-action-dependencies.md"},{"slug":"kubeflow-precise-workflow-triggers","title":"Precise workflow triggers","description":"Configure CI/CD workflows to trigger precisely based on relevant file path changes. This minimizes unnecessary builds and tests while ensuring all required workflows run when dependencies are modified.","repository":"kubeflow/kubeflow","domain":"ml-systems","topic":"CI/CD","language":"Yaml","updated":"2022-12-20","comments":7,"stars":15064,"raw":"https://awesomereviewers.com/raw/kubeflow-precise-workflow-triggers.md"},{"slug":"azure-sentinel-parameterize-config-values","title":"Parameterize Config Values","description":"When authoring queries/parsers and deployment templates, ensure all environment- or customer-specific values are configurable via parameters (e.g., `let`, `ParserParams`, CloudFormation `Parameters`), and avoid unsafe sample/environment defaults. Also, if you introduce or rely on a standard configuration flag (e.g., additional-fields “pack”), make sure it’s...","repository":"Azure/Azure-Sentinel","domain":"cloud-infra","topic":"Configurations","language":"Yaml","updated":"2026-06-25","comments":6,"stars":6042,"raw":"https://awesomereviewers.com/raw/azure-sentinel-parameterize-config-values.md"}],"prompt_count":167},{"slug":"dependencies","title":"Dependencies and lockfiles","topics":[],"checks":[{"kind":"dependency-audit","title":"Dependency audit","method":"supply_chain","method_slug":"supply-chain","catches":"Known-vulnerable or disallowed dependencies and licenses.","tool":null,"alternatives":[],"note":null},{"kind":"lockfile-check","title":"Lockfile consistency","method":"supply_chain","method_slug":"supply-chain","catches":"A lockfile that no longer matches its manifest.","tool":null,"alternatives":[],"note":null},{"kind":"version-matrix","title":"Version and platform matrix","method":"testing","method_slug":"testing","catches":"Breakage on a runtime version, OS or feature combination you did not run locally.","tool":{"id":"ci-matrix","method":"testing","kind":"version-matrix","languages":["*"],"upstream":"https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations","docs":null,"autofix":false,"exit_codes":{},"repos":5,"share":42,"commands":["analyze (language: 5)","analyze (ref: 2, language: 1)","behavior (node: 2)"],"run":"analyze (language: 5)","via":null,"triggers":["ci"],"examples":[{"repository":"prisma/prisma","slug":"prisma-prisma"},{"repository":"QwenLM/qwen-code","slug":"qwenlm-qwen-code"},{"repository":"openai/codex-security","slug":"openai-codex-security"},{"repository":"bridgecrewio/checkov","slug":"bridgecrewio-checkov"},{"repository":"Azure/Azure-Sentinel","slug":"azure-azure-sentinel"}]},"alternatives":[],"note":null}],"prompts":[],"prompt_count":0},{"slug":"tests","title":"The tests themselves","topics":["Testing"],"checks":[{"kind":"mutation-testing","title":"Mutation testing","method":"testing","method_slug":"testing","catches":"Tests that keep passing whatever the code does.","tool":null,"alternatives":[],"note":null},{"kind":"version-matrix","title":"Version and platform matrix","method":"testing","method_slug":"testing","catches":"Breakage on a runtime version, OS or feature combination you did not run locally.","tool":{"id":"ci-matrix","method":"testing","kind":"version-matrix","languages":["*"],"upstream":"https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations","docs":null,"autofix":false,"exit_codes":{},"repos":5,"share":42,"commands":["analyze (language: 5)","analyze (ref: 2, language: 1)","behavior (node: 2)"],"run":"analyze (language: 5)","via":null,"triggers":["ci"],"examples":[{"repository":"prisma/prisma","slug":"prisma-prisma"},{"repository":"QwenLM/qwen-code","slug":"qwenlm-qwen-code"},{"repository":"openai/codex-security","slug":"openai-codex-security"},{"repository":"bridgecrewio/checkov","slug":"bridgecrewio-checkov"},{"repository":"Azure/Azure-Sentinel","slug":"azure-azure-sentinel"}]},"alternatives":[],"note":null}],"prompts":[{"slug":"qwen-code-contract-driven-workflow-testing","title":"Contract-Driven Workflow Testing","description":"Workflow logic changes can silently ship if tests don’t observe the exact contract your users/ops depend on. Adopt this checklist when writing/modifying tests around GitHub Actions scripts/workflows:","repository":"QwenLM/qwen-code","domain":"ai-agents","topic":"Testing","language":"Yaml","updated":"2026-07-29","comments":8,"stars":26407,"raw":"https://awesomereviewers.com/raw/qwen-code-contract-driven-workflow-testing.md"},{"slug":"framework-disable-coverage-in-workflows","title":"Disable coverage in workflows","description":"Keep code coverage tools disabled in CI/CD workflows unless they're specifically needed for generating coverage reports. Enabling coverage tools like xdebug in GitHub Actions can significantly slow down pipeline execution without providing value when reports aren't being collected or analyzed.","repository":"laravel/framework","domain":"app-frameworks","topic":"Testing","language":"Yaml","updated":"2024-11-25","comments":4,"stars":33763,"raw":"https://awesomereviewers.com/raw/framework-disable-coverage-in-workflows.md"},{"slug":"semgrep-ensure-comprehensive-test-coverage","title":"Ensure comprehensive test coverage","description":"Tests should validate all expected behaviors, variants, and edge cases rather than covering only the happy path. When implementing tests, ensure you include scenarios for all relevant configurations, types, or levels that your code supports.","repository":"semgrep/semgrep","domain":"security","topic":"Testing","language":"Yaml","updated":"2024-04-29","comments":3,"stars":12598,"raw":"https://awesomereviewers.com/raw/semgrep-ensure-comprehensive-test-coverage.md"},{"slug":"azure-cli-deterministic-external-testing","title":"Deterministic External Testing","description":"When external services are flaky or untestable, make CI deterministic by (1) pruning recorded interactions to the stable outcomes your playback will actually match, and (2) using narrowly-scoped linter/test exclusions only when a dependency prevents meaningful coverage.","repository":"Azure/azure-cli","domain":"cloud-infra","topic":"Testing","language":"Yaml","updated":"2026-05-26","comments":2,"stars":4592,"raw":"https://awesomereviewers.com/raw/azure-cli-deterministic-external-testing.md"},{"slug":"dify-ci-testing-tool-integration","title":"CI testing tool integration","description":"When integrating new testing or analysis tools into CI pipelines, use graceful failure patterns during initial adoption phases to prevent breaking existing workflows. Add tools as development dependencies and allow them to fail without blocking builds using `|| true` until they are stable and properly configured.","repository":"langgenius/dify","domain":"llm-infra","topic":"Testing","language":"Yaml","updated":"2025-09-10","comments":2,"stars":114231,"raw":"https://awesomereviewers.com/raw/dify-ci-testing-tool-integration.md"},{"slug":"elasticsearch-avoid-flaky-tests","title":"Avoid flaky tests","description":"Design tests to be deterministic and reliable across different environments. Tests that occasionally fail due to timing, race conditions, or environmental differences waste development time and reduce confidence in the test suite.","repository":"elastic/elasticsearch","domain":"data-systems","topic":"Testing","language":"Yaml","updated":"2025-06-13","comments":2,"stars":73104,"raw":"https://awesomereviewers.com/raw/elasticsearch-avoid-flaky-tests.md"},{"slug":"browser-use-organize-tests-by-category","title":"organize tests by category","description":"Structure test suites into clear, logical categories and run them as separate CI jobs for better parallelization, maintainability, and failure identification. This approach makes it easier to understand test failures, enables targeted testing, and improves CI performance through parallel execution.","repository":"browser-use/browser-use","domain":"ai-agents","topic":"Testing","language":"Yaml","updated":"2025-04-27","comments":2,"stars":69139,"raw":"https://awesomereviewers.com/raw/browser-use-organize-tests-by-category.md"},{"slug":"tokio-test-diverse-configurations","title":"Test diverse configurations","description":"Configure test suites to run under multiple specialized environments to catch issues that might not appear in standard test runs. This includes testing with different compiler configurations, using specialized testing tools, and properly preserving environment variables when adding test-specific flags.","repository":"tokio-rs/tokio","domain":"runtimes","topic":"Testing","language":"Yaml","updated":"2024-10-10","comments":2,"stars":28989,"raw":"https://awesomereviewers.com/raw/tokio-test-diverse-configurations.md"},{"slug":"tokio-test-production-configurations-too","title":"Test production configurations too","description":"Include testing configurations that mirror production environments to catch issues that might only manifest in release builds. For example, testing with panic=abort can reveal issues that wouldn't appear when testing with the default panic=unwind setting. Similarly, when using specialized testing tools like Miri, configure the appropriate flags to ensure...","repository":"tokio-rs/tokio","domain":"runtimes","topic":"Testing","language":"Yaml","updated":"2024-10-10","comments":2,"stars":28981,"raw":"https://awesomereviewers.com/raw/tokio-test-production-configurations-too.md"},{"slug":"fiber-avoid-count1-flag","title":"avoid `-count=1` flag","description":"Avoid using the `-count=1` flag in Go test commands unless specifically required to disable test caching. Removing this flag enables concurrent test execution, which not only improves test performance but more importantly allows for better detection of data races during testing.","repository":"gofiber/fiber","domain":"app-frameworks","topic":"Testing","language":"Yaml","updated":"2024-03-04","comments":2,"stars":37560,"raw":"https://awesomereviewers.com/raw/fiber-avoid-count1-flag.md"}],"prompt_count":10},{"slug":"docs","title":"Documentation and comments","topics":["Documentation"],"checks":[{"kind":"docs-build","title":"Docs build","method":"static_analysis","method_slug":"static-analysis","catches":"Broken cross-references, links and markup in documentation.","tool":null,"alternatives":[],"note":null},{"kind":"spelling","title":"Spelling","method":"formatting","method_slug":"formatting","catches":"Typos in identifiers, comments and docs.","tool":{"id":"codespell","method":"formatting","kind":"spelling","languages":["*"],"upstream":"https://github.com/codespell-project/codespell","docs":null,"autofix":false,"exit_codes":{},"repos":1,"share":8,"commands":["pre-commit hook codespell"],"run":null,"via":"pre-commit hook codespell","triggers":["pre_commit","ci"],"examples":[{"repository":"TheAlgorithms/Python","slug":"thealgorithms-python"}]},"alternatives":[],"note":null}],"prompts":[{"slug":"ghostty-documentation-clarity-and-formatting","title":"Documentation clarity and formatting","description":"Ensure documentation is clear, precise, and consistently formatted. Key practices include: 1. **Be explicit and unambiguous** - Define terms that might be unclear and provide specific guidance:","repository":"ghostty-org/ghostty","domain":"devtools","topic":"Documentation","language":"Yaml","updated":"2025-05-06","comments":8,"stars":32864,"raw":"https://awesomereviewers.com/raw/ghostty-documentation-clarity-and-formatting.md"},{"slug":"discourse-consistent-text-formatting","title":"Consistent text formatting","description":"Ensure text formatting follows established guidelines and maintains consistency within the same context. This applies to documentation strings, localization files, user interface text, and error messages.","repository":"discourse/discourse","domain":"app-frameworks","topic":"Documentation","language":"Yaml","updated":"2025-08-08","comments":2,"stars":44898,"raw":"https://awesomereviewers.com/raw/discourse-consistent-text-formatting.md"},{"slug":"azure-sdk-for-net-document-non-obvious-code","title":"Document non-obvious code","description":"Add clarifying comments to code elements whose purpose or behavior may not be immediately apparent to other developers. This includes conditional logic blocks, empty configuration properties, and any code structures whose intent requires context to understand.","repository":"Azure/azure-sdk-for-net","domain":"cloud-infra","topic":"Documentation","language":"Yaml","updated":"2025-06-13","comments":2,"stars":5809,"raw":"https://awesomereviewers.com/raw/azure-sdk-for-net-document-non-obvious-code.md"},{"slug":"mastodon-framework-aware-text-composition","title":"Framework-aware text composition","description":"When writing user-facing text (error messages, notifications, labels), understand how your framework automatically processes and modifies that text before it reaches users. Many frameworks like Rails automatically combine messages with attribute names or apply other transformations that can result in redundant or grammatically incorrect output.","repository":"mastodon/mastodon","domain":"app-frameworks","topic":"Documentation","language":"Yaml","updated":"2025-05-05","comments":2,"stars":48691,"raw":"https://awesomereviewers.com/raw/mastodon-framework-aware-text-composition.md"},{"slug":"hyprland-explain-documentation-rationale","title":"Explain documentation rationale","description":"When writing user-facing documentation, always explain WHY a guideline or requirement exists, not just WHAT users should do. Users are more likely to follow instructions when they understand the reasoning behind them.","repository":"hyprwm/Hyprland","domain":"devtools","topic":"Documentation","language":"Yaml","updated":"2025-01-02","comments":2,"stars":28863,"raw":"https://awesomereviewers.com/raw/hyprland-explain-documentation-rationale.md"},{"slug":"kubeflow-structure-for-navigation","title":"Structure for navigation","description":"Documentation should be structured to optimize user navigation and information discovery. When organizing documentation elements: 1. Group related information into logical categories to help users find relevant content faster","repository":"kubeflow/kubeflow","domain":"ml-systems","topic":"Documentation","language":"Yaml","updated":"2024-09-09","comments":2,"stars":15064,"raw":"https://awesomereviewers.com/raw/kubeflow-structure-for-navigation.md"},{"slug":"kong-release-note-formatting","title":"Release note formatting","description":"When updating documentation that is consumed by automated release tooling (such as changelog YAML), verify both the semantic classification and the generated markdown rendering.","repository":"Kong/kong","domain":"cloud-infra","topic":"Documentation","language":"Yaml","updated":"2024-08-12","comments":2,"stars":43871,"raw":"https://awesomereviewers.com/raw/kong-release-note-formatting.md"}],"prompt_count":7}]}