# Verifying YAML and CI workflows changes

Files: `.yml`, `.yaml`. Derived from 12 scanned source repositories and 295 review prompts on https://awesomereviewers.com. Page: https://awesomereviewers.com/verify/yaml/

How to use this: run every check under *Run on every change*. Then, for each section under *Add when the change touches* that describes your diff, run its checks too. Checks catch what a tool can find; then apply the listed review prompts for what tools miss (fetch each prompt's raw URL).

Usage is the share of scanned repositories in this language that run the tool. A missing tool means no scanned repository runs one the scanner recognises: fall back to the prompts.

## Run on every change

- **Formatting**: `prettier` (42% of repos). Command seen: `prettier --experimental-cli --write .`. Autofixes. Exit codes: `0` everything formatted; `1` something was not formatted (--check); `2` prettier error. Docs: https://prettier.io/docs/cli#exit-codes
- **Linting** — no tool detected in the sample. Catches: Bug-prone patterns, unused code and conventions the formatter does not cover.
- **Type checking** — no tool detected in the sample. Catches: Wrong types, unhandled null or None, call signatures broken across modules.
- **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.

Review prompts (21 in total, most discussed first):

- [Use Standard Entity Identifiers](https://awesomereviewers.com/raw/azure-sentinel-use-standard-entity-identifiers.md) — Azure/Azure-Sentinel, Naming Conventions
- [Proper shell quoting](https://awesomereviewers.com/raw/grafana-proper-shell-quoting.md) — grafana/grafana, Code Style
- [Use accessible terminology](https://awesomereviewers.com/raw/mastodon-use-accessible-terminology.md) — mastodon/mastodon, Naming Conventions
- [Prefer Explicit Projection](https://awesomereviewers.com/raw/azure-sentinel-prefer-explicit-projection.md) — Azure/Azure-Sentinel, Code Style
- [maintain consistent naming patterns](https://awesomereviewers.com/raw/istio-maintain-consistent-naming-patterns.md) — istio/istio, Naming Conventions
- [Choose familiar, intuitive names](https://awesomereviewers.com/raw/alacritty-choose-familiar-intuitive-names.md) — alacritty/alacritty, Naming Conventions
- [Remove commented code](https://awesomereviewers.com/raw/chef-remove-commented-code.md) — chef/chef, Code Style
- [Canonical naming semantics](https://awesomereviewers.com/raw/azure-cli-canonical-naming-semantics.md) — Azure/azure-cli, Naming Conventions
- [YAML Message Folding](https://awesomereviewers.com/raw/kong-yaml-message-folding.md) — Kong/kong, Code Style
- [Avoid stray commas](https://awesomereviewers.com/raw/python-avoid-stray-commas.md) — TheAlgorithms/Python, Code Style
- [Use semantic names](https://awesomereviewers.com/raw/python-use-semantic-names.md) — TheAlgorithms/Python, Naming Conventions
- [Self-documenting identifiers](https://awesomereviewers.com/raw/discourse-self-documenting-identifiers.md) — discourse/discourse, Naming Conventions

## Add when the change touches

### Authentication, input handling, secrets, permissions

- **Security scanning**: `codeql` (33% of repos). Runs via GitHub Action github/codeql-action/analyze. Alternatives: semgrep (8%). Docs: https://github.com/github/codeql
- **Secret scanning** — no tool detected in the sample. Catches: Credentials and tokens committed to the repository.
- **Dependency audit** — no tool detected in the sample. Catches: Known-vulnerable or disallowed dependencies and licenses.

Review prompts (57 in total, most discussed first):

- [Security Invariants Testing](https://awesomereviewers.com/raw/qwen-code-security-invariants-testing.md) — QwenLM/qwen-code, Security
- [Limit token permissions](https://awesomereviewers.com/raw/chef-limit-token-permissions.md) — chef/chef, Security
- [Fail-Closed Release Security](https://awesomereviewers.com/raw/codex-security-fail-closed-release-security.md) — openai/codex-security, Security
- [Secure configs across environments](https://awesomereviewers.com/raw/bifrost-secure-configs-across-environments.md) — maximhq/bifrost, Security
- [Cross-service Permission Hardening](https://awesomereviewers.com/raw/azure-sentinel-cross-service-permission-hardening.md) — Azure/Azure-Sentinel, Security
- [Harden CI/CD workflows](https://awesomereviewers.com/raw/express-harden-cicd-workflows.md) — expressjs/Express, Security
- [Never commit credentials](https://awesomereviewers.com/raw/n8n-never-commit-credentials.md) — n8n-io/n8n, Security
- [Comprehensive security scanning](https://awesomereviewers.com/raw/checkov-comprehensive-security-scanning.md) — bridgecrewio/checkov, Security
- [Enforce Boundary Least-Privilege](https://awesomereviewers.com/raw/agentcore-samples-enforce-boundary-least-privilege.md) — awslabs/agentcore-samples, Security
- [Secure Actions Inputs](https://awesomereviewers.com/raw/last30days-skill-secure-actions-inputs.md) — mvanhorn/last30days-skill, Security
- [CI Security Defaults](https://awesomereviewers.com/raw/aidlc-workflows-ci-security-defaults.md) — awslabs/aidlc-workflows, Security
- [Immutable Setup Pinning](https://awesomereviewers.com/raw/goose-immutable-setup-pinning.md) — aaif-goose/goose, Security

### Public APIs, signatures, error paths, nullability

- **Type checking** — no tool detected in the sample. Catches: Wrong types, unhandled null or None, call signatures broken across modules.
- **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.
- **Property-based tests** — no tool detected in the sample. Catches: Edge-case inputs nobody wrote a test for; invariants over generated data.

Review prompts (11 in total, most discussed first):

- [Trusted Error Handling](https://awesomereviewers.com/raw/qwen-code-trusted-error-handling.md) — QwenLM/qwen-code, Error Handling
- [Null-safe Filters](https://awesomereviewers.com/raw/azure-sentinel-null-safe-filters.md) — Azure/Azure-Sentinel, Null Handling
- [API Call Correctness](https://awesomereviewers.com/raw/qwen-code-api-call-correctness.md) — QwenLM/qwen-code, API
- [Descriptive parameter names](https://awesomereviewers.com/raw/n8n-descriptive-parameter-names.md) — n8n-io/n8n, API
- [API version compatibility first](https://awesomereviewers.com/raw/istio-api-version-compatibility-first.md) — istio/istio, API
- [Global option placement](https://awesomereviewers.com/raw/vscode-global-option-placement.md) — microsoft/VSCode, API
- [Document data constraints](https://awesomereviewers.com/raw/langfuse-document-data-constraints.md) — langfuse/langfuse, API
- [Explicit Null Safety](https://awesomereviewers.com/raw/bifrost-explicit-null-safety.md) — maximhq/bifrost, Null Handling
- [Specify explicit REST formats](https://awesomereviewers.com/raw/elasticsearch-specify-explicit-rest-formats.md) — elastic/elasticsearch, API
- [Optimize API consumption](https://awesomereviewers.com/raw/temporal-optimize-api-consumption.md) — temporalio/temporal, API
- [Secure API endpoints](https://awesomereviewers.com/raw/checkov-secure-api-endpoints.md) — bridgecrewio/checkov, API

### Service and framework code

- **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.
- **Version and platform matrix**: `ci-matrix` (42% of repos). Command seen: `analyze (language: 5)`. Docs: https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

### Algorithms, parsers, data transforms

- **Property-based tests** — no tool detected in the sample. Catches: Edge-case inputs nobody wrote a test for; invariants over generated data.
- **Fuzzing** — no tool detected in the sample. Catches: Crashes, panics and hangs on malformed input, especially in parsers and decoders.
- **Mutation testing** — no tool detected in the sample. Catches: Tests that keep passing whatever the code does.
- **Proofs and specifications** — no tool detected in the sample. Catches: Design-level bugs in protocols and algorithms, checked against a specification.

Review prompts (2 in total, most discussed first):

- [Deterministic Set Reconciliation](https://awesomereviewers.com/raw/qwen-code-deterministic-set-reconciliation.md) — QwenLM/qwen-code, Algorithms
- [Deterministic KQL Pipelines](https://awesomereviewers.com/raw/azure-sentinel-deterministic-kql-pipelines.md) — Azure/Azure-Sentinel, Algorithms

### Threads, async code, locks, shared state

- **Concurrency model checking** — no tool detected in the sample. Catches: Races and orderings that fail only under specific interleavings.
- **Undefined-behaviour detection** — no tool detected in the sample. Catches: Memory-safety and aliasing violations in unsafe code.
- **Property-based tests** — no tool detected in the sample. Catches: Edge-case inputs nobody wrote a test for; invariants over generated data.

Review prompts (2 in total, most discussed first):

- [Concurrency synchronization rules](https://awesomereviewers.com/raw/qwen-code-concurrency-synchronization-rules.md) — QwenLM/qwen-code, Concurrency
- [Race-safe concurrency](https://awesomereviewers.com/raw/codex-security-race-safe-concurrency.md) — openai/codex-security, Concurrency

### Network calls, retries, timeouts, protocols

- **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.
- **Fuzzing** — no tool detected in the sample. Catches: Crashes, panics and hangs on malformed input, especially in parsers and decoders.

Review prompts (6 in total, most discussed first):

- [Conservative networking defaults](https://awesomereviewers.com/raw/istio-conservative-networking-defaults.md) — istio/istio, Networking
- [Portable network identity](https://awesomereviewers.com/raw/azure-sentinel-portable-network-identity.md) — Azure/Azure-Sentinel, Networking
- [Lambda CORS protection](https://awesomereviewers.com/raw/checkov-lambda-cors-protection.md) — bridgecrewio/checkov, Networking
- [Target core resources](https://awesomereviewers.com/raw/checkov-target-core-resources.md) — bridgecrewio/checkov, Networking
- [Document network configuration](https://awesomereviewers.com/raw/prisma-document-network-configuration.md) — prisma/prisma, Networking
- [Document networking annotations](https://awesomereviewers.com/raw/kubeflow-document-networking-annotations.md) — kubeflow/kubeflow, Networking

### UI components and pages

- **End-to-end browser tests** — no tool detected in the sample. Catches: User flows broken across components, routing and the network.
- **Linting** — no tool detected in the sample. Catches: Bug-prone patterns, unused code and conventions the formatter does not cover.

### Databases, migrations, caching

- **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.
- **Version and platform matrix**: `ci-matrix` (42% of repos). Command seen: `analyze (language: 5)`. Docs: https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

Review prompts (2 in total, most discussed first):

- [Stable, Scoped Query Outputs](https://awesomereviewers.com/raw/azure-sentinel-stable-scoped-query-outputs.md) — Azure/Azure-Sentinel, Database
- [Deterministic CI Cache Keys](https://awesomereviewers.com/raw/vscode-deterministic-ci-cache-keys.md) — microsoft/VSCode, Caching

### Hot paths and performance

- No tool-based check applies; rely on the prompts.

Review prompts (4 in total, most discussed first):

- [Early Filter and Cache](https://awesomereviewers.com/raw/azure-sentinel-early-filter-and-cache.md) — Azure/Azure-Sentinel, Performance Optimization
- [Minimize expensive API calls](https://awesomereviewers.com/raw/qwen-code-minimize-expensive-api-calls.md) — QwenLM/qwen-code, Performance Optimization
- [Benchmark performance changes](https://awesomereviewers.com/raw/kubernetes-benchmark-performance-changes.md) — kubernetes/kubernetes, Performance Optimization
- [Optimize compilation flags](https://awesomereviewers.com/raw/maplibre-native-optimize-compilation-flags.md) — maplibre/maplibre-native, Performance Optimization

### Model, prompt and LLM code

- **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.

Review prompts (2 in total, most discussed first):

- [AI eval config correctness](https://awesomereviewers.com/raw/promptfoo-ai-eval-config-correctness.md) — promptfoo/promptfoo, AI
- [Responsible AI management](https://awesomereviewers.com/raw/dify-responsible-ai-management.md) — langgenius/dify, AI

### Logging, metrics, tracing

- No tool-based check applies; rely on the prompts.

Review prompts (4 in total, most discussed first):

- [Document observability rationale](https://awesomereviewers.com/raw/istio-document-observability-rationale.md) — istio/istio, Observability
- [Warn on silent failures](https://awesomereviewers.com/raw/qwen-code-warn-on-silent-failures.md) — QwenLM/qwen-code, Logging
- [Triage-Ready Telemetry](https://awesomereviewers.com/raw/azure-sentinel-triage-ready-telemetry.md) — Azure/Azure-Sentinel, Observability
- [Configure OpenTelemetry programmatically](https://awesomereviewers.com/raw/temporal-configure-opentelemetry-programmatically.md) — temporalio/temporal, Observability

### CI workflows and configuration files

- **CI workflow linting**: `actionlint` (17% of repos). Command seen: `actionlint -color`. Alternatives: zizmor (17%). Docs: https://github.com/rhysd/actionlint
- **File hygiene**: `pre-commit-hooks` (33% of repos). Runs via pre-commit hook trailing-whitespace. Autofixes. Docs: https://github.com/pre-commit/pre-commit-hooks

Review prompts (167 in total, most discussed first):

- [Keep CI configurations minimal](https://awesomereviewers.com/raw/framework-keep-ci-configurations-minimal.md) — laravel/framework, CI/CD
- [CI workflow correctness](https://awesomereviewers.com/raw/python-ci-workflow-correctness.md) — TheAlgorithms/Python, CI/CD
- [Workflow State Hygiene](https://awesomereviewers.com/raw/qwen-code-workflow-state-hygiene.md) — QwenLM/qwen-code, CI/CD
- [Deterministic CI Runs](https://awesomereviewers.com/raw/nanochat-deterministic-ci-runs.md) — karpathy/nanochat, CI/CD
- [Gated deterministic releases](https://awesomereviewers.com/raw/codex-security-gated-deterministic-releases.md) — openai/codex-security, CI/CD
- [Resilient Efficient CI](https://awesomereviewers.com/raw/vscode-resilient-efficient-ci.md) — microsoft/VSCode, CI/CD
- [CI/CD Workflow Guardrails](https://awesomereviewers.com/raw/redis-cicd-workflow-guardrails.md) — redis/redis, CI/CD
- [Deterministic CI Practices](https://awesomereviewers.com/raw/query-deterministic-ci-practices.md) — tanstack/query, CI/CD
- [CI script reliability practices](https://awesomereviewers.com/raw/continue-ci-script-reliability-practices.md) — continuedev/continue, CI/CD
- [Pin and automate action dependencies](https://awesomereviewers.com/raw/express-pin-and-automate-action-dependencies.md) — expressjs/Express, CI/CD
- [Precise workflow triggers](https://awesomereviewers.com/raw/kubeflow-precise-workflow-triggers.md) — kubeflow/kubeflow, CI/CD
- [Parameterize Config Values](https://awesomereviewers.com/raw/azure-sentinel-parameterize-config-values.md) — Azure/Azure-Sentinel, Configurations

### Dependencies and lockfiles

- **Dependency audit** — no tool detected in the sample. Catches: Known-vulnerable or disallowed dependencies and licenses.
- **Lockfile consistency** — no tool detected in the sample. Catches: A lockfile that no longer matches its manifest.
- **Version and platform matrix**: `ci-matrix` (42% of repos). Command seen: `analyze (language: 5)`. Docs: https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

### The tests themselves

- **Mutation testing** — no tool detected in the sample. Catches: Tests that keep passing whatever the code does.
- **Version and platform matrix**: `ci-matrix` (42% of repos). Command seen: `analyze (language: 5)`. Docs: https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

Review prompts (10 in total, most discussed first):

- [Contract-Driven Workflow Testing](https://awesomereviewers.com/raw/qwen-code-contract-driven-workflow-testing.md) — QwenLM/qwen-code, Testing
- [Disable coverage in workflows](https://awesomereviewers.com/raw/framework-disable-coverage-in-workflows.md) — laravel/framework, Testing
- [Ensure comprehensive test coverage](https://awesomereviewers.com/raw/semgrep-ensure-comprehensive-test-coverage.md) — semgrep/semgrep, Testing
- [Deterministic External Testing](https://awesomereviewers.com/raw/azure-cli-deterministic-external-testing.md) — Azure/azure-cli, Testing
- [CI testing tool integration](https://awesomereviewers.com/raw/dify-ci-testing-tool-integration.md) — langgenius/dify, Testing
- [Avoid flaky tests](https://awesomereviewers.com/raw/elasticsearch-avoid-flaky-tests.md) — elastic/elasticsearch, Testing
- [organize tests by category](https://awesomereviewers.com/raw/browser-use-organize-tests-by-category.md) — browser-use/browser-use, Testing
- [Test diverse configurations](https://awesomereviewers.com/raw/tokio-test-diverse-configurations.md) — tokio-rs/tokio, Testing
- [Test production configurations too](https://awesomereviewers.com/raw/tokio-test-production-configurations-too.md) — tokio-rs/tokio, Testing
- [avoid `-count=1` flag](https://awesomereviewers.com/raw/fiber-avoid-count1-flag.md) — gofiber/fiber, Testing

### Documentation and comments

- **Docs build** — no tool detected in the sample. Catches: Broken cross-references, links and markup in documentation.
- **Spelling**: `codespell` (8% of repos). Runs via pre-commit hook codespell. Docs: https://github.com/codespell-project/codespell

Review prompts (7 in total, most discussed first):

- [Documentation clarity and formatting](https://awesomereviewers.com/raw/ghostty-documentation-clarity-and-formatting.md) — ghostty-org/ghostty, Documentation
- [Consistent text formatting](https://awesomereviewers.com/raw/discourse-consistent-text-formatting.md) — discourse/discourse, Documentation
- [Document non-obvious code](https://awesomereviewers.com/raw/azure-sdk-for-net-document-non-obvious-code.md) — Azure/azure-sdk-for-net, Documentation
- [Framework-aware text composition](https://awesomereviewers.com/raw/mastodon-framework-aware-text-composition.md) — mastodon/mastodon, Documentation
- [Explain documentation rationale](https://awesomereviewers.com/raw/hyprland-explain-documentation-rationale.md) — hyprwm/Hyprland, Documentation
- [Structure for navigation](https://awesomereviewers.com/raw/kubeflow-structure-for-navigation.md) — kubeflow/kubeflow, Documentation
- [Release note formatting](https://awesomereviewers.com/raw/kong-release-note-formatting.md) — Kong/kong, Documentation

## Source repositories

[EbookFoundation/free-programming-books](https://awesomereviewers.com/sources/ebookfoundation-free-programming-books/), [TheAlgorithms/Python](https://awesomereviewers.com/sources/thealgorithms-python/), [Kong/kong](https://awesomereviewers.com/sources/kong-kong/), [prisma/prisma](https://awesomereviewers.com/sources/prisma-prisma/), [istio/istio](https://awesomereviewers.com/sources/istio-istio/), [QwenLM/qwen-code](https://awesomereviewers.com/sources/qwenlm-qwen-code/), [anthropics/claude-code](https://awesomereviewers.com/sources/anthropics-claude-code/), [SWE-agent/SWE-agent](https://awesomereviewers.com/sources/swe-agent-swe-agent/), [astral-sh/ty](https://awesomereviewers.com/sources/astral-sh-ty/), [openai/codex-security](https://awesomereviewers.com/sources/openai-codex-security/), [bridgecrewio/checkov](https://awesomereviewers.com/sources/bridgecrewio-checkov/), [Azure/Azure-Sentinel](https://awesomereviewers.com/sources/azure-azure-sentinel/)