Awesome Reviewers

Verifying YAML and CI workflows changes

Files: .yml, .yaml. Derived from 12 scanned source repositories and 295 review prompts on https://awesomereviewers.com. Page: https://awesomereviewers.com/verify/yaml/

How to use this: run every check under Run on every change. Then, for each section under Add when the change touches that describes your diff, run its checks too. Checks catch what a tool can find; then apply the listed review prompts for what tools miss (fetch each prompt’s raw URL).

Usage is the share of scanned repositories in this language that run the tool. A missing tool means no scanned repository runs one the scanner recognises: fall back to the prompts.

Run on every change

• Formatting: prettier (42% of repos). Command seen: prettier --experimental-cli --write .. Autofixes. Exit codes: 0 everything formatted; 1 something was not formatted (–check); 2 prettier error. Docs: https://prettier.io/docs/cli#exit-codes
• Linting — no tool detected in the sample. Catches: Bug-prone patterns, unused code and conventions the formatter does not cover.
• Type checking — no tool detected in the sample. Catches: Wrong types, unhandled null or None, call signatures broken across modules.
• Unit and integration tests — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.

Review prompts (21 in total, most discussed first):

• Use Standard Entity Identifiers — Azure/Azure-Sentinel, Naming Conventions
• Proper shell quoting — grafana/grafana, Code Style
• Use accessible terminology — mastodon/mastodon, Naming Conventions
• Prefer Explicit Projection — Azure/Azure-Sentinel, Code Style
• maintain consistent naming patterns — istio/istio, Naming Conventions
• Choose familiar, intuitive names — alacritty/alacritty, Naming Conventions
• Remove commented code — chef/chef, Code Style
• Canonical naming semantics — Azure/azure-cli, Naming Conventions
• YAML Message Folding — Kong/kong, Code Style
• Avoid stray commas — TheAlgorithms/Python, Code Style
• Use semantic names — TheAlgorithms/Python, Naming Conventions
• Self-documenting identifiers — discourse/discourse, Naming Conventions

Add when the change touches

Authentication, input handling, secrets, permissions

• Security scanning: codeql (33% of repos). Runs via GitHub Action github/codeql-action/analyze. Alternatives: semgrep (8%). Docs: https://github.com/github/codeql
• Secret scanning — no tool detected in the sample. Catches: Credentials and tokens committed to the repository.
• Dependency audit — no tool detected in the sample. Catches: Known-vulnerable or disallowed dependencies and licenses.

Review prompts (57 in total, most discussed first):

• Security Invariants Testing — QwenLM/qwen-code, Security
• Limit token permissions — chef/chef, Security
• Fail-Closed Release Security — openai/codex-security, Security
• Secure configs across environments — maximhq/bifrost, Security
• Cross-service Permission Hardening — Azure/Azure-Sentinel, Security
• Harden CI/CD workflows — expressjs/Express, Security
• Never commit credentials — n8n-io/n8n, Security
• Comprehensive security scanning — bridgecrewio/checkov, Security
• Enforce Boundary Least-Privilege — awslabs/agentcore-samples, Security
• Secure Actions Inputs — mvanhorn/last30days-skill, Security
• CI Security Defaults — awslabs/aidlc-workflows, Security
• Immutable Setup Pinning — aaif-goose/goose, Security

Public APIs, signatures, error paths, nullability

• Type checking — no tool detected in the sample. Catches: Wrong types, unhandled null or None, call signatures broken across modules.
• Unit and integration tests — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.
• Property-based tests — no tool detected in the sample. Catches: Edge-case inputs nobody wrote a test for; invariants over generated data.

Review prompts (11 in total, most discussed first):

• Trusted Error Handling — QwenLM/qwen-code, Error Handling
• Null-safe Filters — Azure/Azure-Sentinel, Null Handling
• API Call Correctness — QwenLM/qwen-code, API
• Descriptive parameter names — n8n-io/n8n, API
• API version compatibility first — istio/istio, API
• Global option placement — microsoft/VSCode, API
• Document data constraints — langfuse/langfuse, API
• Explicit Null Safety — maximhq/bifrost, Null Handling
• Specify explicit REST formats — elastic/elasticsearch, API
• Optimize API consumption — temporalio/temporal, API
• Secure API endpoints — bridgecrewio/checkov, API

Service and framework code

• Unit and integration tests — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.
• Version and platform matrix: ci-matrix (42% of repos). Command seen: analyze (language: 5). Docs: https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

Algorithms, parsers, data transforms

• Property-based tests — no tool detected in the sample. Catches: Edge-case inputs nobody wrote a test for; invariants over generated data.
• Fuzzing — no tool detected in the sample. Catches: Crashes, panics and hangs on malformed input, especially in parsers and decoders.
• Mutation testing — no tool detected in the sample. Catches: Tests that keep passing whatever the code does.
• Proofs and specifications — no tool detected in the sample. Catches: Design-level bugs in protocols and algorithms, checked against a specification.

Review prompts (2 in total, most discussed first):

• Deterministic Set Reconciliation — QwenLM/qwen-code, Algorithms
• Deterministic KQL Pipelines — Azure/Azure-Sentinel, Algorithms

Threads, async code, locks, shared state

• Concurrency model checking — no tool detected in the sample. Catches: Races and orderings that fail only under specific interleavings.
• Undefined-behaviour detection — no tool detected in the sample. Catches: Memory-safety and aliasing violations in unsafe code.
• Property-based tests — no tool detected in the sample. Catches: Edge-case inputs nobody wrote a test for; invariants over generated data.

Review prompts (2 in total, most discussed first):

• Concurrency synchronization rules — QwenLM/qwen-code, Concurrency
• Race-safe concurrency — openai/codex-security, Concurrency

Network calls, retries, timeouts, protocols

• Unit and integration tests — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.
• Fuzzing — no tool detected in the sample. Catches: Crashes, panics and hangs on malformed input, especially in parsers and decoders.

Review prompts (6 in total, most discussed first):

• Conservative networking defaults — istio/istio, Networking
• Portable network identity — Azure/Azure-Sentinel, Networking
• Lambda CORS protection — bridgecrewio/checkov, Networking
• Target core resources — bridgecrewio/checkov, Networking
• Document network configuration — prisma/prisma, Networking
• Document networking annotations — kubeflow/kubeflow, Networking

UI components and pages

• End-to-end browser tests — no tool detected in the sample. Catches: User flows broken across components, routing and the network.
• Linting — no tool detected in the sample. Catches: Bug-prone patterns, unused code and conventions the formatter does not cover.

Databases, migrations, caching

• Unit and integration tests — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.
• Version and platform matrix: ci-matrix (42% of repos). Command seen: analyze (language: 5). Docs: https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

Review prompts (2 in total, most discussed first):

• Stable, Scoped Query Outputs — Azure/Azure-Sentinel, Database
• Deterministic CI Cache Keys — microsoft/VSCode, Caching

Hot paths and performance

• No tool-based check applies; rely on the prompts.

Review prompts (4 in total, most discussed first):

• Early Filter and Cache — Azure/Azure-Sentinel, Performance Optimization
• Minimize expensive API calls — QwenLM/qwen-code, Performance Optimization
• Benchmark performance changes — kubernetes/kubernetes, Performance Optimization
• Optimize compilation flags — maplibre/maplibre-native, Performance Optimization

Model, prompt and LLM code

• Unit and integration tests — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.

Review prompts (2 in total, most discussed first):

• AI eval config correctness — promptfoo/promptfoo, AI
• Responsible AI management — langgenius/dify, AI

Logging, metrics, tracing

• No tool-based check applies; rely on the prompts.

Review prompts (4 in total, most discussed first):

• Document observability rationale — istio/istio, Observability
• Warn on silent failures — QwenLM/qwen-code, Logging
• Triage-Ready Telemetry — Azure/Azure-Sentinel, Observability
• Configure OpenTelemetry programmatically — temporalio/temporal, Observability

CI workflows and configuration files

• CI workflow linting: actionlint (17% of repos). Command seen: actionlint -color. Alternatives: zizmor (17%). Docs: https://github.com/rhysd/actionlint
• File hygiene: pre-commit-hooks (33% of repos). Runs via pre-commit hook trailing-whitespace. Autofixes. Docs: https://github.com/pre-commit/pre-commit-hooks

Review prompts (167 in total, most discussed first):

• Keep CI configurations minimal — laravel/framework, CI/CD
• CI workflow correctness — TheAlgorithms/Python, CI/CD
• Workflow State Hygiene — QwenLM/qwen-code, CI/CD
• Deterministic CI Runs — karpathy/nanochat, CI/CD
• Gated deterministic releases — openai/codex-security, CI/CD
• Resilient Efficient CI — microsoft/VSCode, CI/CD
• CI/CD Workflow Guardrails — redis/redis, CI/CD
• Deterministic CI Practices — tanstack/query, CI/CD
• CI script reliability practices — continuedev/continue, CI/CD
• Pin and automate action dependencies — expressjs/Express, CI/CD
• Precise workflow triggers — kubeflow/kubeflow, CI/CD
• Parameterize Config Values — Azure/Azure-Sentinel, Configurations

Dependencies and lockfiles

• Dependency audit — no tool detected in the sample. Catches: Known-vulnerable or disallowed dependencies and licenses.
• Lockfile consistency — no tool detected in the sample. Catches: A lockfile that no longer matches its manifest.
• Version and platform matrix: ci-matrix (42% of repos). Command seen: analyze (language: 5). Docs: https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

The tests themselves

• Mutation testing — no tool detected in the sample. Catches: Tests that keep passing whatever the code does.
• Version and platform matrix: ci-matrix (42% of repos). Command seen: analyze (language: 5). Docs: https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

Review prompts (10 in total, most discussed first):

• Contract-Driven Workflow Testing — QwenLM/qwen-code, Testing
• Disable coverage in workflows — laravel/framework, Testing
• Ensure comprehensive test coverage — semgrep/semgrep, Testing
• Deterministic External Testing — Azure/azure-cli, Testing
• CI testing tool integration — langgenius/dify, Testing
• Avoid flaky tests — elastic/elasticsearch, Testing
• organize tests by category — browser-use/browser-use, Testing
• Test diverse configurations — tokio-rs/tokio, Testing
• Test production configurations too — tokio-rs/tokio, Testing
• avoid -count=1 flag — gofiber/fiber, Testing

Documentation and comments

• Docs build — no tool detected in the sample. Catches: Broken cross-references, links and markup in documentation.
• Spelling: codespell (8% of repos). Runs via pre-commit hook codespell. Docs: https://github.com/codespell-project/codespell

Review prompts (7 in total, most discussed first):

• Documentation clarity and formatting — ghostty-org/ghostty, Documentation
• Consistent text formatting — discourse/discourse, Documentation
• Document non-obvious code — Azure/azure-sdk-for-net, Documentation
• Framework-aware text composition — mastodon/mastodon, Documentation
• Explain documentation rationale — hyprwm/Hyprland, Documentation
• Structure for navigation — kubeflow/kubeflow, Documentation
• Release note formatting — Kong/kong, Documentation

Source repositories

EbookFoundation/free-programming-books, TheAlgorithms/Python, Kong/kong, prisma/prisma, istio/istio, QwenLM/qwen-code, anthropics/claude-code, SWE-agent/SWE-agent, astral-sh/ty, openai/codex-security, bridgecrewio/checkov, Azure/Azure-Sentinel

This site is open source. Improve this page.