When reviewing GitHub Actions used for CI/CD automation, verify three things:

1) Repo context is available

• If the workflow reads files from the repository (e.g., .github/labeler.yml), ensure actions/checkout is present.

2) Automation is testable without merging

• For workflows that comment/close/alter PRs, add a safe test path so you can validate behavior on a non-merged PR (e.g., gate execution behind a dedicated test label).

3) Permissions match the actual API usage

• Confirm the permissions block grants only what’s needed for the specific targets the action touches (e.g., PRs vs issues), and don’t assume old permission requirements won’t resurface.

Example patterns:

• Ensure checkout before reading repo config: ```yaml

• name: Checkout uses: actions/checkout@v4

• name: Apply labels using labeler uses: actions/labeler@v5 with: pr-number: ${{ steps.pr-number.outputs.number }} repo-token: ${{ secrets.GITHUB_TOKEN }} configuration-path: .github/labeler.yml ```

• Gate “stale PR” behavior behind a test label (safe dry-run style): ```yaml

  Example approach: trigger on schedule, but only operate when a PR has a specific label.

  (Exact wiring depends on the action version you use.)

• name: Mark stale PRs uses: actions/stale@vX with: only-labels: stale-ci-test # keep existing close/comment settings as desired ```

Apply this as a checklist during CI/CD workflow reviews to prevent silent misconfigurations, missing file access, and hard-to-test automation that can impact real PRs.