Verifying YAML and CI workflows changes

• Security scanning Injection, unsafe APIs and tainted data reaching a sink.
  codeql 33% · 4 of 12 repos

  runs via GitHub Action github/codeql-action/analyze

  exit codes, docs, alternatives, where it runs

  • Runs inci
  • Alternativessemgrep 8%
  • Seen inprisma/prisma, QwenLM/qwen-code, bridgecrewio/checkov, Azure/Azure-Sentinel
  • Docshttps://github.com/github/codeql
• Secret scanning Credentials and tokens committed to the repository.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Dependency audit Known-vulnerable or disallowed dependencies and licenses.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Security Invariants TestingTreat CI/workflow security like production security code: define explicit invariants, enforce them defensively, and lock them with execut...

  QwenLM/qwen-code Security Yaml ai-agents 2026-07-28

  copy raw open
• Limit token permissionsAlways specify the minimum required permissions for the GITHUB_TOKEN in GitHub Actions workflows to enhance security. By default, the GIT...

  chef/chef Security Yaml cloud-infra 2025-07-01

  copy raw open
• Fail-Closed Release SecurityAny security-sensitive release/publish workflow must be deterministic, run only on trusted code, validate against authoritative data, and...

  openai/codex-security Security Yaml security 2026-07-30

  copy raw open
• Secure configs across environmentsWhen making security-related changes, ensure the configuration is (1) least-privilege/scoped, (2) actually enforced by the platform, and ...

  maximhq/bifrost Security Yaml llm-infra 2026-07-04

  copy raw open
• Cross-service Permission HardeningWhen granting permissions across AWS services (S3→SQS, EventBridge→Lambda, etc.), use the correct permission model and apply least-privil...

  Azure/Azure-Sentinel Security Yaml cloud-infra 2026-06-25

  copy raw open

52 more in Security — the playbook lists the top 12.

• Type checking Wrong types, unhandled null or None, call signatures broken across modules.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Unit and integration tests Behaviour regressions on the paths the tests exercise.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Property-based tests Edge-case inputs nobody wrote a test for; invariants over generated data.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Trusted Error HandlingUse strict, non-silent error handling and evidence gating across CI scripts and publish steps—especially when untrusted inputs and reruns...

  QwenLM/qwen-code Error Handling Yaml ai-agents 2026-07-28

  copy raw open
• Null-safe FiltersEnsure queries and ASIM parsers handle nullable/optional fields safely by (1) using type-correct null checks, (2) guarding references to ...

  Azure/Azure-Sentinel Null Handling Yaml cloud-infra 2026-07-29

  copy raw open
• API Call CorrectnessWhen automating GitHub (or similar) APIs from CI/workflows, treat API access like production client code: make it correct, complete, and ...

  QwenLM/qwen-code API Yaml ai-agents 2026-07-29

  copy raw open
• Descriptive parameter namesUse specific, descriptive parameter names for API resources rather than generic identifiers. Parameter names should clearly indicate the ...

  n8n-io/n8n API Yaml ai-agents 2025-07-10

  copy raw open
• API version compatibility firstWhen selecting API versions, prioritize compatibility over using the latest available version. Choose older, stable API versions when the...

  istio/istio API Yaml orchestration 2022-11-22

  copy raw open

6 more in API, Error Handling, Null Handling — the playbook lists the top 11.

• Unit and integration tests Behaviour regressions on the paths the tests exercise.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.
  ci-matrix 42% · 5 of 12 repos

  analyze (language: 5)copy

  exit codes, docs, alternatives, where it runs

  • Commands seenanalyze (language: 5)
analyze (ref: 2, language: 1)
behavior (node: 2)
  • Runs inci
  • Seen inprisma/prisma, QwenLM/qwen-code, openai/codex-security, bridgecrewio/checkov, Azure/Azure-Sentinel
  • Docshttps://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

• Property-based tests Edge-case inputs nobody wrote a test for; invariants over generated data.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Fuzzing Crashes, panics and hangs on malformed input, especially in parsers and decoders.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Mutation testing Tests that keep passing whatever the code does.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Proofs and specifications Design-level bugs in protocols and algorithms, checked against a specification.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Deterministic Set ReconciliationWhen you correlate agent outputs, commit history, or prior workflow state across time, avoid fuzzy matching and “best-effort” heuristics....

  QwenLM/qwen-code Algorithms Yaml ai-agents 2026-07-28

  copy raw open
• Deterministic KQL PipelinesTreat each analytics/hunting query as a deterministic algorithm: parse based on the actual encoded input, collapse repeated events by key...

  Azure/Azure-Sentinel Algorithms Yaml cloud-infra 2026-07-02

  copy raw open

• Concurrency model checking Races and orderings that fail only under specific interleavings.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Undefined-behaviour detection Memory-safety and aliasing violations in unsafe code.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Property-based tests Edge-case inputs nobody wrote a test for; invariants over generated data.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Concurrency synchronization rulesDesign GitHub Actions concurrency so overlapping runs can’t corrupt multi-step outcomes. Rules: 1) Don’t assume `concurrency` is a durabl...

  QwenLM/qwen-code Concurrency Yaml ai-agents 2026-07-26

  copy raw open
• Race-safe concurrencyWhen multiple workflow runs mutate or publish to the same shared external resource (labels, registries, “latest”), make synchronization e...

  openai/codex-security Concurrency Yaml security 2026-07-29

  copy raw open

• Unit and integration tests Behaviour regressions on the paths the tests exercise.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Fuzzing Crashes, panics and hangs on malformed input, especially in parsers and decoders.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Conservative networking defaultsWhen configuring networking components, prefer stable and permissive defaults over restrictive or experimental configurations that may no...

  istio/istio Networking Yaml orchestration 2025-07-21

  copy raw open
• Portable network identityWhen implementing networking-related configuration or telemetry parsing, avoid brittle assumptions about IP/host formats and instead use ...

  Azure/Azure-Sentinel Networking Yaml cloud-infra 2026-07-21

  copy raw open
• Lambda CORS protectionWhen implementing network security checks for AWS Lambda functions, ensure that CORS (Cross-Origin Resource Sharing) policies are verifie...

  bridgecrewio/checkov Networking Yaml security 2025-04-20

  copy raw open
• Target core resourcesWhen implementing network security checks for serverless functions like AWS Lambda, ensure you target the core function resources rather ...

  bridgecrewio/checkov Networking Yaml security 2025-04-20

  copy raw open
• Document network configurationWhen configuring network settings in containerized services, always document the reasoning behind specific choices, especially for port m...

  prisma/prisma Networking Yaml data-systems 2024-08-02

  copy raw open

1 more in Networking, Axios — the playbook lists the top 6.

• End-to-end browser tests User flows broken across components, routing and the network.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Linting Bug-prone patterns, unused code and conventions the formatter does not cover.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Unit and integration tests Behaviour regressions on the paths the tests exercise.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.
  ci-matrix 42% · 5 of 12 repos

  analyze (language: 5)copy

  exit codes, docs, alternatives, where it runs

  • Commands seenanalyze (language: 5)
analyze (ref: 2, language: 1)
behavior (node: 2)
  • Runs inci
  • Seen inprisma/prisma, QwenLM/qwen-code, openai/codex-security, bridgecrewio/checkov, Azure/Azure-Sentinel
  • Docshttps://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

• Stable, Scoped Query OutputsWhen writing KQL for Sentinel (parsers, analytic rules, hunts), make\ \ query outputs and intermediate datasets stable and correct: \n\n-...

  Azure/Azure-Sentinel Database Yaml cloud-infra 2026-07-21

  copy raw open
• Deterministic CI Cache KeysUse deterministic, content-derived cache keys and ensure every producer/consumer of that cache computes the key *identically*. Apply thes...

  microsoft/VSCode Caching Yaml devtools 2026-10-22

  copy raw open

No tool-based check applies. The review prompts below are the verification.

• Early Filter and CacheWhen writing KQL (hunting queries or ASIM parsers), optimize for fewer rows and fewer expensive computations: 1) Prefilter early (before ...

  Azure/Azure-Sentinel Performance Optimization Yaml cloud-infra 2026-07-10

  copy raw open
• Minimize expensive API callsWhen your code depends on GitHub (or other remote) APIs, pagination and per-item mutations are often the dominant performance cost. Struc...

  QwenLM/qwen-code Performance Optimization Yaml ai-agents 2026-07-28

  copy raw open
• Benchmark performance changesAlways measure and validate performance impact through benchmarking before making changes that could affect system performance, even when...

  kubernetes/kubernetes Performance Optimization Yaml orchestration 2025-07-23

  copy raw open
• Optimize compilation flagsWhen optimizing application performance, carefully select compiler flags based on your optimization goals. For size-critical applications...

  maplibre/maplibre-native Performance Optimization Yaml app-frameworks 2023-12-17

  copy raw open

• Unit and integration tests Behaviour regressions on the paths the tests exercise.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• AI eval config correctnessWhen writing eval/test configurations for AI models and agents, make sure each run is properly isolated and uses accurate, model-specific...

  promptfoo/promptfoo AI Yaml ai-agents 2026-10-17

  copy raw open
• Responsible AI managementEnsure AI models are managed responsibly throughout their lifecycle and have appropriate boundaries on their decision-making authority. W...

  langgenius/dify AI Yaml llm-infra 2025-02-04

  copy raw open

No tool-based check applies. The review prompts below are the verification.

• Document observability rationaleWhen introducing, modifying, or removing observability features (tracing, metrics, monitoring configurations), always include clear docum...

  istio/istio Observability Yaml orchestration 2025-03-27

  copy raw open
• Warn on silent failuresIn automation scripts/workflows, never fail or skip important work silently. If a condition decides to omit a capability/flag, or if a co...

  QwenLM/qwen-code Logging Yaml ai-agents 2026-07-29

  copy raw open
• Triage-Ready TelemetryWhen implementing observability detections/parsers, ensure alerts/fields are (1) schema-correct and vendor-correct, and (2) triage-ready ...

  Azure/Azure-Sentinel Observability Yaml cloud-infra 2025-12-11

  copy raw open
• Configure OpenTelemetry programmaticallyConfigure OpenTelemetry programmatically rather than through environment variables or command-line flags. This creates a more maintainabl...

  temporalio/temporal Observability Yaml orchestration 2025-06-24

  copy raw open

• CI workflow linting Broken GitHub Actions syntax, script injection, over-broad token permissions.
  actionlint 17% · 2 of 12 repos

  actionlint -colorcopy

  exit codes, docs, alternatives, where it runs

  • Commands seenactionlint -color
actionlint -color github-action/examples/*.yml
pre-commit hook actionlint
  • Runs inpre-commit, ci
  • Alternativeszizmor 17%
  • Seen inastral-sh/ty, openai/codex-security
  • Docshttps://github.com/rhysd/actionlint
• File hygiene Invalid JSON, YAML or TOML, merge markers, trailing whitespace, oversized files.
  pre-commit-hooks 33% · 4 of 12 repos autofix

  runs via pre-commit hook trailing-whitespace

  exit codes, docs, alternatives, where it runs

  • Commands seenpre-commit hook check-merge-conflict
pre-commit hook trailing-whitespace
pre-commit hook check-added-large-files
  • Runs inpre-commit, ci
  • Seen inTheAlgorithms/Python, SWE-agent/SWE-agent, astral-sh/ty, bridgecrewio/checkov
  • Docshttps://github.com/pre-commit/pre-commit-hooks

• Keep CI configurations minimalWhen configuring CI workflows, include only the extensions, tools, and settings that are necessary for the specific tests being run. Avoi...

  laravel/framework CI/CD Yaml app-frameworks 2024-11-25

  copy raw open
• CI workflow correctnessAll CI workflows must be syntactically valid, reliably triggered, and logically non-redundant. Apply these rules: 1) Every step must be v...

  TheAlgorithms/Python CI/CD Yaml docs 2026-03-26

  copy raw open
• Workflow State HygieneCI/CD workflows should enforce *state invariants* across steps, runs, and runners: later steps must only execute when earlier phases trul...

  QwenLM/qwen-code CI/CD Yaml ai-agents 2026-07-28

  copy raw open
• Deterministic CI RunsEnsure GitHub Actions CI runs are repeatable, targeted, and don’t rely on brittle hacks. 1) Run tests using the environment you just prep...

  karpathy/nanochat CI/CD Yaml ml-systems 2026-02-16

  copy raw open
• Gated deterministic releasesAll release/publishing workflows must be deterministic, serialized safely, and strictly gated so that user-facing artifacts are published...

  openai/codex-security CI/CD Yaml security 2026-07-30

  copy raw open

162 more in CI/CD, Configurations — the playbook lists the top 12.

• Dependency audit Known-vulnerable or disallowed dependencies and licenses.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Lockfile consistency A lockfile that no longer matches its manifest.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.
  ci-matrix 42% · 5 of 12 repos

  analyze (language: 5)copy

  exit codes, docs, alternatives, where it runs

  • Commands seenanalyze (language: 5)
analyze (ref: 2, language: 1)
behavior (node: 2)
  • Runs inci
  • Seen inprisma/prisma, QwenLM/qwen-code, openai/codex-security, bridgecrewio/checkov, Azure/Azure-Sentinel
  • Docshttps://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

• Mutation testing Tests that keep passing whatever the code does.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.
  ci-matrix 42% · 5 of 12 repos

  analyze (language: 5)copy

  exit codes, docs, alternatives, where it runs

  • Commands seenanalyze (language: 5)
analyze (ref: 2, language: 1)
behavior (node: 2)
  • Runs inci
  • Seen inprisma/prisma, QwenLM/qwen-code, openai/codex-security, bridgecrewio/checkov, Azure/Azure-Sentinel
  • Docshttps://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

• Contract-Driven Workflow TestingWorkflow logic changes can silently ship if tests don’t observe the exact contract your users/ops depend on. Adopt this checklist when wr...

  QwenLM/qwen-code Testing Yaml ai-agents 2026-07-29

  copy raw open
• Disable coverage in workflowsKeep code coverage tools disabled in CI/CD workflows unless they're specifically needed for generating coverage reports. Enabling coverag...

  laravel/framework Testing Yaml app-frameworks 2024-11-25

  copy raw open
• Ensure comprehensive test coverageTests should validate all expected behaviors, variants, and edge cases rather than covering only the happy path. When implementing tests,...

  semgrep/semgrep Testing Yaml security 2024-04-29

  copy raw open
• Deterministic External TestingWhen external services are flaky or untestable, make CI deterministic by (1) pruning recorded interactions to the stable outcomes your pl...

  Azure/azure-cli Testing Yaml cloud-infra 2026-05-26

  copy raw open
• CI testing tool integrationWhen integrating new testing or analysis tools into CI pipelines, use graceful failure patterns during initial adoption phases to prevent...

  langgenius/dify Testing Yaml llm-infra 2025-09-10

  copy raw open

5 more in Testing — the playbook lists the top 10.

• Docs build Broken cross-references, links and markup in documentation.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Spelling Typos in identifiers, comments and docs.
  codespell 8% · 1 of 12 repos

  runs via pre-commit hook codespell

  exit codes, docs, alternatives, where it runs

  • Runs inpre-commit, ci
  • Seen inTheAlgorithms/Python
  • Docshttps://github.com/codespell-project/codespell

• Documentation clarity and formattingEnsure documentation is clear, precise, and consistently formatted. Key practices include: 1. **Be explicit and unambiguous** - Define te...

  ghostty-org/ghostty Documentation Yaml devtools 2025-05-06

  copy raw open
• Consistent text formattingEnsure text formatting follows established guidelines and maintains consistency within the same context. This applies to documentation st...

  discourse/discourse Documentation Yaml app-frameworks 2025-08-08

  copy raw open
• Document non-obvious codeAdd clarifying comments to code elements whose purpose or behavior may not be immediately apparent to other developers. This includes con...

  Azure/azure-sdk-for-net Documentation Yaml cloud-infra 2025-06-13

  copy raw open
• Framework-aware text compositionWhen writing user-facing text (error messages, notifications, labels), understand how your framework automatically processes and modifies...

  mastodon/mastodon Documentation Yaml app-frameworks 2025-05-05

  copy raw open
• Explain documentation rationaleWhen writing user-facing documentation, always explain WHY a guideline or requirement exists, not just WHAT users should do. Users are mo...

  hyprwm/Hyprland Documentation Yaml devtools 2025-01-02

  copy raw open

2 more in Documentation — the playbook lists the top 7.