ci-maintenance

Audit the trust boundary before editing. This skill owns Actions event semantics, workflow security, permissions, action pinning, setup reuse, untrusted inputs, timeouts, concurrency, and artifact trust boundaries.

Workflow

1. Decide whether this is a review or an implementation. Reviews produce evidence-backed findings without editing; implementations continue through the smallest boundary-preserving change.
2. Inspect every affected workflow, composite action, and caller. List all affected jobs and actions before proceeding.
3. For each job, record the trigger, actor/fork status, workflow revision, checked-out revision, permissions, credentials, and every external input and consumer. Include artifacts, caches, outputs, PR fields, refs, dispatch inputs, generated files, and called actions.
4. Consult current GitHub documentation for every platform-sensitive decision. Repository examples establish local convention, not platform semantics.
5. Apply every applicable rule:
   • Default workflow permissions to empty and grant minimal job permissions.
   • Reuse the repository's shared setup action unless the environment must differ.
   • Give executable jobs intentional matrices and realistic timeouts.
   • Pin external actions and reusable workflows to full commit SHAs with readable release comments; verify each SHA belongs to that upstream release.
   • Analyze event choice, checkout revision, and credential persistence together.
   • Pass untrusted expressions through environment variables; validate and quote them before use.
   • Derive concurrency from interruption safety.
6. For forks, privileged credentials, publication, or cross-run data, read privileged-workflows.md.
7. Run the narrowest syntax and repository checks, inspect the complete diff, and identify behavior testable only on GitHub-hosted runners.

For local patterns, inspect the current shared setup action and the nearest workflow with the same trust boundary. Use ordinary check workflows for routine precedent and privileged publication workflows only for equivalent trust boundaries.

The task is complete when every affected job and caller has a recorded trust boundary, every applicable rule has evidence or a compensating control, local checks pass, and GitHub-only verification is identified. Reviews report every failure with evidence; implementations resolve every failure and contain only intended behavior.