What problem does it solve?
Code that runs git or gh commands against repository checkouts in gh-aw can silently fail or leak credentials when the wrong token is used, when credentials are missing in credential-free contexts, or when sparse and shallow checkouts are deepened at runtime. This Skill gives reviewers a concrete checklist to catch those issues before they ship.
Core Features & Use Cases
- Credential wiring review: Verifies that per-checkout github-token values from the checkout: block are actually threaded into downstream steps rather than assuming the default GITHUB_TOKEN applies.
- Credential-free context checks: Confirms that remote git operations in the agent job and safe-outputs MCP server fail soft with clear no-credentials errors instead of raw git stderr.
- Sparse and shallow safety: Flags steps that deepen or widen sparse, shallow, or blobless monorepo checkouts at runtime instead of expanding fetch options at compile time.
- Use Case: While reviewing a pull request that adds a git fetch step to a compiled .lock.yml workflow, use this Skill to determine whether the step has credentials, which checkout entry it targets, and whether it should instead be handled by actions/checkout configuration.
Quick Start
Review the git and gh commands in this pull request against the checkout credential checklist and report any missing tokens or unsafe fetch operations.
