github-action-review

Reviews GitHub Action shell scripts, jq filters, and workflow annotations for fallow.

4.4k|154|Updated Mar 17, 2026
One-click install
npx skills add https://github.com/fallow-rs/fallow --skill github-action-review
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: github-action-review
Source: https://github.com/fallow-rs/fallow/tree/main/.agents/skills/github-action-review
Command: npx skills add https://github.com/fallow-rs/fallow --skill github-action-review

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Changes to GitHub Actions, shell scripts, and jq filters are easy to break in subtle ways—unsafe token handling, jq failures on empty data, or non-idempotent PR comments. This Skill provides a structured review checklist so these CI-facing changes are audited consistently before merge.

Core Features & Use Cases

  • Shell and jq Safety Review: Inspects changed shell scripts and jq filters for robustness against empty or malformed data.
  • Action Definition Audit: Reviews action.yml, annotation formatting, and PR review comment behavior for correctness and idempotency.
  • Clear Verdict Output: Ends every review with an explicit APPROVE, CONCERN, or BLOCK decision.
  • Use Case: A contributor modifies the fallow GitHub Action's jq filter that formats annotations. Invoke this Skill to verify the filter handles empty result sets, tokens are handled safely, and repeated runs do not duplicate PR comments.

Quick Start

Review the changes to action.yml and the shell scripts in the action directory using the github-action-review skill and give me a verdict.

Frequently Asked Questions about github-action-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review GitHub Action shell scripts for safety?

Review the changed shell scripts for unsafe expansions, unquoted variables, and improper token handling. This Skill walks through the action definition, scripts, and jq filters, then issues an APPROVE, CONCERN, or BLOCK verdict.

How to test jq filters against empty or malformed data?

Run the jq filters against empty arrays, missing fields, and malformed JSON to confirm they fail gracefully rather than producing broken annotations. The review checklist in this Skill explicitly prioritizes jq robustness on empty and malformed inputs.

What should a GitHub Action code review check?

A GitHub Action review should check shell safety, secret and token handling, jq filter robustness, annotation and comment correctness, and idempotent PR behavior so repeated runs do not duplicate comments.

Why does a GitHub Action post duplicate PR review comments?

Duplicate comments happen when the action is not idempotent—it creates a new comment on every run instead of updating an existing one. The review verifies idempotent PR behavior so re-runs update rather than duplicate annotations.

When should I use this review Skill?

Use it whenever changes touch the action/ directory, action.yml, GitHub review formatting, or CI shell and jq behavior in the fallow repository. It is scoped to reviewing those CI-facing changes, not general application code.