github-actions-dependabot-review

What problem does it solve? Dependabot PRs that bump GitHub Actions versions can silently introduce malicious or risky upstream changes, and manually auditing each action's upstream diff is tedious and easy to skip. ## Core Features & Use Cases - Duplicate Review Detection: Checks whether a human already reviewed the PR before doing redundant work. - Upstream Diff Audit: Compares old and new revisions of the action repository using Dependabot-provided hashes, checking for secret exfiltration, shell injection, new network calls, and suspicious minified artifacts. - Dependency and Lockfile Review: Inspects changed manifests like package-lock.json or Cargo.lock, verifying registry metadata and release age when diffs are too large. - Use Case: A maintainer receives a Dependabot PR titled "bump actions/checkout from v4 to v5" and asks the agent to review it; the agent audits the upstream diff, compares it against the changelog, and posts an OK/not-OK-to-merge comment. ## Quick Start Review the open Dependabot PRs that update GitHub Actions workflows and post a security assessment comment on each one.