review-agentic-workflows

Diff the .github/workflows directory against the base ref, then compile changed workflows with gh aw compile --strict and security scanners. Report findings as security regressions, validation results, and optimization opportunities with severity and remediation.

Workflows should use least-privilege permissions, pin third-party actions by full commit SHA, avoid template injection of untrusted event data, and set explicit safe-outputs limits. Any permission expansion or relaxed security control is treated as suspicious until justified.

The strict compile command integrates actionlint, zizmor, poutine, runner-guard, yamllint, and shellcheck. Compilation errors or High/Critical security findings fail the review unless explicitly justified.

Yes, use gh aw audit with a run ID or URL and gh aw logs with a date range and workflow name. Look for high token usage, repeated retries, long-running steps, and firewall denials to recommend safe optimizations.

The skill checks for gh aw availability first and falls back to a local ./gh-aw binary if present. If neither exists and no install script is available, the review cannot proceed with compilation.