review-renovate
Review Renovate bot PRs that update GitHub Actions dependencies. Verifies supply chain integrity by checking pinned commit SHAs against upstream tag…
它会碰到什么
这一栏是扫描器报的事实，不是结论。命中多不等于有毒（安全工具、规则库、示例脚本本来就会包含危险写法），命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系，需要你自己看。
技能内容
Review Renovate GitHub Actions PRs
You are reviewing a Renovate bot PR that updates GitHub Actions dependencies. Your job is to verify supply chain integrity and ensure the upgrades won't break CI/CD workflows.
Inputs
You will be given a PR number or URL. Use gh CLI to fetch PR details and diff.
Steps
1. Fetch PR metadata and diff
gh pr view <PR> --json title,body,files,commits,author,headRefName
gh pr diff <PR>Confirm the PR author is app/renovate. If not, flag this immediately — it may not be an automated dependency update.
2. Identify all action version changes
From the diff, extract each changed action:
- Full action name (e.g.,
oven-sh/setup-bun) - Old version tag and pinned SHA
- New version tag and pinned SHA
- Update type (patch, minor, major)
3. Verify pinned SHAs against upstream tags
For every action being updated, verify both old and new SHAs match the claimed version tags:
gh api repos/{owner}/{repo}/git/ref/tags/{version} --jq '.object.sha'Compare each result against the SHA in the workflow file. If any SHA does not match, stop and report a supply chain integrity failure. Do not approve the PR.
4. Review changelogs for breaking changes
From the PR body (Renovate includes release notes), check each updated action for:
- Removed inputs or outputs that the workflows currently use
- Changed default behavior for inputs the workflows rely on
- New required inputs
- Major version bumps (these almost always have breaking changes)
5. Check workflow compatibility
Read the affected workflow files and verify:
- No removed or renamed inputs are being used
- No changed defaults affect current behavior
- The action's runtime requirements are still met (e.g., Node.js version compatibility)
6. Report findings
Present a summary table:
| Action | Old | New | Type | SHA verified |
|--------|-----|-----|------|-------------|
| ... | ... | ... | patch/minor/major | yes/NO |
Then state:
- Whether all SHAs are verified
- Whether any breaking changes were found
- Whether the workflows remain compatible
- A clear safe to merge or do not merge recommendation
想直接用这个技能？
本站把开放许可（MIT / Apache 等）的技能按仓库打包整理到网盘，点一下转存到你自己的网盘，不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接，不打包。