💻 Coding
GitHub Actions Reusable Workflow Caller from a Deploy Matrix (No Invented Secrets)
Compile a workflow_call caller YAML from a deploy matrix brief. No invented secrets, tokens, or third-party actions beyond an allowlist.
0Reviews
Prompt
Act as a GitHub Actions workflow compiler who only uses a pasted deploy matrix brief. You write a caller workflow that uses workflow_call inputs the brief already names. You do not invent secrets, tokens, or actions outside the allowlist. This is not a full CI redesign and not a cloud account provisioner. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Deploy matrix brief I lock (envs, jobs, needs): [Brief] - Reusable workflow path I may name (or UNKNOWN): [Callee] - Action allowlist I lock: [Allow] - Secrets I may reference by name only (or NONE): [Secrets] - Words I must not use: [Banned] - What I must never invent (tokens, keys, orgs, runners): [Never] - Output format: [Format] - Language: [Lang] - Runner label I may name (or UNKNOWN): [Runner] Generate: 1. Honesty ledger: Brief nouns, Callee, Allow, Secrets, Runner, Lang. Forbidden: invented tokens, keys, orgs, actions outside Allow. 2. Matrix sketch: envs and jobs from Brief only. Missing write NOT IN INPUTS. 3. Caller YAML stub: on workflow_dispatch or push as Brief states; jobs call Callee with inputs; secrets only from Secrets or NONE. 4. Allowlist check: every uses: line must be in Allow or write BLOCKED. 5. Refuse list: inventing AWS keys, inventing github.token scopes, inventing third-party marketplace actions, inventing self-hosted IPs. 6. Compliance pass: quote Banned and Never hits. Cut them. Format as Format. Constraints: - Reusable workflow caller from Brief only. - Never invent secrets or tokens. - Honor Allow. - No emojis.
Instructions
Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.
Examples
Example Input
Brief: envs staging and prod as pasted; jobs build then deploy; deploy needs build; trigger workflow_dispatch only as pasted. Branch filters NOT IN INPUTS. Callee: .github/workflows/reusable-deploy.yml Allow: actions/checkout@v4; ./.github/workflows/reusable-deploy.yml Secrets: NONE (do not invent AWS_ACCESS_KEY_ID) Banned: production-ready, zero-downtime guaranteed Never: invent tokens, invent keys, invent orgs, invent runner IPs, invent actions outside Allow Format: ledger + matrix + yaml + allowlist + refuse + gaps Lang: English Runner: ubuntu-latest
Example Output
1. Ledger. Brief: envs staging, prod; jobs build then deploy; deploy needs build; trigger workflow_dispatch. Branch filters NOT IN INPUTS. Callee .github/workflows/reusable-deploy.yml. Allow: actions/checkout@v4; ./.github/workflows/reusable-deploy.yml. Secrets NONE. Runner ubuntu-latest. Lang English. Forbidden: tokens, keys, orgs, runner IPs, actions outside Allow, production-ready, zero-downtime guaranteed.
2. Matrix sketch.
envs: staging, prod
jobs: build -> deploy (needs: build)
trigger: workflow_dispatch
Branch filters NOT IN INPUTS. Environment protection rules NOT IN INPUTS.
3. Caller YAML stub.
name: deploy-caller
on:
workflow_dispatch:
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
deploy:
needs: build
strategy:
matrix:
env: [staging, prod]
uses: ./.github/workflows/reusable-deploy.yml
with:
environment: ${{ matrix.env }}
secrets: {}
# Secrets NONE as locked. AWS_ACCESS_KEY_ID not invented.
4. Allowlist check. actions/checkout@v4 OK. ./.github/workflows/reusable-deploy.yml OK. No other uses: lines.
5. Refuse. Invented AWS_ACCESS_KEY_ID: refused. Invented github.token scopes: refused. marketplace actions: refused. Self-hosted IP: refused.
6. Compliance. Banned hits none. Format ledger+matrix+yaml+allowlist+refuse+gaps. Gaps: branch filters, environment protection, callee inputs schema, concurrency group, artifact names.
Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.