GitHub Actions Reusable Workflow Map from Repo Inventory (No Invented Secrets)

Prompt

Act as a GitHub Actions reusable-workflow cartographer who only uses a pasted repo inventory. You write a reusable workflow call map the inventory already supports. You do not invent secrets names, OIDC claim values, runner labels, or workflow_call inputs not in Inputs. This is not a CI security audit and not a billing estimate for Actions minutes.
You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs.

Inputs:
- Repo workflow inventory I lock (workflow stubs, workflow_call cues, job notes): [Inventory]
- Actions / runner version notes I lock: [Version]
- Repo or org label I may quote (or UNKNOWN): [Workspace]
- Required workflow names I may quote (or UNKNOWN): [SpecNames]
- Workflow file paths already present (or UNKNOWN): [WorkflowPaths]
- workflow_call input cues already present (or UNKNOWN): [CallInputs]
- Secret and environment notes already present (or UNKNOWN): [SecretNotes]
- Words I must not use: [Banned]
- What I must never invent (secrets, OIDC claims, runner labels, fake inputs): [Never]
- Output format: [Format]
- Language: [Lang]

Generate:
1. Honesty ledger: Inventory nouns, Version, Workspace, SpecNames, WorkflowPaths, CallInputs, SecretNotes, Lang. Forbidden: invented secrets, OIDC claims, runner labels, fake workflow_call inputs. Banner: not a CI security audit; not an Actions-minutes billing estimate.
2. Reusable workflow call map table: one row per Inventory workflow stub or workflow_call cue. Missing SecretNotes write NOT IN INPUTS. Use GitHub Actions workflow_call, jobs, needs, and secrets language when Inventory supports it. Never print secret VALUES or OIDC claim VALUES not in Inventory.
3. Spec name set: only names in SpecNames. Unnamed workflows stay NOT IN INPUTS. Never invent runner-label VALUES not in Inventory.
4. Version lock: print Version. Refuse Actions features newer than Version if Version is named.
5. Refuse list: inventing secrets names, inventing OIDC claim values, inventing runner labels, inventing workflow_call inputs not in CallInputs.
6. Compliance pass: quote Banned and Never hits. Cut them. Format as Format.

Constraints:
- Map from Inventory only. No invented secret VALUES. Teach GitHub Actions reusable workflow mapping, not a generic Jenkins or CircleCI swap.
- Honor Version. No emojis.

Instructions

Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.

Generated Output

This image was generated using the prompt above.

GitHub Actions Reusable Workflow Map from Repo Inventory (No Invented Secrets) - Result

Examples

Example Input

Inventory: workflow Harbor Quay Build as pasted workflow_call cue uses .github/workflows/reuse-build.yml as pasted job notes needs Lint as pasted; workflow River Ops Deploy as pasted. Secret invent NONE. OIDC invent NONE. Runner invent NONE.
Version: GitHub Actions ubuntu-22.04 as pasted (do not invent unreleased AI workflow writer)
Workspace: Harbor Quay Ops monorepo as pasted
SpecNames: reuse-build.yml as pasted; Deploy as pasted. GITHUB_TOKEN policy UNKNOWN.
WorkflowPaths: .github/workflows/reuse-build.yml as pasted; .github/workflows/deploy.yml as pasted. release.yml UNKNOWN.
CallInputs: node-version as pasted; environment as pasted. matrix OS UNKNOWN.
SecretNotes: environment production as pasted. AWS role ARN NOT IN INPUTS.
Banned: guaranteed green, secret invent, OIDC invent, runner invent
Never: invent secrets, invent OIDC claims, invent runner labels, invent workflow_call inputs
Format: ledger + table + specs + version + refuse + compliance
Lang: English

Example Output

1. Ledger. Inventory: workflow Harbor Quay Build workflow_call cue uses .github/workflows/reuse-build.yml job notes needs Lint; workflow River Ops Deploy. Secret invent NONE. OIDC invent NONE. Runner invent NONE. Version GitHub Actions ubuntu-22.04. Workspace Harbor Quay Ops monorepo. SpecNames reuse-build.yml; Deploy; GITHUB_TOKEN policy UNKNOWN. WorkflowPaths .github/workflows/reuse-build.yml; .github/workflows/deploy.yml; release.yml UNKNOWN. CallInputs node-version; environment; matrix OS UNKNOWN. SecretNotes environment production; AWS role ARN NOT IN INPUTS. Lang English. Banner: not a CI security audit; not an Actions-minutes billing estimate. Forbidden: invented secrets, OIDC claims, runner labels, fake workflow_call inputs, guaranteed green, secret invent, OIDC invent, runner invent.

2. Reusable workflow call map.
1. Harbor Quay Build | WorkflowPaths .github/workflows/reuse-build.yml as pasted | CallInputs node-version as pasted | SecretNotes environment production as pasted | secrets NONE | OIDC NONE | GitHub Actions reusable workflow map only.
2. River Ops Deploy | WorkflowPaths .github/workflows/deploy.yml as pasted | CallInputs environment as pasted | SecretNotes beyond production NOT IN INPUTS | secrets NONE | OIDC NONE.
GITHUB_TOKEN policy UNKNOWN so write GITHUB_TOKEN policy NOT IN INPUTS. release.yml not invented beyond WorkflowPaths.

3. Spec name set. reuse-build.yml; Deploy as SpecNames. GITHUB_TOKEN policy UNKNOWN so write GITHUB_TOKEN policy NOT IN INPUTS. No secret VALUES beyond Inventory. No third workflow invented.

4. Version lock. GitHub Actions ubuntu-22.04 as pasted. Unreleased AI workflow writer not used. Runner packs NOT IN INPUTS.

5. Refuse. Secret invent: refused. OIDC invent: refused. Runner invent: refused. CallInput invent: refused. Guaranteed green: refused.

6. Compliance. Banned hits none. Format ledger+table+specs+version+refuse+compliance. Gaps: GITHUB_TOKEN policy, release.yml WorkflowPaths, matrix OS CallInputs, AWS role ARN SecretNotes, runner packs list if any.

Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.