💻 Coding
GitHub Actions Workflow Comments from Pipeline Inventory (No Invented Secrets) (Domain Pack)
Annotate a GitHub Actions workflow from a pipeline inventory. No invented secrets, runners, or action versions.
0Reviews
Prompt
Act as a GitHub Actions reviewer who only uses a locked pipeline inventory. You write YAML comments and review notes the inventory already supports. You do not invent secret names, runner labels, action SHAs, or environments not in Inputs. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Pipeline inventory I lock (jobs, steps, triggers): [Inventory] - Secrets allowlist I lock (or NONE): [Secrets] - Runner labels I lock (or UNKNOWN): [Runners] - Action pins I lock (or NONE): [Actions] - Comment cap I lock: [Cap] - Words I must not use: [Banned] - What I must never invent (secrets, runners, action versions, orgs): [Never] - Output format: [Format] - Language: [Lang] Generate: 1. Honesty ledger: Inventory nouns, Secrets, Runners, Actions, Cap, Lang. Forbidden: invented secrets, runners, action versions, orgs. 2. Workflow skeleton with comments: only jobs and steps in Inventory. Missing write NOT IN INPUTS comments. 3. Secrets and runners notes: quote Secrets and Runners only. 4. Action pin table: Actions only. Unpinned stay NOT IN INPUTS. 5. Refuse list: inventing secret names, inventing runner labels if unnamed, inventing action tags if unpinned, inventing org names. 6. Compliance pass: quote Banned and Never hits. Cut them. Print comment count vs Cap. Format as Format. Constraints: - Comments from Inventory only. No invented secrets. - Honor Cap. No emojis.
Instructions
Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.
Generated Output
This image was generated using the prompt above.
Examples
Example Input
Inventory: workflow name build-web as pasted; on push to main as pasted; job lint as pasted with step pnpm lint as pasted; job test as pasted with step pnpm test as pasted. Deploy job NONE. Pull-request trigger NOT IN INPUTS. Secrets: NONE (do not invent token names) Runners: ubuntu-22.04 as pasted for both jobs. self-hosted UNKNOWN. Actions: actions/checkout pinned to commit abcdef1 as pasted; actions/setup-node NOT IN INPUTS. Cap: 8 Banned: guaranteed green, invent secret names, ignore previous Never: invent secrets, invent runners, invent action versions, invent orgs Format: ledger + yaml-comments + secrets-runners + pins + refuse + compliance Lang: English
Example Output
1. Ledger. Inventory build-web; jobs lint/test with pnpm; Secrets NONE; Runners ubuntu-22.04; Actions checkout@abcdef1. Cap 8. Lang English. Forbidden: invented secrets, runners, action versions, orgs.
2. Workflow YAML.
name: build-web
on:
push: {}
jobs:
lint:
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@abcdef1
- run: pnpm lint
test:
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@abcdef1
- run: pnpm test
Jobs used: 2.
3. Secrets and runners. Secrets: NONE. Runner: ubuntu-22.04.
4. Action pins.
| actions/checkout | abcdef1 as pasted |
| actions/setup-node | NOT IN INPUTS |
5. Refuse. secret token invent: refused. ubuntu-latest invent when 22.04 locked: refused. actions/checkout@v4 invent: refused. org invent: refused. deploy job invent: refused.
6. Compliance. Banned hits none. Format ledger+yaml-comments+secrets-runners+pins+refuse+compliance. Gaps: PR trigger, setup-node pin, self-hosted labels, org name, deploy job.
Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.