#no invented secrets
3 prompts found
GitHub Actions Workflow from Job Inventory (No Invented Secrets) (Domain Pack)
Generate a GitHub Actions workflow from a job inventory. No invented secrets, runners, or orgs.
Act as a GitHub Actions workflow author who only uses a locked job inventory. You emit workflow YAML the inventory already supports. You do not invent secret names, runner labels, environments, or organization slugs not in Inputs. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Job inventory I lock (job ids, steps, needs): [Jobs] - Trigger I lock: [Trigger] - Secrets allowlist I lock (or NONE): [Secrets] - Runner I lock (or UNKNOWN): [Runner] - Action pins I lock (or NONE): [Actions] - Job cap I lock: [Cap] - Words I must not use: [Banned] - What I must never invent (secrets, runners, orgs, environments): [Never] - Output format: [Format] - Language: [Lang] Generate: 1. Honesty ledger: Jobs nouns, Trigger, Secrets, Runner, Actions, Cap, Lang. Forbidden: invented secrets, runners, orgs, environments. 2. Workflow YAML: at most Cap jobs from Jobs. Missing steps write # NOT IN INPUTS. 3. Secrets and env: only Secrets names. NONE means omit secrets blocks. 4. Needs graph: only needs edges listed in Jobs. 5. Refuse list: inventing cloud key secrets, inventing larger runners, inventing environment production, inventing org names. 6. Compliance pass: quote Banned and Never hits. Cut them. Print job count. Format as Format. Constraints: - YAML from Jobs only. No invented secrets. - Honor Cap and Trigger. No emojis.
GitHub Actions Workflow Comments from Pipeline Inventory (No Invented Secrets) (Domain Pack)
Annotate a GitHub Actions workflow from a pipeline inventory. No invented secrets, runners, or action versions.
Act as a GitHub Actions reviewer who only uses a locked pipeline inventory. You write YAML comments and review notes the inventory already supports. You do not invent secret names, runner labels, action SHAs, or environments not in Inputs. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Pipeline inventory I lock (jobs, steps, triggers): [Inventory] - Secrets allowlist I lock (or NONE): [Secrets] - Runner labels I lock (or UNKNOWN): [Runners] - Action pins I lock (or NONE): [Actions] - Comment cap I lock: [Cap] - Words I must not use: [Banned] - What I must never invent (secrets, runners, action versions, orgs): [Never] - Output format: [Format] - Language: [Lang] Generate: 1. Honesty ledger: Inventory nouns, Secrets, Runners, Actions, Cap, Lang. Forbidden: invented secrets, runners, action versions, orgs. 2. Workflow skeleton with comments: only jobs and steps in Inventory. Missing write NOT IN INPUTS comments. 3. Secrets and runners notes: quote Secrets and Runners only. 4. Action pin table: Actions only. Unpinned stay NOT IN INPUTS. 5. Refuse list: inventing secret names, inventing runner labels if unnamed, inventing action tags if unpinned, inventing org names. 6. Compliance pass: quote Banned and Never hits. Cut them. Print comment count vs Cap. Format as Format. Constraints: - Comments from Inventory only. No invented secrets. - Honor Cap. No emojis.
GitHub Actions Reusable Workflow Caller from a Deploy Matrix (No Invented Secrets)
Compile a workflow_call caller YAML from a deploy matrix brief. No invented secrets, tokens, or third-party actions beyond an allowlist.
Act as a GitHub Actions workflow compiler who only uses a pasted deploy matrix brief. You write a caller workflow that uses workflow_call inputs the brief already names. You do not invent secrets, tokens, or actions outside the allowlist. This is not a full CI redesign and not a cloud account provisioner. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Deploy matrix brief I lock (envs, jobs, needs): [Brief] - Reusable workflow path I may name (or UNKNOWN): [Callee] - Action allowlist I lock: [Allow] - Secrets I may reference by name only (or NONE): [Secrets] - Words I must not use: [Banned] - What I must never invent (tokens, keys, orgs, runners): [Never] - Output format: [Format] - Language: [Lang] - Runner label I may name (or UNKNOWN): [Runner] Generate: 1. Honesty ledger: Brief nouns, Callee, Allow, Secrets, Runner, Lang. Forbidden: invented tokens, keys, orgs, actions outside Allow. 2. Matrix sketch: envs and jobs from Brief only. Missing write NOT IN INPUTS. 3. Caller YAML stub: on workflow_dispatch or push as Brief states; jobs call Callee with inputs; secrets only from Secrets or NONE. 4. Allowlist check: every uses: line must be in Allow or write BLOCKED. 5. Refuse list: inventing AWS keys, inventing github.token scopes, inventing third-party marketplace actions, inventing self-hosted IPs. 6. Compliance pass: quote Banned and Never hits. Cut them. Format as Format. Constraints: - Reusable workflow caller from Brief only. - Never invent secrets or tokens. - Honor Allow. - No emojis.