GitHub Actions

Treat a workflow as production code with credentials. Anchor security on the trust boundary, performance on the critical path, and correctness on the execution graph. Preserve behavior deliberately and prove the changed path.

Process

Select every requested mode first:

• Audit: inspect and report without edits when selected alone.
• Modify: diagnose and change an existing workflow or Dependabot configuration.
• Create: add a new workflow, reusable workflow, or Dependabot configuration.

Modes can combine. For an audit-and-fix request, audit first, modify the authorized findings, and report both corrected and outstanding findings.

After mode selection, use Dependabot and dependency automation as the specialized process for a Dependabot-only task. Apply the workflow execution-graph process below only to repository workflows triggered by Dependabot or generated for dependency submission.

1. Map the affected pipeline

For an existing workflow, traverse every reachable local action and reusable workflow. Deduplicate source reads by immutable identity, but analyze every call edge with its caller's ref, inputs, secrets, permission ceiling, conditions, environment, and runner. When a reusable contract can change, find every affected caller. For creation, map repository conventions and candidate components implied by the requested behavior.