gh-release-pipeline
Pass
Audited by Gen Agent Trust Hub on Apr 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill facilitates the setup of automated CI/CD pipelines using well-known, established GitHub Actions (e.g.,
actions/checkout,actions/setup-node,cycjimmy/semantic-release-action) and industry-standard release tools. - [SAFE]: Strong emphasis is placed on security guardrails, such as using fine-grained Personal Access Tokens (PATs) for cross-repository operations (e.g., Homebrew tap updates) and configuring non-cancellable concurrency groups to prevent pipeline corruption.
- [SAFE]: The documentation correctly guides users to manage sensitive credentials via GitHub Secrets and to explicitly define workflow
permissions(e.g.,contents: write) to minimize the attack surface of the defaultGITHUB_TOKEN. - [SAFE]: The skill includes robust troubleshooting guidance to prevent common CI/CD misconfigurations, such as infinite loops caused by bot-authored commits.
Audit Metadata