Read the existing pipeline files, the repository's build and test commands, and the branch protection or required checks if they are visible. Name the provider and, for GitHub Enterprise Server, its version.
Write down, for the change:
- which events and refs run it, and which commit each one tests (events);
- which jobs need which permissions and secrets;
- which result gates the merge.
Edit, using the cards for:
- workflow-level permissions: contents: read;
- event data through env:;
- actions pinned by SHA, with a version comment;
- persist-credentials: false;
- shell: bash for any pipe;
- an aggregator for required checks;
- timeout-minutes on every job;
- OIDC only in the deploy job.
Run the linters: actionlint, python3 scripts/check_action_pins.py .github, uvx zizmor@1.30.1 --offline .github/workflows. For GitLab and Bitbucket, run uvx check-jsonschema@0.38.2 --builtin-schema vendor.gitlab-ci|vendor.bitbucket-pipelines FILE.
Run changed scripts locally with the runner's shell flags (local reproduction).
Report the lint output, the local runs, and what only a hosted run can show: secrets, approvals, required checks, and runner availability.

Route the task to a card

Task or symptom	Card
Required check stuck pending	Events, selection before execution
Fork PRs need labels or comments	pull_request_target
Token can push or publish from tests	Permissions
PR title or branch name in `run:`	Injection
`uses: x@v1`	Pinning
Step green although tests failed	Shell and pipefail
Many matrix jobs as required checks	Aggregator
Superseded runs or overlapping deploys	Concurrency, GitLab interruptible
Build output missing in the next job	Artifacts, GitLab needs, Bitbucket steps
Cloud deploy credentials	GitHub OIDC, GitLab id_tokens, Bitbucket OIDC
Duplicate GitLab pipelines	Workflow rules
Manual job does not block	allow_failure
Branch not running in Bitbucket	Start conditions
Deploy rebuilds the code	Build once
Attestations or SBOM requested	Provenance
Slow dependency installs	Cache keys

Rules

Never run PR code in a job that has secrets or write tokens: pull_request_target, workflow_run, or a protected-variable job.
Pass attacker-controlled values through env: and quoted variables, never through ${{ }} inside run:.
Pin third-party actions to a commit SHA with a # vX.Y.Z comment, and check the comment with check_action_pins.py --resolve.
Make workflow permissions read-only. Grant write or id-token scopes only to the job that needs them.
Do not use continue-on-error, allow_failure: true, || true, or a pipe without pipefail on a required check.
A required-check aggregator fails on failure, cancelled, and unexpected skipped.
Deploy the tested artifact, identified by its digest. Never rebuild for production.

scripts/check_action_pins.py PATH... [--resolve] reports uses: references that are not SHA-pinned. --resolve checks version comments against gh api. test_check_action_pins.py holds its tests.
assets/examples/github/good/ is the reference workflow, with ci/all-green.sh, ci/test.sh, and ci/deploy.sh. github/bad/ has one of each defect.
assets/examples/gitlab/.gitlab-ci.yml and bitbucket/bitbucket-pipelines.yml, plus a deliberately broken variant of each.
sh assets/examples/verify.sh [network] checks the reference workflows. Offline, it runs actionlint 1.7.12, the pin checker, the aggregator truth table, and the runner's shell flags. network adds zizmor 1.30.1, check-jsonschema 0.38.2, and SHA resolution with gh.

The changed files, with lint output: actionlint, the pin checker, zizmor, or check-jsonschema.
The event-to-commit and job-to-permission table for the change.
Local runs of changed scripts with the runner's shell flags, and the aggregator truth table if it changed.
A list of what needs a hosted run, each marked not run: required checks, secrets, approvals, and OIDC trust. Linters and local runs do not verify hosted behavior.

The change needs secrets or write permissions in a job that runs PR code.
Branch protection or required-check names must change, and you cannot see the settings.
The provider is GitHub Enterprise Server, where the v4+ artifact actions are not supported, and the server version is unknown.