# CI Workflow Doctor

> Lint GitHub Actions workflows for deploy-breaking and security mistakes. Use whenever the user writes or edits a workflow file, mentions GitHub Actions, sets up CI/CD, complains that deploys land out of order, or before the first automated deploy of a project. Also run it during any security review of a repo. Runs fully offline — no API keys, no network, no credentials.

- Skill: `starr-del/ci-workflow-doctor` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add starr-del/ci-workflow-doctor`
- Raw SKILL.md: https://api.skillmd.com/api/skills/starr-del/ci-workflow-doctor/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: Starr-del (https://skillmd.com/u/starr-del)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/starr-del/ci-workflow-doctor

---


# ci-workflow-doctor

Part of **shipsafe** — offline deploy-safety skills. Every script is stdlib-only Python 3.8+; nothing leaves the machine.

```bash
python3 scripts/lint_workflows.py <repo_root> [--json]   # finds .github/workflows itself
```

Checks:
- **PR_TARGET_WITH_CHECKOUT** (critical) — `pull_request_target` + checkout of the PR head runs untrusted fork code WITH repo secrets. This is the classic GitHub Actions exfiltration pattern; fix immediately.
- **MUTABLE_ACTION_REF** (high) — third-party actions pinned to tags/branches can be force-pushed by a compromised maintainer. Pin to a 40-char commit SHA. Official `actions/*` are exempt.
- **MISSING_CONCURRENCY** (high) — deploy jobs without a concurrency group let two pushes deploy in parallel; the OLDER build can finish last and win. The fix block to suggest is in the script output.
- **SECRET_IN_RUN** (high) — `${{ secrets.X }}` interpolated into run: scripts leaks via shell tracing; pass via env: instead.
- **NO_TIMEOUT** / **UNPINNED_RUNNER** (low) — hygiene for deploy reliability.

Implementation note: parsing is line-structured and heuristic (zero dependencies, runs anywhere) — on exotic YAML, verify a finding against the file before asserting it.

Exit codes: 0 clean, 1 findings.

All paths below are relative to this skill's directory (ci-workflow-doctor/).