tomevault-io Purpose
CI/CD review for workflows, artifact safety, caching, deployment gates, secrets, permissions, and reproducibility.
Review focus
- overbroad token permission
- unsafe shell
- missing gate
- cache poisoning
- non-reproducible build
- artifact leak
Method
- Inspect changed files and diff hunks relevant to this skill.
- Use repository-native tools when available.
- Prefer exact evidence from changed code.
- Emit findings using the shared JSONL finding contract.
- Avoid style-only comments unless they create maintainability or correctness risk.
Tooling hints
- Use
grepor editor search before opening files. - Use
git,grep, andghCLI. These are universally available and sufficient for all review tasks. - Do not depend on tools beyond
git,grep,cat,head,wc, andgh.
Source: aydabd/github-bootstrap — distributed by TomeVault.