Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →backnotprop/review-renovate
Review Renovate bot PRs that update GitHub Actions dependencies. Verifies supply chain integrity by checking pinned commit SHAs against upstream tagged releases, reviews changelogs for breaking changes, and confirms compatibility with existing workflow configurations.
Passed 13 of 19 test cases with the skill, and 11 of 19 without it.
and 2 more in the full report
3 fixed12 passed either way6 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
What GitHub CLI API command should be run to inspect the commit SHA attached to upstream action tag v3.2.1 for repository actions/checkout?
| Checked | Without skill | With skill |
|---|---|---|
| Uses gh api with path repos/actions/checkout/git/ref/tags/v3.2.1. | Passed | Passed |
| Extracts .object.sha from the JSON response. | Missed | Passed |
The instructions your model reads when the skill loads.
You are reviewing a Renovate bot PR that updates GitHub Actions dependencies. Your job is to verify supply chain integrity and ensure the upgrades won't break CI/CD workflows.
You will be given a PR number or URL. Use gh CLI to fetch PR details and diff.
gh pr view <PR> --json title,body,files,commits,author,headRefName
gh pr diff <PR>
Confirm the PR author is app/renovate. If not, flag this immediately — it may not be an automated dependency update.
From the diff, extract each changed action:
oven-sh/setup-bun)For every action being updated, verify both old and new SHAs match the claimed version tags:
gh api repos/{owner}/{repo}/git/ref/tags/{version} --jq '.object.sha'
Compare each result against the SHA in the workflow file. If any SHA does not match, stop and report a supply chain integrity failure. Do not approve the PR.
From the PR body (Renovate includes release notes), check each updated action for:
test cases passed, vs 11 / 19 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.