← all checklists

GitHub (repository & Actions)

20 items · source

Copy as markdown

Filter items

CI/CD & Supply Chain

• Review branch protection.
• Require CODEOWNERS.
• Review pull_request_target.
• Enable Dependabot updates for actions.

Pre-Release Gates

• GitHub repository audit complete.
• GitHub Actions audit complete.

AI Output Handling

• Never directly use model output as a GitHub Actions workflow.

AI Integrations (email, browser, repos, cloud)

• Agent cannot modify branch protection.
• Agent cannot modify GitHub Actions permissions.
• Agent cannot modify CODEOWNERS without review.

AI-Generated Crypto, Dependency & Config Bugs

Review every AI-generated:

• GitHub Actions

Verify AI did not:

• disable branch protection
• give GitHub Actions write-all permissions

AI-Generated Infrastructure & Pipeline Bugs

• Review GITHUB_TOKEN.
• Review pull_request_target.

Review Blind Spots

• Verify old GitHub Actions security patterns are not copied.
• Compare GitHub Actions permissions.

Agent Prompts & PR Review

• Agent is prohibited from bypassing branch protection.

Treat AI suggestions such as these as security-sensitive:

• "use pull_request_target"

Vibe-Coding Release Gate

• AI changed GitHub Actions.