Seed new CLIs with the GitHub Actions audit job - #76
Conversation
The seed's test workflow had no lint-actions job while every CLI seeded from it (basecamp-cli, hey-cli, fizzy-cli) and this repo's own test workflow run actionlint and zizmor on every push. A new CLI now starts with the same job, on zizmor-action 0.6.3, and with the actionlint config that lets 1.7.12 pass the `$/` reusable-workflow call the seed's release workflow makes (#74).
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
🟡 Changes recommended
The seed prompt’s copy map omits the new actionlint configuration, so generated CLIs will not receive it.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds GitHub Actions auditing to newly seeded CLIs.
Changes:
- Adds actionlint and zizmor audit steps.
- Adds actionlint suppression for the future
$/workflow reference.
[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or rungh pr ready --undo.
Click "Ready for review" or rungh pr readyto reengage.
File summaries
| File | Description |
|---|---|
seed/.github/workflows/test.yml |
Adds the Actions audit job. |
seed/.github/actionlint.yaml |
Configures actionlint for $/ references. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e20b0f903d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
A CLI bootstrapped from prompts/seed-cli.md copies the seed's .github tree file by file from the map in step 4. The map did not name seed/.github/actionlint.yaml, so a new CLI would get the lint-actions job without the config that lets actionlint 1.7.12 pass the $/ reusable-workflow call.
seed/.github/workflows/scorecard.yml has been in the seed without an entry in the step-4 copy map, so a CLI bootstrapped from the prompt never got it.
|
Fixed — the seed prompt's copy map now carries |
The seed's
test.ymlhad nolint-actionsjob, while every CLI seeded from it (basecamp-cli, hey-cli, fizzy-cli) and this repo's owntest.ymlrun actionlint and zizmor on every push. A newly seeded CLI would start without the audit and gain it only if someone noticed.This adds the same job to the seed, on zizmor-action 0.6.3 (zizmor 1.30), and a
seed/.github/actionlint.yamlscoped to the$/.github/workflows/security.ymlcall the seed's release workflow makes after #74. Before #74 lands the config is inert; after it, it is what lets actionlint 1.7.12 pass.Verified from the seed root, the way a seeded repo runs it (
cd seed && actionlint): exit 0. Running actionlint from this repo's root againstseed/.github/workflows/*.ymlis not a valid check, since it resolves the seed's./.github/workflows/security.ymlcall against this repo's own file and reports a secret mismatch that does not exist in the seed. zizmor 1.30.0 over the seed reports only the./call that #74 rewrites.Independent of #74 in content; stacks cleanly either way.