Opinionated conventions for reliable, least-privilege GitHub Actions CI and deploy workflows.
Reviews and rewrites Git commit messages to Conventional Commits quality — clear type/scope, imperative subject, useful body explaining why — and trains the author with concrete before/after feedback.
Reads Conventional Commits or a changelog snippet, classifies fix/feat/breaking changes, and recommends the next SemVer bump (patch, minor, or major) with a clear rationale and a preview of the resulting version. Use when a user asks "what version should I ship?", "is this a breaking change?", or "bump SemVer from these commits". Includes a tested stdlib Python advisor.
Reviews GitHub Actions workflow YAML for supply-chain and injection risks: pull_request_target with PR checkout, untrusted github.event text in run steps, actions pinned to tags or branches instead of commit SHAs, missing or write-all permissions, secrets in shell commands, curl | bash, self-hosted runners on PRs, and missing timeouts. Use before merging CI changes or auditing a repo. Includes a stdlib Python linter with --self-test.
Checks a GitHub CODEOWNERS file against the real repository file list - works out who owns every file (last matching line wins), then reports invalid or unknown owners, unowned files and critical paths left to the catch-all rule, rules that match nothing or are fully overridden by later lines, unsupported ! and [ ] syntax, duplicates, empty teams and one-person bottlenecks. Includes an offline stdlib Python checker.
Compares environment variables across local, staging and production, finds missing, unused or mismatched settings before they break a deploy, and keeps your example env file honest.
Finds out why your CI builds are slow: tracks job times over weeks, spots missing caches, serial steps and oversized runners, and suggests concrete changes ranked by minutes saved.
Finds old and abandoned Git branches in your repositories, checks whether their work was merged or still matters, and asks owners before suggesting a safe cleanup list.
After an incident it collects the alert timeline, chat messages, deploys and graphs into a blameless postmortem draft with impact, root cause, and follow-up actions.
