Review Renovate pull requests that update GitHub Actions. Verify pinned commits against upstream version tags, inspect release notes for breaking changes, and check existing workflow settings before giving a clear recommendation on whether to merge.
Review Renovate bot PRs that update GitHub Actions dependencies. Verifies supply chain integrity by checking pinned commit SHAs against upstream tagged releases, reviews changelogs for breaking changes, and confirms compatibility with existing workflow configurations. Use when a Renovate PR updates GitHub Actions in .github/workflows/.
Review the instructions the agent will receive before you install.
You are reviewing a Renovate bot PR that updates GitHub Actions dependencies. Your job is to verify supply chain integrity and ensure the upgrades won't break CI/CD workflows.
You will be given a PR number or URL. Use gh CLI to fetch PR details and diff.
gh pr view <PR> --json title,body,files,commits,author,headRefName
gh pr diff <PR>
Confirm the PR author is app/renovate. If not, flag this immediately — it may not be an automated dependency update.
From the diff, extract each changed action:
oven-sh/setup-bun)For every action being updated, verify both old and new SHAs match the claimed version tags:
gh api repos/{owner}/{repo}/git/ref/tags/{version} --jq '.object.sha'
Compare each result against the SHA in the workflow file. If any SHA does not match, stop and report a supply chain integrity failure. Do not approve the PR.
From the PR body (Renovate includes release notes), check each updated action for:
Read the affected workflow files and verify:
Present a summary table:
| Action | Old | New | Type | SHA verified |
|---|---|---|---|---|
| ... | ... | ... | patch/minor/major | yes/NO |
Then state:
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Use Plannotator to review plans, code changes, documents, and running local apps in a browser. This reference covers returning feedback to agents, browsing past decisions, sharing guided code reviews, and leaving questions for later replies.
Review Markdown files, HTML files, URLs, or folders in Plannotator’s annotation interface. The agent responds to requested changes and distinguishes them from approvals, optional approval notes, and sessions closed without feedback.
Open documents, text configuration files, HTML, URLs, or folders in Plannotator for browser review. The agent responds to returned annotations and can use an approval session when you need to accept a plan, specification, or document.
Open files, folders, or URLs in Plannotator’s annotation interface, then have the agent address the returned comments. Use it to review Markdown, plain-text configuration files, or HTML through a shared feedback workflow.
Analyze rejected plans and reviewer feedback to identify recurring concerns, changing expectations, and concrete prompt improvements. Produce an HTML dashboard from Plannotator archives, or use Claude Code plan rejection reasons when those archives are unavailable.
Open the assistant’s latest rendered message in Plannotator and return specific annotations for revision. The skill distinguishes requested edits from approval, approval with notes, and a closed session, so each review result receives the appropriate response.