mcpField
R
review-renovate

review-renovate

github.com/backnotpropSecurity9.7k286 installsUpdated today
Repository

About review-renovate

A review skill for Renovate pull requests that update GitHub Actions. It checks pinned commit SHAs against upstream tags, examines breaking changes, and assesses workflow compatibility before recommending whether to merge.

Key features

  1. 01Fetch PR metadata and diffs
  2. 02Verify old and new action SHAs
  3. 03Review changelogs for breaking changes
  4. 04Check workflow compatibility
  5. 05Report findings and merge recommendation

Use cases

  1. 01Assess a Renovate GitHub Actions update
  2. 02Catch action tag and SHA mismatches
  3. 03Check whether workflow inputs still work

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/backnotprop/plannotator --skill review-renovate

After installing, type/review-renovatein Claude Code to confirm it loaded.

Details

From the project README

Review Renovate GitHub Actions PRs

You are reviewing a Renovate bot PR that updates GitHub Actions dependencies. Your job is to verify supply chain integrity and ensure the upgrades won't break CI/CD workflows.

Inputs

You will be given a PR number or URL. Use gh CLI to fetch PR details and diff.

Steps

1. Fetch PR metadata and diff
gh pr view <PR> --json title,body,files,commits,author,headRefName
gh pr diff <PR>

Confirm the PR author is app/renovate. If not, flag this immediately — it may not be an automated dependency update.

2. Identify all action version changes

From the diff, extract each changed action:

  • Full action name (e.g., oven-sh/setup-bun)
  • Old version tag and pinned SHA
  • New version tag and pinned SHA
  • Update type (patch, minor, major)
3. Verify pinned SHAs against upstream tags

For every action being updated, verify both old and new SHAs match the claimed version tags:

gh api repos/{owner}/{repo}/git/ref/tags/{version} --jq '.object.sha'

Compare each result against the SHA in the workflow file. If any SHA does not match, stop and report a supply chain integrity failure. Do not approve the PR.

4. Review changelogs for breaking changes

From the PR body (Renovate includes release notes), check each updated action for:

  • Removed inputs or outputs that the workflows currently use
  • Changed default behavior for inputs the workflows rely on
  • New required inputs
  • Major version bumps (these almost always have breaking changes)
5. Check workflow compatibility

Read the affected workflow files and verify:

  • No removed or renamed inputs are being used
  • No changed defaults affect current behavior
  • The action's runtime requirements are still met (e.g., Node.js version compatibility)
6. Report findings

Present a summary table:

ActionOldNewTypeSHA verified
.........patch/minor/majoryes/NO

Then state:

  • Whether all SHAs are verified
  • Whether any breaking changes were found
  • Whether the workflows remain compatible
  • A clear safe to merge or do not merge recommendation

Comments

Markdown supported