mcpField
W
workflow-audit

workflow-audit

github.com/bitwardenCloud & DevOps16266 installsUpdated today
Repository

About workflow-audit

A read-only skill for linting GitHub Actions workflow files with `bwwl` and organizing findings by file, rule, and whether they need judgment. It is intended for repository maintainers; it reports issues without changing files.

Key features

  1. 01Checks for the `bwwl` prerequisite
  2. 02Lints workflow files in scoped repositories
  3. 03Groups findings by file and rule
  4. 04Separates mechanical and judgment-based findings
  5. 05Reports totals and repositories without issues

Use cases

  1. 01Auditing workflows in the current repository
  2. 02Checking workflow files across multiple repositories
  3. 03Preparing findings before applying fixes

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/bitwarden/ai-plugins --skill workflow-audit

After installing, type/workflow-auditin Claude Code to confirm it loaded.

Details

From the project README

Rules

  • This skill is strictly read-only. Do not modify, create, or delete any files.
  • Flag uncertainty. If a finding is ambiguous, note it in the report rather than guessing.

Step 1: Verify Prerequisites

Check if bwwl is available:

bwwl --version

If the command is not found, stop and inform the user that bwwl must be installed before continuing. Do not attempt to install it.

Step 2: Determine Scope

Parse the user's request to determine what to lint:

  • Single file or directory (e.g., .github/workflows/build.yml or .github/workflows/): Operate on the current repo only.
  • Multiple repos (e.g., "server, clients, android"): Operate on each repo sequentially. Ask the user for the base directory where their repos are cloned. For each repo, look for its local clone at <base-dir>/<repo>. If a clone is not found, inform the user and skip that repo.
  • No specific target: Lint all files in .github/workflows/ of the current directory.

Step 3: Run the Linter

For each repo in scope, run:

bwwl lint -f .github/workflows/

Capture both stdout and stderr. If operating on multiple repos, announce which repo is being linted.

Step 4: Parse and Categorize Findings

From the linter output, produce a structured list of findings. Group by file and rule. Consult the bitwarden-workflow-linter-rules skill to categorize each finding:

Mechanical (can be auto-fixed):

  • name_capitalized, permissions_exist, pinned_job_runner, step_pinned, underscore_outputs, job_environment_prefix, check_pr_target
  • Simple run_actionlint findings (single-line shell fixes)

Judgment (requires user input):

  • name_exists, step_approved, complex run_actionlint findings

Step 5: Report

Output a summary table per repo:

FileFindingRuleCategory
............

Include totals: mechanical findings, judgment findings, and repos with no issues.

Inform the user that they can use the workflow-fix skill to apply fixes based on these findings.

Comments

Markdown supported