expo-cicd-workflows — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited expo-cicd-workflows (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Help developers write and edit EAS CI/CD workflow YAML files.
Fetch these resources before generating or validating workflow files. Use the fetch script (implemented using Node.js) in this skill's scripts/ directory; it caches responses using ETags for efficiency:
# Fetch resources
node {baseDir}/scripts/fetch.js <url>Do not rely on memorized values; these resources evolve as new features are added.
Workflows live in .eas/workflows/*.yml (or .yaml).
A workflow file has these top-level keys:
name — Display name for the workflowon — Triggers that start the workflow (at least one required)jobs — Job definitions (required)defaults — Shared defaults for all jobsconcurrency — Control parallel workflow runsConsult the schema for the full specification of each section.
Use ${{ }} syntax for dynamic values. The schema defines available contexts:
github.* — GitHub repository and event informationinputs.* — Values from workflow_dispatch inputsneeds.* — Outputs and status from dependent jobsjobs.* — Job outputs (alternative syntax)steps.* — Step outputs within custom jobsworkflow.* — Workflow metadataWhen generating or editing workflows:
needs and after exist in the workflowif conditions respect the schema's length constraintsAfter generating or editing a workflow file, validate it against the schema:
# Install dependencies if missing
[ -d "{baseDir}/scripts/node_modules" ] || npm install --prefix {baseDir}/scripts
node {baseDir}/scripts/validate.js <workflow.yml> [workflow2.yml ...]The validator fetches the latest schema and checks the YAML structure. Fix any reported errors before considering the workflow complete.
When users ask about available options (job types, triggers, runner types, etc.), fetch the schema and derive the answer from it rather than relying on potentially outdated information.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.