github-actions-integration — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited github-actions-integration (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
anthropics/claude-code-action@v1 GitHub Actions action'i. PR'lari otomatik review eder, issue'lardan otomatik fix olusturur. vibecosystem ile entegre calisir.
Kaynak: https://github.com/anthropics/claude-code-action
Repository Settings > Secrets and variables > Actions > New repository secret:
Name: ANTHROPIC_API_KEY
Value: sk-ant-... (Anthropic API key)Dosya: .github/workflows/claude-review.yml
name: Claude Code Review
on:
pull_request:
types: [opened, synchronize, reopened]
permissions:
contents: read
pull-requests: write
issues: write
jobs:
claude-review:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Claude Code Review
uses: anthropics/claude-code-action@v1
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
review_comment_prefix: "vibecosystem-review"
direct_prompt: |
Review this PR for:
1. Code quality and patterns
2. Security vulnerabilities (OWASP Top 10)
3. Performance issues
4. Test coverage gaps
5. Breaking changes
Use vibecosystem's code-reviewer agent standards.
Provide VERDICT: PASS | WARN | FAILNe yapar: PR acildiginda, guncellediginde veya yeniden acildiginda otomatik review yapar. Review sonucunu PR comment olarak yazar.
Dosya: .github/workflows/claude-fix.yml
name: Claude Code Fix
on:
issues:
types: [labeled]
permissions:
contents: write
pull-requests: write
issues: write
jobs:
claude-fix:
if: contains(github.event.label.name, 'claude-fix')
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Claude Code Fix
uses: anthropics/claude-code-action@v1
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
direct_prompt: |
Fix the issue described below.
Follow TDD workflow: write test first, then implement fix.
Create a PR with the fix.
Issue: ${{ github.event.issue.title }}
Body: ${{ github.event.issue.body }}Ne yapar: Issue'ya claude-fix label'i eklendiginde otomatik fix olusturur ve PR acar.
claude-fix label'i ekleSadece belirli dosya tiplerini review et:
on:
pull_request:
types: [opened, synchronize, reopened]
paths:
- '**.ts'
- '**.tsx'
- '**.js'
- '**.jsx'vibecosystem agent standartlarina gore prompt'u genislet:
direct_prompt: |
Review this PR using vibecosystem standards:
## Code Quality
- Immutability: no mutations, use spread operator
- File size: max 800 lines per file
- Function size: max 50 lines
- Nesting: max 4 levels
- No console.log in production code
- No hardcoded values
## Security (OWASP Top 10)
- Input validation (use zod)
- SQL injection prevention
- XSS prevention
- No hardcoded credentials
- Rate limiting check
## Testing
- Test coverage >= 80%
- Edge cases covered
- Error paths tested
VERDICT: PASS | WARN | FAILdirect_prompt: |
Fix the issue below.
Rules:
- TDD: write failing test first, then implement
- Defensive code: try/catch, null checks, input validation
- No mutations, use immutable patterns
- Follow repository's existing code style
- Run tests before creating PR
Issue: ${{ github.event.issue.title }}
Body: ${{ github.event.issue.body }}Farkli label'lar icin farkli davranislar:
jobs:
claude-fix:
if: contains(github.event.label.name, 'claude-fix')
# ... standard fix
claude-refactor:
if: contains(github.event.label.name, 'claude-refactor')
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: anthropics/claude-code-action@v1
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
direct_prompt: |
Refactor the code described in this issue.
Maintain all existing tests.
Do not change external behavior.
Issue: ${{ github.event.issue.title }}
Body: ${{ github.event.issue.body }}Repository'de CLAUDE.md varsa claude-code-action onu otomatik okur. vibecosystem kurallarini CLAUDE.md'ye ekle:
# Project Rules
- Follow vibecosystem coding standards
- Use TDD workflow for all changes
- Security review required for auth/data code
- VERDICT format: PASS | WARN | FAILReview workflow'u vibecosystem'in code-reviewer agent standartlarini kullanir:
Fix workflow'u TDD workflow'unu kullanir:
| Sorun | Cozum |
|---|---|
| Review calismadi | ANTHROPIC_API_KEY secret ayarli mi? |
| Permission hatasi | Workflow permissions blogu dogru mu? |
| Fix PR acilmadi | claude-fix label dogru yazildi mi? |
| Review cok uzun suruyor | fetch-depth: 1 ile sadece son commit'i al |
| Rate limit | API key plan limitini kontrol et |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.