review-renovate
Review Renovate bot PRs that update GitHub Actions dependencies. Verifies supply chain integrity by checking pinned commit SHAs against upstream tagged releases, reviews changelogs for breaking changes, and confirms compatibility with existing workflow configurations. Use when a Renovate PR updates GitHub Actions in .github/workflows/.
- Installs
- 286
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/backnotprop/plannotator --skill review-renovate- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads review-renovate automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Review Renovate GitHub Actions PRs
You are reviewing a Renovate bot PR that updates GitHub Actions dependencies. Your job is to verify supply chain integrity and ensure the upgrades won't break CI/CD workflows.
Inputs
You will be given a PR number or URL. Use gh CLI to fetch PR details and diff.
Steps
1. Fetch PR metadata and diff
gh pr view <PR> --json title,body,files,commits,author,headRefName
gh pr diff <PR>
Confirm the PR author is app/renovate. If not, flag this immediately — it may not be an automated dependency update.
2. Identify all action version changes
From the diff, extract each changed action:
- Full action name (e.g.,
oven-sh/setup-bun) - Old version tag and pinned SHA
- New version tag and pinned SHA
- Update type (patch, minor, major)
3. Verify pinned SHAs against upstream tags
For every action being updated, verify both old and new SHAs match the claimed version tags:
gh api repos/{owner}/{repo}/git/ref/tags/{version} --jq '.object.sha'
Compare each result against the SHA in the workflow file. If any SHA does not match, stop and report a supply chain integrity failure. Do not approve the PR.
4. Review changelogs for breaking changes
From the PR body (Renovate includes release notes), check each updated action for:
- Removed inputs or outputs that the workflows currently use
- Changed default behavior for inputs the workflows rely on
- New required inputs
- Major version bumps (these almost always have breaking changes)
5. Check workflow compatibility
Read the affected workflow files and verify:
- No removed or renamed inputs are being used
- No changed defaults affect current behavior
- The action's runtime requirements are still met (e.g., Node.js version compatibility)
6. Report findings
Present a summary table:
| Action | Old | New | Type | SHA verified |
|---|---|---|---|---|
| ... | ... | ... | patch/minor/major | yes/NO |
Then state:
- Whether all SHAs are verified
- Whether any breaking changes were found
- Whether the workflows remain compatible
- A clear safe to merge or do not merge recommendation
FAQ
What does the review-renovate skill do?
Review Renovate bot PRs that update GitHub Actions dependencies. Verifies supply chain integrity by checking pinned commit SHAs against upstream tagged releases, reviews changelogs for breaking changes, and confirms compatibility with existing workflow configurations. Use when a Renovate PR updates GitHub Actions in .github/workflows/.
How do I install review-renovate?
Run npx skills add https://github.com/backnotprop/plannotator --skill review-renovate in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/review-renovate/ (personal) or .claude/skills/review-renovate/ (project).
Which AI agents can use review-renovate?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is review-renovate safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains review-renovate?
It is published by backnotprop in backnotprop/plannotator. It has 286 recorded installs.
More from backnotprop/plannotator
plannotator-visual-explainer
backnotprop/plannotator
Generate self-contained HTML visualizations with Plannotator theming. Use for implementation plans, PR explainers, architecture diagrams, data tables, slide decks, and any visual explanation of technical concepts. Plans and PR explainers follow Plannotator's prescriptive approach; all other visual content delegates to nicobailon/visual-explainer.
plannotator-compound
backnotprop/plannotator
Analyze a user's Plannotator plan archive to extract denial patterns, feedback taxonomy, evolution over time, and actionable prompt improvements — then produce a polished HTML dashboard report. Falls back to Claude Code ExitPlanMode denial reasons when Plannotator data is unavailable.
plannotator-setup-goal
backnotprop/plannotator
Turn an idea or objective into a goal package for /goal. Interviews the user, builds a reviewed fact sheet via Plannotator, then explores the codebase to produce an execution plan.
plannotator-review
backnotprop/plannotator
Open Plannotator's browser-based code review UI for the current worktree, another directory, or a pull request URL, then act on the feedback that comes back.
plannotator-annotate
backnotprop/plannotator
Open Plannotator's annotation UI for a markdown file, plain-text config file (.yaml, .json, .toml, .ini, .csv, .log, …), HTML file, URL, or folder and then respond to the returned annotations.
plannotator-last
backnotprop/plannotator
Open Plannotator on the latest rendered assistant message and use the returned annotations to revise that message or continue.
Popular code quality & workflow skills
grill-me
mattpocock/skills
A relentless interview to sharpen a plan or design.
improve-codebase-architecture
mattpocock/skills
Scan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.
handoff
mattpocock/skills
Compact the current conversation into a handoff document for another agent to pick up.
domain-modeling
mattpocock/skills
Build and sharpen a project's domain model. Use when discussing codebase terminology, writing or editing a GLOSSARY.md, or recording or editing an ADR.
codebase-design
mattpocock/skills
Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.
diagnosing-bugs
mattpocock/skills
Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.