What problem does it solve? Renovate bot PRs that bump GitHub Actions versions can introduce supply chain risks or breaking changes, and manually verifying every pinned commit SHA and changelog is tedious and error-prone. ## Core Features & Use Cases - Supply Chain Verification: Confirms that both old and new pinned commit SHAs match the claimed upstream version tags via the GitHub API, flagging mismatches as integrity failures. - Breaking Change Detection: Reviews Renovate release notes for removed inputs, changed defaults, new required inputs, and major version bumps. - Workflow Compatibility Checks: Reads affected workflow files to confirm no removed or renamed inputs are in use and runtime requirements still hold. - Use Case: A Renovate PR bumps actions/checkout from v4 to v5 across your workflows. The skill fetches the diff, verifies both SHAs against the upstream tags, scans the changelog for breaking changes, and returns a clear safe-to-merge or do-not-merge recommendation. ## Quick Start Ask the agent to review Renovate PR number 42 that updates GitHub Actions in the workflows directory.
