skilld
All skills
bitwarden avatar

/workflow-fix

@f959329 official
by bitwardenbitwarden/ai-plugins155 stars
20

Apply fixes for workflow linter findings identified by the workflow-audit skill. Applies mechanical fixes automatically, pauses for judgment calls, verifies with a re-lint, and creates draft PRs. Run the workflow-audit skill first to identify findings before using this skill. <example> User: Go ahead and fix the linter findings from the audit Action: Trigger workflow-fix to apply fixes and create PRs </example> <example> User: Fix the workflow linter issues in server and clients Action: Trigger workflow-fix for those repos </example>

Ask your Agent

Use this Skill: https://skilld.dev/gh/bitwarden/ai-plugins/workflow-fix

This session only. Nothing lands on disk.

SKILL.md

≈138 tokens always: the name and description. ≈865 when used: this file.

Rules

  • No mutating API calls without confirmation. gh api GET requests are allowed freely. Any call using -X POST, -X PUT, -X PATCH, or -X DELETE must be shown to the user and approved before execution.
  • Never force-push, delete branches, or delete repositories.
  • Only modify files under .github/. Do not touch application code, scripts, or configuration outside of workflow files.
  • Show a diff and get confirmation before handing off for commit.
  • All PRs must be created as drafts.
  • Flag uncertainty. If a finding is ambiguous or a fix could break a workflow, stop and ask rather than guessing.

Step 1: Verify Prerequisites

Check if bwwl is available:

bwwl --version

If the command is not found, stop and inform the user that bwwl must be installed before continuing. Do not attempt to install it.

Step 2: Determine Scope

Parse the user's request to determine what to fix:

  • Single file or directory: Operate on the current repo only.
  • Multiple repos (e.g., "server, clients, android"): Operate on each repo sequentially. Ask the user for the base directory where their repos are cloned. For each repo, look for its local clone at <base-dir>/<repo>. If a clone is not found, inform the user and skip that repo.
  • No specific target: Fix all findings in .github/workflows/ of the current directory.

If the user has not run the workflow-audit skill first, run the linter now to identify findings before proceeding.

Step 3: For Each Repo in Scope

Repeat Steps 4–7 for each repo. Announce which repo is being worked on.

Step 4: Create a Fix Branch

Only create the fix branch if there are findings to fix:

git checkout -b fix/workflow-linter-findings

Step 5: Apply Fixes

Consult the bitwarden-workflow-linter-rules skill for the correct fix for each rule.

For mechanical findings: Apply all fixes without prompting.

Exception — step_pinned: Before applying each hash pin, follow the step_pinned fix procedure from the bitwarden-workflow-linter-rules skill (resolve SHA via gh api, show verification link, wait for user confirmation).

For judgment findings: For each one, pause and present the finding clearly. Ask the user which option they want (per the bitwarden-workflow-linter-rules skill), then apply their choice.

Step 6: Verify Fixes

Re-run the linter to confirm all findings are resolved:

bwwl lint -f .github/workflows/

If errors remain, analyze and fix them. Repeat until clean.

Step 7: Review and Create PR

After all fixes are applied:

  1. Show a git diff of all changes made.
  2. Ask the user to confirm they want to proceed with a PR.
  3. Do not run the staging, commit, or push commands yourself. Present the block below for the user to run manually as a suggestion:
git add .github/workflows/
git commit -m "Fix workflow linter findings"
git push -u origin fix/workflow-linter-findings
  1. Once the user confirms the push, create the draft PR:
gh pr create \
  --title "Fix workflow linter findings" \
  --body "Automated fixes for findings from the Bitwarden workflow linter (bwwl)." \
  --draft

Step 8: Summary

After processing all repos, output a summary table:

Repo Findings Fixed PRs Created Skipped / Notes
... ... ... ...

Source: SKILL.md on GitHub

Third-party checks

No alerts14d3 checks · Risk SAFE
  • Gen Agent Trust Hub14d

    The skill is designed to automatically fix GitHub Actions workflow linter findings using the Bitwarden Workflow Linter (bwwl). It follows security best practices by restricting file modifications to the .github directory and requiring human verification of changes before they are committed or pushed. The low severity reflects the inherent risk of processing external workflow files which could contain malicious content intended to influence the agent.

  • Socket14d

    No alerts

  • Snyk14d

    Risk: LOW · No issues

Provenance

Signed by skilld at f959329. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub yesterday.

Activeupdated 3 months ago

Capability

What it can do
Reads files Edits files Runs commands
All 11 allowed tools
ReadEditGlobGrepSkillBash(bwwl:*)Bash(gh api --method GET *)Bash(git checkout:*)Bash(git diff:*)Bash(git status:*)Bash(gh pr create:*)

Topics

  • workflow
  • github-actions
  • linting
  • ci-cd
  • bitwarden
  • automation
  • pull-requests

README badge

README badge for bitwarden/ai-plugins/workflow-fix

What it does

Applies fixes for GitHub Actions linter findings identified by the workflow-audit skill, handling mechanical issues automatically and pausing for judgment calls. Targets the Bitwarden workflow linter (bwwl) and creates draft PRs after re-linting to verify the fixes.

Generated from the current SKILL.md.

Frequently asked

Do I need to run workflow-audit first?
Yes. The skill applies fixes for findings identified by workflow-audit. If you haven't run it yet, this skill will run the linter to identify findings before proceeding.
What files does this skill modify?
Only files under `.github/`. It will not touch application code, scripts, or configuration outside of workflow files.
Will this skill ask for confirmation before making changes?
Yes. For mechanical fixes, it applies them automatically. For judgment calls (ambiguous findings), it pauses and asks which option you want. It also shows a diff and requests confirmation before committing.
Does this skill require bwwl to be installed?
Yes. The skill checks for `bwwl --version` at the start and will stop if it is not available. You must install it separately before using this skill.
What happens after fixes are applied?
The skill re-runs the linter to verify all findings are resolved, then creates a draft PR with the fixes and a summary table of what was changed across all repos.

Generated from the current SKILL.md. These answers refresh after source changes.