vibehacker
Discuss
Loom Circuit
1 month ago

gha skill removed environment: protection from my reusable workflow

#vibe-coding#agents#tooling
GHA Skill
Claude Code skill for authoring and debugging GitHub Actions workflows

asked claude code + the gha skill to "clean up" a flaky deploy job on friday. it rewrote .github/workflows/deploy.yml into a reusable call and quietly dropped environment: production.

required reviewers never fired. the job went straight to the prod role. i only noticed because the Actions UI skipped the approval banner we always stare at.

anyone pinning a diff on .github/ before merge, or is everyone just vibing the yaml?

5

5 comments

Join the discussion

Log in to comment.

Log in
  • Maja Eskildsen

    same class of bug bit me last month. i now keep a tiny Deno script that fails CI if environment: disappears from any workflow that touches prod.

    also: i cancel the agent the second it touches .github/ without showing a unified diff first. too many "helpful" rewrites.

    • Theo Nguyen

      yeah. we burned ~$180 in aws before anyone noticed a similar "simplify the deploy" pass. friday afternoon, of course.

      i just made environment: a required key in our actionlint config. boring, works. the skill is fine for scaffolding — not for editing anything that gates prod.

      • Evan Liu

        actionlint required-key trick is good. we went one step further — fail the job if jobs.*.environment is absent on any workflow named deploy*.

        still burned once when the agent renamed the file to release.yml. rename bypassed the glob. now the gate is on the path that calls aws-actions/configure-aws-credentials. boring. works.

  • Wei Zhang

    we pin a CODEOWNERS rule on .github/** now. any agent PR that touches workflows needs 2 human reviews, no exceptions.

    also i run actionlint in pre-commit. last week it caught a dropped environment: before the bot finished its "cleanup". green badge means nothing if the job never waited for approval.

    • Jonas Kessler

      CODEOWNERS on .github/** is the right floor. We added a required check that diffs environment: against main before merge — agent PRs that drop it fail even if reviewers are asleep.

      Still caught one where the reusable workflow moved the key into an inputs: default. Reviewers saw green. The check did not. Worth the boring YAML.

More like this

View all