review-renovate
Review Renovate bot PRs that update GitHub Actions dependencies. Verifies supply chain integrity by checking pinned commit SHAs against upstream tagged releases, reviews changelogs for breaking changes, and confirms compatibility with existing workflow configurations. Use when a Renovate PR updates GitHub Actions in .github/workflows/.
Profile →npx skills add backnotprop/plannotator --skill review-renovate --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Review Renovate GitHub Actions PRs You are reviewing a Renovate bot PR that updates GitHub Actions dependencies. Your job is to verify supply chain integrity and ensure the upgrades won't break CI/CD workflows. ## Inputs You will be given a PR number or URL. Use `gh` CLI to fetch PR details and diff. ## Steps ### 1. Fetch PR metadata and diff ``` gh pr view <PR> --json title,body,files,commits,author,headRefName gh pr diff <PR> ``` Confirm the PR author is `app/renovate`. If not, flag this immediately — it may not be an automated dependency update. ### 2. Identify all action version changes From the diff, extract each changed action: - Full action name (e.g., `oven-sh/setup-bun`) - Old version tag and pinned SHA - New version tag and pinned SHA - Update type (patch, minor, major) ### 3. Verify pinned SHAs against upstream tags For every action being updated, verify **both old and new** SHAs match the claimed version tags: ``` gh api repos/{owner}/{repo}/git/ref/tags/{version} --jq '.object.sha' ``` Compare each result against the SHA in the workflow file. If any SHA does not match, **stop and report a supply chain integrity failure**. Do not approve the PR. ### 4. Review changelo
- Inputs
- Steps
- 1. Fetch PR metadata and diff
- 2. Identify all action version changes
- 3. Verify pinned SHAs against upstream tags
- 4. Review changelogs for breaking changes
- 5. Check workflow compatibility
- 6. Report findings
What does the review-renovate skill do?
Review Renovate bot PRs that update GitHub Actions dependencies. Verifies supply chain integrity by checking pinned commit SHAs against upstream tagged releases, reviews changelogs for breaking changes, and confirms compatibility with existing workflow configurations. Use when a Renovate PR updates GitHub Actions in .github/workflows/.
How do I install it?
Run `npx skills add backnotprop/plannotator --skill review-renovate --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From backnotprop/plannotator, a repository with 7,510 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.