actions-security-review

Reviews GitHub Actions workflows with actionlint and zizmor, then ranks findings by exploitable data flow and proposes behavior-aware fixes. Use when: reviewing Actions security, privileged triggers, expression or environment-file injection, token permissions, action pinning, vulnerable actions, reusable-workflow secrets, OIDC boundaries, artifacts, or self-hosted runners.