opencode-skills-collection 4.0.54 → 4.0.55

package/bundled-skills/embedding-strategies/SKILL.md

@@ -115,9 +115,11 @@ class LocalEmbedder:
     def __init__(
         self,
         model_name: str = "BAAI/bge-large-en-v1.5",
-        device: str = "cuda"
+        device: str = "cpu",
+        query_prefix: str = ""
     ):
         self.model = SentenceTransformer(model_name, device=device)
+        self.query_prefix = query_prefix  # Choose from the selected model card.
 
     def embed(
         self,
@@ -135,11 +137,8 @@ class LocalEmbedder:
         return embeddings
 
     def embed_query(self, query: str) -> np.ndarray:
-        """Embed a query with BGE-style prefix."""
-        # BGE models benefit from query prefix
-        if "bge" in self.model.get_sentence_embedding_dimension():
-            query = f"Represent this sentence for searching relevant passages: {query}"
-        return self.embed([query])[0]
+        """Embed a query with the explicitly configured model prefix."""
+        return self.embed([self.query_prefix + query])[0]
 
     def embed_documents(self, documents: List[str]) -> np.ndarray:
         """Embed documents for indexing."""
@@ -171,8 +170,13 @@ def chunk_by_tokens(
     tokenizer=None
 ) -> List[str]:
     """Chunk text by token count."""
-    import tiktoken
-    tokenizer = tokenizer or tiktoken.get_encoding("cl100k_base")
+    if not isinstance(chunk_size, int) or not isinstance(chunk_overlap, int):
+        raise ValueError("chunk size and overlap must be integers")
+    if chunk_size <= 0 or not 0 <= chunk_overlap < chunk_size:
+        raise ValueError("require chunk_size > 0 and 0 <= overlap < chunk_size")
+    if tokenizer is None:
+        import tiktoken
+        tokenizer = tiktoken.get_encoding("cl100k_base")
 
     tokens = tokenizer.encode(text)
     chunks = []
@@ -183,6 +187,8 @@ def chunk_by_tokens(
         chunk_tokens = tokens[start:end]
         chunk_text = tokenizer.decode(chunk_tokens)
         chunks.append(chunk_text)
+        if end >= len(tokens):
+            break
         start = end - chunk_overlap
 
     return chunks
@@ -249,58 +255,28 @@ def recursive_character_splitter(
     chunk_overlap: int = 200,
     separators: List[str] = None
 ) -> List[str]:
-    """LangChain-style recursive splitter."""
-    separators = separators or ["\n\n", "\n", ". ", " ", ""]
-
-    def split_text(text: str, separators: List[str]) -> List[str]:
-        if not text:
-            return []
-
-        separator = separators[0]
-        remaining_separators = separators[1:]
-
-        if separator == "":
-            # Character-level split
-            return [text[i:i+chunk_size] for i in range(0, len(text), chunk_size - chunk_overlap)]
-
-        splits = text.split(separator)
-        chunks = []
-        current_chunk = []
-        current_length = 0
-
-        for split in splits:
-            split_length = len(split) + len(separator)
-
-            if current_length + split_length > chunk_size and current_chunk:
-                chunk_text = separator.join(current_chunk)
-
-                # Recursively split if still too large
-                if len(chunk_text) > chunk_size and remaining_separators:
-                    chunks.extend(split_text(chunk_text, remaining_separators))
-                else:
-                    chunks.append(chunk_text)
-
-                # Start new chunk with overlap
-                overlap_splits = []
-                overlap_length = 0
-                for s in reversed(current_chunk):
-                    if overlap_length + len(s) <= chunk_overlap:
-                        overlap_splits.insert(0, s)
-                        overlap_length += len(s)
-                    else:
-                        break
-                current_chunk = overlap_splits
-                current_length = overlap_length
-
-            current_chunk.append(split)
-            current_length += split_length
-
-        if current_chunk:
-            chunks.append(separator.join(current_chunk))
-
-        return chunks
-
-    return split_text(text, separators)
+    """Bounded character chunks, preferring a separator inside each window."""
+    if chunk_size <= 0 or not 0 <= chunk_overlap < chunk_size:
+        raise ValueError("require chunk_size > 0 and 0 <= overlap < chunk_size")
+    separators = separators or ["\n\n", "\n", ". ", " "]
+    chunks = []
+    start = 0
+    while start < len(text):
+        end = min(start + chunk_size, len(text))
+        if end < len(text):
+            for separator in separators:
+                if not separator:
+                    continue
+                boundary = text.rfind(separator, start + chunk_overlap + 1, end)
+                if boundary >= 0:
+                    end = boundary + len(separator)
+                    break
+        chunks.append(text[start:end])
+        if end == len(text):
+            break
+        start = end - chunk_overlap
+    return chunks
+
 ```
 
 ### Template 4: Domain-Specific Embedding Pipeline
@@ -381,8 +357,8 @@ class DomainEmbeddingPipeline:
 class CodeEmbeddingPipeline:
     """Specialized pipeline for code embeddings."""
 
-    def __init__(self, model: str = "voyage-code-2"):
-        self.model = model
+    def __init__(self, embed_fn):
+        self.embed_fn = embed_fn  # Supply a reviewed provider-specific embedding adapter.
 
     def chunk_code(self, code: str, language: str) -> List[dict]:
         """Chunk code by functions/classes."""
@@ -391,12 +367,12 @@ class CodeEmbeddingPipeline:
         # Parse with tree-sitter
         # Extract functions, classes, methods
         # Return chunks with context
-        pass
+        raise NotImplementedError("Supply the installed parser and language grammar")
 
     def embed_with_context(self, chunk: str, context: str) -> List[float]:
         """Embed code with surrounding context."""
         combined = f"Context: {context}\n\nCode:\n{chunk}"
-        return get_embedding(combined, model=self.model)
+        return self.embed_fn(combined)
 ```
 
 ### Template 5: Embedding Quality Evaluation

package/bundled-skills/embedding-strategies/resources/implementation-playbook.md

@@ -0,0 +1,23 @@
+# Embedding selection and migration
+
+## Inputs
+
+Representative documents, query/relevance pairs, data-sharing permission, installed provider SDK and latency/cost constraints.
+
+## Procedure
+
+1. Choose candidate models from their actual supported languages, token limits, dimensions and query/document instructions. Record model revision and preprocessing together.
+2. Validate chunk-size and overlap bounds; test empty input and an overlong document. Preserve identifiers and source offsets. Batch only within provider limits and keep original text intact.
+3. Compare retrieval on the same labeled queries, including no-answer and cross-tenant cases. Use a separate index for each model and dimension; verify rollback before switching readers.
+
+## Worked example
+
+Evaluate two models against twenty labeled support queries. Report recall at a fixed k, latency and failures; do not describe this small sample as general superiority.
+
+## Verification and handoff
+
+Report the actual files or configuration changed, checks performed, observed results and any untested environment. Keep the original inputs and evidence sufficient to reproduce the conclusion.
+
+## Limitations
+
+Embeddings may expose private source information. Do not send documents to a provider without authorization, or mix vectors from different model revisions.

package/bundled-skills/fastapi-pro/resources/implementation-playbook.md

@@ -0,0 +1,23 @@
+# FastAPI endpoint implementation
+
+## Inputs
+
+Installed FastAPI/Pydantic/SQLAlchemy versions, endpoint contract, identity model and test database.
+
+## Procedure
+
+1. Define request and response schemas from the user journey. Keep ownership and permission decisions server-side and separate from serialization.
+2. Reuse application lifespan and dependency patterns. Bound outbound timeouts; avoid blocking calls in async handlers and avoid sharing mutable database sessions across concurrent tasks.
+3. Test success, invalid input, unauthorized access and persistence failure. Verify response fields, transaction rollback and client-visible errors before updating the API contract.
+
+## Worked example
+
+Create an invoice endpoint with an idempotency requirement. Repeating the same request must not create a second invoice; a different tenant must not retrieve the first.
+
+## Verification and handoff
+
+Report the actual files or configuration changed, checks performed, observed results and any untested environment. Keep the original inputs and evidence sufficient to reproduce the conclusion.
+
+## Limitations
+
+Background work and external effects require their own retry and idempotency design. Schema validation is not authorization.

package/bundled-skills/find-complementary-founders/scripts/assess_profile.py

@@ -8,6 +8,7 @@ import json
 import os
 import re
 import sys
+import stat
 from collections import defaultdict
 from datetime import date, datetime, timezone
 from pathlib import Path
@@ -395,9 +396,14 @@ def write_json(path: Path, data: dict, *, private: bool) -> None:
     path.parent.mkdir(parents=True, exist_ok=True)
     if path.is_symlink():
         raise ProfileError(f"Refusing to write through symlink: {path}")
-    flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC | getattr(os, "O_NOFOLLOW", 0)
+    flags = os.O_WRONLY | os.O_CREAT | getattr(os, "O_NOFOLLOW", 0)
+    flags |= getattr(os, "O_NONBLOCK", 0)
     fd = os.open(path, flags, 0o600 if private else 0o644)
     with os.fdopen(fd, "w", encoding="utf-8") as handle:
+        file_stat = os.fstat(handle.fileno())
+        if not stat.S_ISREG(file_stat.st_mode) or file_stat.st_nlink != 1:
+            raise ProfileError(f"Refusing to write non-regular or multiply linked file: {path}")
+        os.ftruncate(handle.fileno(), 0)
         os.fchmod(handle.fileno(), 0o600 if private else 0o644)
         json.dump(data, handle, indent=2, ensure_ascii=False, sort_keys=True)
         handle.write("\n")

package/bundled-skills/frontend-security-coder/SKILL.md

@@ -68,13 +68,13 @@ Expert frontend security developer with comprehensive knowledge of client-side s
 - **Third-party CSS**: External stylesheet validation, subresource integrity for stylesheets
 
 ### Clickjacking Protection
-- **Frame detection**: Intersection Observer API implementation, UI overlay detection, frame-busting logic
+- **Frame detection**: Supplementary UI signals only; do not treat viewport observation as a frame authorization boundary
 - **Frame-busting techniques**: JavaScript-based frame busting, top-level navigation protection
 - **X-Frame-Options**: DENY and SAMEORIGIN implementation, frame ancestor control
 - **CSP frame-ancestors**: Content Security Policy frame protection, granular frame source control
 - **SameSite cookie protection**: Cross-frame CSRF protection, cookie isolation techniques
 - **Visual confirmation**: User action confirmation, critical operation verification, overlay detection
-- **Environment-specific deployment**: Apply clickjacking protection only in production or standalone applications, disable or relax during development when embedding in iframes
+- **Environment-specific deployment**: Define an explicit allowed embedding policy per environment; do not disable protection as a convenience
 
 ### Secure Redirects and Navigation
 - **Redirect validation**: URL allowlist validation, internal redirect verification, domain allowlist enforcement
@@ -117,7 +117,7 @@ Expert frontend security developer with comprehensive knowledge of client-side s
 
 ### Mobile and Responsive Security
 - **Touch interaction security**: Gesture validation, touch event security, haptic feedback
-- **Viewport security**: Secure viewport configuration, zoom prevention for sensitive forms
+- **Viewport security**: Secure viewport configuration, preserve user zoom and accessible scaling
 - **Device API security**: Geolocation privacy, camera/microphone permissions, sensor data protection
 - **App-like behavior**: PWA security, full-screen mode security, navigation gesture handling
 - **Cross-platform compatibility**: Platform-specific security considerations, feature detection security
@@ -127,7 +127,7 @@ Expert frontend security developer with comprehensive knowledge of client-side s
 - Implements comprehensive input validation with allowlist approaches
 - Uses Content Security Policy headers to prevent script injection
 - Validates all user-supplied URLs before navigation or redirects
-- Applies frame-busting techniques only in production environments
+- Uses server-delivered frame-ancestors policy; frame detection is only supplementary
 - Sanitizes all dynamic content with established libraries like DOMPurify
 - Implements secure authentication token storage and management
 - Uses modern browser security features and APIs
@@ -151,7 +151,7 @@ Expert frontend security developer with comprehensive knowledge of client-side s
 2. **Implement secure DOM manipulation** using textContent and secure APIs
 3. **Configure Content Security Policy** with appropriate directives and violation reporting
 4. **Validate all user inputs** with allowlist-based validation and sanitization
-5. **Implement clickjacking protection** with frame detection and busting techniques
+5. **Implement clickjacking protection** with server-delivered frame-ancestors policy and authorized embedding tests
 6. **Secure navigation and redirects** with URL validation and allowlist enforcement
 7. **Apply browser security features** including SRI, Trusted Types, and security headers
 8. **Handle authentication securely** with proper token storage and session management

package/bundled-skills/frontend-security-coder/resources/implementation-playbook.md

@@ -0,0 +1,23 @@
+# Frontend security implementation
+
+## Inputs
+
+The component, rendering framework, trusted content policy, session design and browser test route.
+
+## Procedure
+
+1. Identify untrusted text, HTML, URLs and cross-window messages. Prefer text rendering; use an established sanitizer only where authored HTML is required.
+2. Enforce URL schemes and destination rules. Validate message origin and source. Coordinate server headers and authorization; client validation is only usability feedback.
+3. Test an inert markup payload as text, disallowed URL schemes and messages from another origin. Inspect rendered DOM, network effects and console. Preserve zoom and keyboard access.
+
+## Worked example
+
+A profile biography contains markup. Render it as text unless rich text is explicitly required; verify no extra element or request appears and legitimate text remains readable.
+
+## Verification and handoff
+
+Report the actual files or configuration changed, checks performed, observed results and any untested environment. Keep the original inputs and evidence sufficient to reproduce the conclusion.
+
+## Limitations
+
+Frame detection and frame-busting scripts do not replace frame-ancestors response policy. Browser storage is not a safe place for server secrets.

package/bundled-skills/github-actions-templates/SKILL.md

@@ -6,348 +6,68 @@ source: community
 date_added: "2026-02-27"
 ---
 
-# GitHub Actions Templates
+# GitHub Actions Workflow Patterns
 
-Production-ready GitHub Actions workflow patterns for testing, building, and deploying applications.
+## When to Use
 
-## Do not use this skill when
+Implement testing, matrix builds, artifact preparation or an explicitly authorized deployment workflow for an existing repository.
 
-- The task is unrelated to github actions templates
-- You need a different domain or tool outside this scope
+## Inputs
 
-## Instructions
+Inspect the repository's actual scripts, lockfile, supported runtimes, required check names and release policy. Read `resources/implementation-playbook.md` and `references/common-workflows.md` before choosing job boundaries.
 
-- Clarify goals, constraints, and required inputs.
-- Apply relevant best practices and validate outcomes.
-- Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
+## Test Workflow
 
-## Purpose
-
-Create efficient, secure GitHub Actions workflows for continuous integration and deployment across various tech stacks.
-
-## Use this skill when
-
-- Automate testing and deployment
-- Build Docker images and push to registries
-- Deploy to Kubernetes clusters
-- Run security scans
-- Implement matrix builds for multiple environments
-
-## Common Workflow Patterns
-
-### Pattern 1: Test Workflow
+This Node example assumes the target repository declares `npm test` and supports Node 22. Adapt the runtime and command to the actual project. The pinned action revisions are explicit review inputs; verify them before adopting or updating the template.
 
 ```yaml
 name: Test
-
 on:
-  push:
-    branches: [ main, develop ]
   pull_request:
-    branches: [ main ]
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        node-version: [18.x, 20.x]
-
-    steps:
-    - uses: actions/checkout@v4
-
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v4
-      with:
-        node-version: ${{ matrix.node-version }}
-        cache: 'npm'
-
-    - name: Install dependencies
-      run: npm ci
-
-    - name: Run linter
-      run: npm run lint
-
-    - name: Run tests
-      run: npm test
-
-    - name: Upload coverage
-      uses: codecov/codecov-action@v3
-      with:
-        files: ./coverage/lcov.info
-```
-
-**Reference:** See `assets/test-workflow.yml`
-
-### Pattern 2: Build and Push Docker Image
-
-```yaml
-name: Build and Push
-
-on:
   push:
-    branches: [ main ]
-    tags: [ 'v*' ]
-
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-    - uses: actions/checkout@v4
-
-    - name: Log in to Container Registry
-      uses: docker/login-action@v3
-      with:
-        registry: ${{ env.REGISTRY }}
-        username: ${{ github.actor }}
-        password: ${{ secrets.GITHUB_TOKEN }}
-
-    - name: Extract metadata
-      id: meta
-      uses: docker/metadata-action@v5
-      with:
-        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-        tags: |
-          type=ref,event=branch
-          type=ref,event=pr
-          type=semver,pattern={{version}}
-          type=semver,pattern={{major}}.{{minor}}
-
-    - name: Build and push
-      uses: docker/build-push-action@v5
-      with:
-        context: .
-        push: true
-        tags: ${{ steps.meta.outputs.tags }}
-        labels: ${{ steps.meta.outputs.labels }}
-        cache-from: type=gha
-        cache-to: type=gha,mode=max
-```
-
-**Reference:** See `assets/deploy-workflow.yml`
-
-### Pattern 3: Deploy to Kubernetes
-
-```yaml
-name: Deploy to Kubernetes
-
-on:
-  push:
-    branches: [ main ]
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@v4
-
-    - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@v4
-      with:
-        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-        aws-region: us-west-2
-
-    - name: Update kubeconfig
-      run: |
-        aws eks update-kubeconfig --name production-cluster --region us-west-2
-
-    - name: Deploy to Kubernetes
-      run: |
-        kubectl apply -f k8s/
-        kubectl rollout status deployment/my-app -n production
-        kubectl get services -n production
-
-    - name: Verify deployment
-      run: |
-        kubectl get pods -n production
-        kubectl describe deployment my-app -n production
-```
-
-### Pattern 4: Matrix Build
-
-```yaml
-name: Matrix Build
-
-on: [push, pull_request]
-
-jobs:
-  build:
-    runs-on: ${{ matrix.os }}
-
-    strategy:
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-        python-version: ['3.9', '3.10', '3.11', '3.12']
-
-    steps:
-    - uses: actions/checkout@v4
-
-    - name: Set up Python
-      uses: actions/setup-python@v5
-      with:
-        python-version: ${{ matrix.python-version }}
-
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install -r requirements.txt
-
-    - name: Run tests
-      run: pytest
-```
-
-**Reference:** See `assets/matrix-build.yml`
-
-## Workflow Best Practices
-
-1. **Use specific action versions** (@v4, not @latest)
-2. **Cache dependencies** to speed up builds
-3. **Use secrets** for sensitive data
-4. **Implement status checks** on PRs
-5. **Use matrix builds** for multi-version testing
-6. **Set appropriate permissions**
-7. **Use reusable workflows** for common patterns
-8. **Implement approval gates** for production
-9. **Add notification steps** for failures
-10. **Use self-hosted runners** for sensitive workloads
-
-## Reusable Workflows
-
-```yaml
-# .github/workflows/reusable-test.yml
-name: Reusable Test Workflow
-
-on:
-  workflow_call:
-    inputs:
-      node-version:
-        required: true
-        type: string
-    secrets:
-      NPM_TOKEN:
-        required: true
-
+    branches: [main]
+permissions:
+  contents: read
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-node@v4
-      with:
-        node-version: ${{ inputs.node-version }}
-    - run: npm ci
-    - run: npm test
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
+        with:
+          node-version: '22'
+          cache: npm
+      - run: npm ci
+      - run: npm test
 ```
 
-**Use reusable workflow:**
-```yaml
-jobs:
-  call-test:
-    uses: ./.github/workflows/reusable-test.yml
-    with:
-      node-version: '20.x'
-    secrets:
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-```
+## Matrix Builds
 
-## Security Scanning
+Add a matrix only for versions and operating systems the project supports. Keep dependencies reproducible, identify failing combinations, and avoid hiding failures with blanket continue-on-error. Test required-check behavior when jobs are conditionally skipped.
 
-```yaml
-name: Security Scan
+## Build and Publication
 
-on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
+Build an artifact from the tested commit and record its identity. Publication needs a separate trusted job with the minimum registry permission. Do not publish artifacts produced by arbitrary untrusted code in a privileged context; bind accepted artifacts to their exact source and producing workflow.
 
-jobs:
-  security:
-    runs-on: ubuntu-latest
+## Deployment
 
-    steps:
-    - uses: actions/checkout@v4
-
-    - name: Run Trivy vulnerability scanner
-      uses: aquasecurity/trivy-action@master
-      with:
-        scan-type: 'fs'
-        scan-ref: '.'
-        format: 'sarif'
-        output: 'trivy-results.sarif'
+Use the project's protected release path. Identify the immutable artifact, destination, workload identity, rollout and rollback checks before adding deployment commands. A named GitHub environment does not configure reviewers automatically. Verify its actual protections. Do not label a placeholder echo command as a successful deployment.
 
-    - name: Upload Trivy results to GitHub Security
-      uses: github/codeql-action/upload-sarif@v2
-      with:
-        sarif_file: 'trivy-results.sarif'
+## Verification
 
-    - name: Run Snyk Security Scan
-      uses: snyk/actions/node@master
-      env:
-        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-```
+Exercise one passing change and one deliberate test failure on a topic branch. Confirm the failing check prevents downstream publication. Inspect tokens, runner isolation, caches and artifact boundaries. Keep production credentials absent from untrusted validation jobs.
 
-## Deployment with Approvals
+## Example
 
-```yaml
-name: Deploy to Production
+A project needs Linux and Windows tests. Select its supported runtime, add the two runner combinations and confirm that either failure blocks the required result. Prepare publication separately; do not add registry credentials to the matrix.
 
-on:
-  push:
-    tags: [ 'v*' ]
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    environment:
-      name: production
-      url: https://app.example.com
-
-    steps:
-    - uses: actions/checkout@v4
-
-    - name: Deploy application
-      run: |
-        echo "Deploying to production..."
-        # Deployment commands here
-
-    - name: Notify Slack
-      if: success()
-      uses: slackapi/slack-github-action@v1
-      with:
-        webhook-url: ${{ secrets.SLACK_WEBHOOK }}
-        payload: |
-          {
-            "text": "Deployment to production completed successfully!"
-          }
-```
-
-## Reference Files
-
-- `assets/test-workflow.yml` - Testing workflow template
-- `assets/deploy-workflow.yml` - Deployment workflow template
-- `assets/matrix-build.yml` - Matrix build template
-- `references/common-workflows.md` - Common workflow patterns
+## Limitations
 
-## Related Skills
+This skill supplies patterns, not an installed deployment program. Repository policy, runner trust and environment settings must be inspected. Review every third-party action at its full commit SHA and treat logs and uploaded artifacts as possible data-exposure paths.
 
-- `gitlab-ci-patterns` - For GitLab CI workflows
-- `deployment-pipeline-design` - For pipeline architecture
-- `secrets-management` - For secrets handling
+## Sources
 
-## Limitations
-- Use this skill only when the task clearly matches the scope described above.
-- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
-- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
+- [GitHub secure workflow guidance](https://docs.github.com/en/actions/reference/security/secure-use)