ghas-config-reviewerlisted

Audit a GitHub repo or org's GitHub Advanced Security configuration against the org's baseline. Checks code scanning enablement, secret scanning + push protection, Dependabot alerts + version updates, dependency review, branch protection requiring GHAS checks, and CODEOWNERS hygiene. Uses `gh api` for live inspection of a target repo or org; falls back to documented baseline check items the user can run manually. Produces a structured finding list with severity, current vs expected state, and remediation steps. Use when the user asks to audit or review a repo's or org's GitHub Advanced Security (GHAS) configuration — code scanning, secret scanning + push protection, Dependabot, dependency review, branch protection — during repo onboarding, periodic GHAS audits, or before a stakeholder review of GHAS posture. This owns "is code scanning / secret scanning / push protection / Dependabot enabled?" questions at **repo or org** level. For researching how a single GHAS feature works use ghas-feature-research; for no
themarmack/research-bot · ★ 0 · AI & Automation · score 68

Install: claude install-skill themarmack/research-bot

# ghas-config-reviewer A Category 3 ops tool. The user runs this against a repo (or org) and gets a structured posture report: what's configured, what's missing relative to the baseline, what's misconfigured. ## When to use - New-repo onboarding review. - Periodic sweep across the org's important repos (high-blast-radius, regulated-data-handling, etc.). - Before stakeholder reviews of GHAS posture (legal, audit, security architecture). - Validating that an exception expired and the baseline is now enforced. ## When NOT to use - Workflow-level review → `actions-workflow-hardener`. - Repository-level governance beyond GHAS (CODEOWNERS specifics, ruleset patterns) → [`repo-golden-path-scorer`](../repo-golden-path-scorer/SKILL.md). - Investigating a specific CodeQL alert → that's CodeQL triage, not configuration review. ## Baseline (the org's expected state) This is the documented expected state for a "fully GHAS-onboarded" repo in the org. Deviations get flagged. ### Code scanning | Setting | Expected | Severity if missing | |---------|----------|---------------------| | Code scanning enabled | yes | CRITICAL | | Setup mode | default OR advanced (org policy permits both) | INFO | | Default queries plus security-extended | yes | HIGH | | Custom CodeQL pack from the org | yes (for in-scope languages) | MEDIUM | | Code scanning required on PR before merge | yes | HIGH | | Workflow files scanned (advanced setup) | yes | MEDIUM | ### Secret scanning | Setting | Expected |