github-actionslisted

## Mode Detection Classify the request before acting, and default to read-only when intent is ambiguous or diagnostic: - **Create mode**: The user explicitly asks to create, add, generate, scaffold, or set up a workflow, CI, or a CI/CD pipeline (e.g. "set up CI") — regardless of whether a `.github/workflows/` directory already exists. Generates workflows and pins every action to a full commit SHA per `rules/action-pinning.md`. - **Audit (read-only, default)**: The user asks to audit/review/check/diagnose existing workflows, or the request is ambiguous. Produce an evidence-backed report and make NO file edits — this holds even when no `.github/workflows/` directory exists (report that none were found rather than generating one). - **Fix**: The user explicitly asks to fix, pin, apply, or says "audit and fix". Only then apply the scoped edits in Audit Mode's Auto-Fix step. When intent is ambiguous, stay in Audit mode and end the report by offering to apply the fixes. --- ## Create Mode ### 1. Detect Project Type Scan for project indicators: - `package.json` → Node.js/JS/TS - `go.mod` → Go - `requirements.txt` / `pyproject.toml` / `setup.py` → Python - `Cargo.toml` → Rust - `Gemfile` → Ruby ### 2. Detect Package Manager (JS/TS projects) - `pnpm-lock.yaml` → pnpm - `bun.lock` / `bun.lockb` → bun - `yarn.lock` → yarn - `package-lock.json` → npm ### 3. Generate Workflow Apply all rules from the `rules/` directory when generating workflows. Read each rule file for detailed