---
name: repository-cicd-exposure-review
description: Review authorized repositories, configuration, history, workflows, and build artifacts for secret and supply-chain trust failures.
---

# Repository and CI exposure review

## Accepted inputs

- Authorized repository or exported source tree
- Workflow, build, deployment, artifact, and dependency configuration
- Current scope and secret-handling rules

Never run project code, workflow actions, hooks, or discovered binaries during intake.

## Procedure

1. Hash the source snapshot and inventory branches, history depth, submodules, packages, workflows, and artifact routes.
2. Search for credential shapes, private endpoints, signing material, debug configuration, and environment-variable flow.
3. Trace workflow triggers to permissions, checkout targets, untrusted inputs, secrets, runners, caches, and published artifacts.
4. Distinguish placeholders, revoked examples, test fixtures, and active-looking material.
5. Redact candidate secrets and record only a hash, type, location, and exposure path.
6. Use a documented placeholder or known test credential as a negative control for the classifier.

## Output artifacts

- Repository and workflow trust map
- Redacted exposure ledger
- Dependency and artifact publication risks
- Rotation or owner questions, without secret use

## Stop conditions

Do not validate credentials against any service, trigger workflows, publish artifacts, or access data beyond the supplied repository.

## Completion gate

Complete when every lead has provenance, a non-secret discriminator, a negative control, and a clear owner or rejection reason.