simplify-and-harden-ci — Claude Code skill: PR review in CI

What simplify-and-harden-ci does

This skill runs a CI-only flavor of Simplify & Harden with no interactive approvals. It looks at the files a pull request touches and leaves the code alone — the output is a report, not a patch. Three passes run: simplify, harden, document. The first flags dead code, unclear names and needless abstraction; the second looks for missing input validation, injection paths, auth problems, exposed secrets and concurrency hazards; the third suggests comments for logic that is hard to follow.

Findings land in a PR comment, a check run summary and a YAML artifact keyed simplify_and_harden. Gate policy is yours to set: critical harden findings fail the check, and advisory classes can be made blocking too. A CI agent lacks the context of whoever wrote the change, so ambiguous findings belong in human review rather than an automatic rewrite.

You need GitHub Actions turned on, an authenticated GitHub CLI (gh auth status) and the gh-aw extension, added with gh extension install github/gh-aw. Inside jobs the CLI comes from the github/gh-aw/actions/setup-cli@main step at version v0.2.0-beta. The template sits in references/workflow-example.md and stays out of .github/workflows until you want automation live: a gh-aw workflow is markdown that gh aw compile turns into the .lock.yml GitHub Actions runs. Skip gh aw compile --validate --strict and there is nothing for Actions to execute.