Table of Contents

• The thing I did not want to do
• Enter gh-aw
• Five workflows, one that runs itself
• How a run is wired
• The workflow file, in full
• PR #8: a hidden proxy endpoint
• What the run looked like
• The review it posted
• A finding is a challenge, not a verdict
  • The rate-limiter that is not a bug
  • The blocklist claim that is wrong in a detail
  • The firewall that fails silently
• Asking it to fix something, without letting it
• Pairing it with cybersecurity skills
  • How the agent picks its skills
• What the framework gets right
• Security considerations
  • The trust boundary, drawn
  • The prompt-injection threat model
  • Turning it off
• Cost and observability
• Conclusion
• Reflections
  • Why an LLM here, and not just more CI
  • The gaps that still bother me
  • What is still missing

Well, here we are: I wanted a second reviewer on every pull request, a sanity pass on every failed pipeline, and a monthly security sweep, and I was not willing to hand a language model a write token to get any of it.