Scope and output
Know exactly what is being reviewed.
One public GitHub repository and its checked-in CI/release configuration.
- GitHub Actions and release-flow findings
- Permissions, secrets, and token-boundary review
- Dependency and package-publishing risk review
- Versioning, provenance, rollback, and recovery assessment
- Prioritized fixes with verification steps
- Price
- $129 USDC or the signed exact-ETH alternative
- Delivery target
- 2 business days after confirmed payment
- Boundary
- The review covers checked-in configuration and public workflow evidence. Private logs, organization settings, registries, and signing systems are outside scope unless separately authorized.
Decision questions
The report is built to answer these.
- Are workflow permissions and secret boundaries narrower than the job requires?
- Can package publication prove where the artifact came from?
- What happens when publishing fails after versioning or tagging?
- Can the team roll back or recover without improvising in production?
Good fit
Who should buy this review?
- Maintainers preparing an npm or GitHub release
- Teams migrating to Trusted Publishing or provenance
- Projects with brittle CI permissions or secret handling
- Owners who cannot confidently describe their rollback path
Direct answers
Questions before ordering
What does the Release Pipeline Review cover?
It reviews one public GitHub repository and its checked-in CI and release configuration, including GitHub Actions, permissions, secrets, package publishing, versioning, provenance, rollback, and recovery.
Can you inspect private organization or registry settings?
Not through the standard checkout. Private logs, organization settings, registry administration, credentials, and signing systems require separate authorization and access.
Will the review run or modify my release?
No. The standard review is read-only and based on checked-in configuration plus public workflow evidence. It does not publish packages or mutate production.
What does the report contain?
The report identifies concrete release risks, explains their impact, and provides prioritized fixes with verification steps rather than a generic maturity score.
How much does it cost and how fast is delivery?
The fixed price is $129 USDC or the signed exact-ETH alternative, with a two-business-day delivery target after confirmed payment.
Compare scope
Other KnownFix reviews
Start with a bounded question.
Choose this review only when its published scope matches the decision you need to make. The order target and notes remain private unless you explicitly publish the target.