Workflows should set the default shell to 'pwsh' or 'bash' ensure same functionality on all platforms, unless there are no run steps: > .github/workflows/ci.yml - Job 'build' does not have a default shell defined at the workflow or job level. > .github/workflows/release.yml - Job 'release' does not have a default shell defined at the workflow or job level. > .github/workflows/approve-dependencies.yml - Job 'dependabot' does not have a default shell defined at the workflow or job level.

Early check for secrets when CI workflow uses secrets: > .github/workflows/ci.yml - Job 'build' is part of a workflow that uses secrets but does not check for presence of secrets as a first step. See https://github.com/Particular/Platform/blob/main/guidelines/github-actions/annotated-workflows.md#secrets