GitHub Actions Duplicate Run Audit

Detect duplicate GitHub Actions run bursts by workflow/branch/commit and quantify wasted rerun minutes.

Security Scan

The skill's code, instructions, and requirements are coherent with its stated purpose (auditing GitHub Actions run JSON files); it does not request credentials, install remote code, or perform network access.

Purpose & Capability

Name/description match the implementation: the script ingests GitHub Actions run JSON files, groups runs, clusters bursts, and computes wasted minutes. Requested binaries (bash, python3) are appropriate for the included shell wrapper + embedded Python logic.

Instruction Scope

SKILL.md instructs the user to collect GitHub run exports (example uses the 'gh' CLI) and run the bundled script against a JSON glob. The example 'gh run view ...' command is helpful but 'gh' is not listed in required binaries; this is a documentation mismatch (not a code-level issue). The runtime instructions limit activity to reading JSON files matched by RUN_GLOB and producing report output—there are no instructions to read other system files or send data externally.

Install Mechanism

No install spec (instruction-only with bundled script) — nothing is downloaded or written by an installer. The skill is delivered as a script and SKILL.md only.

Credentials

No credentials or sensitive environment variables are required. The script accepts many optional environment/config variables that control filtering and thresholds, which are proportional to the audit purpose.

Persistence & Privilege

The skill does not request permanent inclusion (always=false) and does not modify other skills or system-wide settings. It runs when invoked and exits with appropriate codes for pass/fail gating.

Assessment

This skill appears to do exactly what it says: it parses GitHub Actions run JSON files and reports duplicate-run bursts. Before running, ensure RUN_GLOB points only to JSON exports you trust (the script reads and parses those files but does not execute their contents). Note the SKILL.md examples use the GitHub CLI ('gh') to collect run JSONs—install 'gh' yourself if you plan to follow those examples, though it's not required by the script itself. No credentials or network calls are made by the script, and there is no installer that downloads remote code. If you need higher assurance, review the remainder of the script (the truncated tail) in your environment to confirm output formatting and exit behavior meet your needs.

Use this skill to detect accidental duplicate workflow execution bursts (for example trigger overlap, force-push storms, or retried dispatches) and measure wasted CI minutes.

What this skill does

• Reads GitHub Actions run JSON exports
• Groups runs by repository + workflow + branch + event + commit SHA
• Clusters bursts where runs happen inside a configurable time window
• Counts duplicate runs and estimates wasted runtime minutes
• Scores severity (ok, warn, critical) for CI hygiene enforcement
• Emits text or JSON for automation

Inputs

Optional:

• RUN_GLOB (default: artifacts/github-actions/*.json)
• TOP_N (default: 20)
• OUTPUT_FORMAT (text or json, default: text)
• DUPLICATE_WINDOW_MINUTES (default: 30)
• MIN_DUPLICATE_RUNS (default: 2)
• WARN_DUPLICATE_RUNS (default: 3)
• CRITICAL_DUPLICATE_RUNS (default: 6)
• WARN_WASTED_MINUTES (default: 20)
• CRITICAL_WASTED_MINUTES (default: 60)
• WORKFLOW_MATCH (regex, optional)
• WORKFLOW_EXCLUDE (regex, optional)
• BRANCH_MATCH (regex, optional)
• BRANCH_EXCLUDE (regex, optional)
• EVENT_MATCH (regex, optional)
• EVENT_EXCLUDE (regex, optional)
• REPO_MATCH (regex, optional)
• REPO_EXCLUDE (regex, optional)
• HEAD_SHA_MATCH (regex, optional)
• HEAD_SHA_EXCLUDE (regex, optional)
• FAIL_ON_CRITICAL (0 or 1, default: 0)

Collect run JSON

gh run view <run-id> --json databaseId,workflowName,event,conclusion,headBranch,headSha,createdAt,updatedAt,startedAt,url,repository \
  > artifacts/github-actions/run-<run-id>.json

Run

Text report:

RUN_GLOB='artifacts/github-actions/*.json' \
DUPLICATE_WINDOW_MINUTES=20 \
bash skills/github-actions-duplicate-run-audit/scripts/duplicate-run-audit.sh

JSON output + fail gate:

RUN_GLOB='artifacts/github-actions/*.json' \
OUTPUT_FORMAT=json \
FAIL_ON_CRITICAL=1 \
bash skills/github-actions-duplicate-run-audit/scripts/duplicate-run-audit.sh

Run against bundled fixtures:

RUN_GLOB='skills/github-actions-duplicate-run-audit/fixtures/*.json' \
bash skills/github-actions-duplicate-run-audit/scripts/duplicate-run-audit.sh

Output contract

• Exit 0 in report mode (default)
• Exit 1 when FAIL_ON_CRITICAL=1 and one or more groups are critical
• Text mode prints summary + ranked duplicate-run groups
• JSON mode prints summary + ranked groups + critical groups