GitHub Actions Failure Streak Audit

Detect consecutive GitHub Actions failure streaks by repo/workflow/branch to prioritize unstable pipelines.

Security Scan

The skill largely matches its stated purpose (analyze GitHub Actions run JSON files) but there are mismatches and a partial file disclosure that prevent a full safety review—notably the SKILL.md expects the `gh` CLI but the declared requirements do not, and the provided script content is truncated so the entire behavior wasn't verifiable.

Purpose & Capability

Name/description align with the included script: it parses GitHub Actions run JSON, groups by repo/workflow/branch, and reports failure streaks. However SKILL.md and examples rely on the `gh` CLI to collect JSON (gh run view), but the declared required binaries list only bash and python3—`gh` is not declared. This is an inconsistency the author should clarify.

Instruction Scope

Instructions and the script operate on local JSON files matched by RUN_GLOB and will read any file the glob matches. That is expected for this task, but it means a malicious or mistaken RUN_GLOB could expose sensitive JSON. The SKILL.md instructs use of `gh run view` (network call to GitHub) which requires user GitHub auth/config; the skill does not declare or request GitHub credentials explicitly. Also, the provided script content in the submission was truncated mid-file so the tail of its behavior (final output, any further processing, or hidden network calls) could not be inspected.

Install Mechanism

No install spec; this is instruction-only with a bundled script. That minimizes install-time risk (nothing is downloaded or executed from external URLs as part of install).

Credentials

The skill does not request credentials or environment variables as required fields. It uses a number of optional environment inputs (RUN_GLOB, WORKFLOW_MATCH, etc.) which is appropriate, but because `gh` is used in examples it will implicitly rely on the user's GitHub CLI auth (GH_TOKEN or gh auth) outside the skill. The script will read whatever files RUN_GLOB points to, so granting it access to directories with secrets would be risky.

Persistence & Privilege

Skill does not request permanent presence (always: false), does not modify other skills or system configuration. It runs as a one-off script and does not persist credentials or enable itself automatically.

What to consider before installing

Before installing/using: 1) Confirm the full script (the bundle you will run) — the copy provided here was truncated and the tail could not be reviewed; don't run it until you can inspect the entire file. 2) Ensure you have the `gh` CLI installed and authenticated (the SKILL.md examples call `gh run view`). 3) Be careful what you set RUN_GLOB to: the script will open any files matched by that glob, so do not point it at directories that may contain secrets or unrelated JSON. 4) Run initially against the included fixtures (or a small controlled sample) to verify behavior and output format. 5) If you need stronger assurance, ask the author to (a) declare `gh` as a required binary in metadata, (b) provide the complete script for review, and (c) confirm there are no outbound network calls beyond those made by the user-run `gh` CLI.

Use this skill to find repeated CI failures before they become delivery bottlenecks.

What this skill does

• Reads GitHub Actions run JSON exports (gh run view --json ...)
• Groups runs by repo + workflow + branch
• Detects consecutive failure streaks (failure, cancelled, timed_out)
• Scores severity by streak length and impacted runtime minutes
• Surfaces longest unresolved streaks first

Inputs

Optional:

• RUN_GLOB (default: artifacts/github-actions/*.json)
• TOP_N (default: 20)
• OUTPUT_FORMAT (text or json, default: text)
• WARN_STREAK (default: 2)
• CRITICAL_STREAK (default: 4)
• FAIL_ON_CRITICAL (0 or 1, default: 0)
• WORKFLOW_MATCH, WORKFLOW_EXCLUDE (regex, optional)
• REPO_MATCH, REPO_EXCLUDE (regex, optional)
• BRANCH_MATCH, BRANCH_EXCLUDE (regex, optional)

Collect run JSON

gh run view <run-id> --json databaseId,workflowName,headBranch,headSha,createdAt,updatedAt,conclusion,url,repository,jobs \
  > artifacts/github-actions/run-<run-id>.json

Run

Text report:

RUN_GLOB='artifacts/github-actions/*.json' \
WARN_STREAK=2 \
CRITICAL_STREAK=4 \
bash skills/github-actions-failure-streak-audit/scripts/failure-streak-audit.sh

JSON output + fail gate:

RUN_GLOB='artifacts/github-actions/*.json' \
OUTPUT_FORMAT=json \
FAIL_ON_CRITICAL=1 \
bash skills/github-actions-failure-streak-audit/scripts/failure-streak-audit.sh

Run with bundled fixtures:

RUN_GLOB='skills/github-actions-failure-streak-audit/fixtures/*.json' \
bash skills/github-actions-failure-streak-audit/scripts/failure-streak-audit.sh

Output contract

• Exit 0 in reporting mode
• Exit 1 when FAIL_ON_CRITICAL=1 and critical streaks exist
• Text output includes grouped streak totals and ranked hotspots
• JSON output includes summary, streaks, and critical_streaks