GitHub Actions Branch Drift Audit

Detect branch-level GitHub Actions reliability drift by comparing failure and runtime deltas against a mainline baseline.

Security Scan

The skill's files and runtime instructions match its stated purpose (auditing GitHub Actions run JSONs) and do not request unrelated credentials or perform suspicious network or file-exfiltration actions.

Purpose & Capability

The skill's name/description match what the code does: it reads GitHub Actions run JSONs, aggregates by repo/workflow/branch, and reports drift. One minor mismatch: SKILL.md demonstrates collecting run JSON using the GitHub CLI (gh run view ...), but the declared required binaries list only bash and python3 — 'gh' is not listed even though it's used in the documented collection step. This is a documentation/metadata omission, not an indication of malicious behavior.

Instruction Scope

SKILL.md and the script limit activity to reading local JSON files (RUN_GLOB), parsing fields, computing stats, and printing text/JSON reports. The instructions do not ask the agent to read arbitrary system files, access unrelated environment variables, or send data to external endpoints. The only external interaction shown is the suggested use of the 'gh' CLI to produce the input files.

Install Mechanism

This is an instruction-only skill with a single shell script; there is no install spec, no downloads, and no archives extracted. No install-related risk was detected.

Credentials

The skill declares no required environment variables or credentials, which is proportionate to its stated offline analysis purpose. Practical note: using the documented 'gh run view' command requires the GitHub CLI and appropriate GH authentication (token/session) if run, but the skill itself does not request or store credentials. The absence of 'gh' in required binaries and no mention of needing GH auth should be corrected in metadata/documentation.

Persistence & Privilege

The skill does not request persistent presence (always: false) nor attempts to modify other skills or system-wide settings. It runs as a local script and exits; nothing indicates escalation of privilege or background persistence.

Assessment

This skill appears coherent and local: it reads GitHub Actions run JSON files and produces reports; it does not request secrets or phone home. Before installing or running: (1) note that SKILL.md shows using the GitHub CLI ('gh') to export runs — ensure you have 'gh' installed and authenticated if you plan to collect live run JSONs; the skill's metadata only lists bash and python3, so update metadata or ensure gh is present. (2) Confirm the RUN_GLOB path points only at intended artifacts (avoid matching any sensitive files). (3) Review/approve use of FAIL_ON_CRITICAL in CI (it causes nonzero exit). (4) If you need broader assurance, inspect the full, untruncated script to confirm no hidden behavior. Overall this skill is internally consistent and low-risk for the described offline audit use case.

Use this skill to catch branch-specific CI reliability regressions before they spread into your mainline release flow.

What this skill does

• Reads GitHub Actions run JSON exports
• Groups runs by repository + workflow + branch
• Selects a baseline branch per repository/workflow (defaults to main|master)
• Compares each non-baseline branch against that baseline on:
  • failure-rate drift (percentage points)
  • average runtime drift (ratio)
• Flags warning/critical drift severity and supports CI fail gates
• Emits text or JSON output for pipeline checks and triage dashboards

Inputs

Optional:

• RUN_GLOB (default: artifacts/github-actions/*.json)
• TOP_N (default: 20)
• OUTPUT_FORMAT (text or json, default: text)
• MIN_RUNS_PER_BRANCH (default: 2)
• MIN_BRANCHES (default: 2)
• BASELINE_BRANCH_MATCH (default: ^(main|master)$)
• WORKFLOW_MATCH (regex, optional)
• WORKFLOW_EXCLUDE (regex, optional)
• REPO_MATCH (regex, optional)
• REPO_EXCLUDE (regex, optional)
• FAILURE_DRIFT_WARN_PP (default: 10)
• FAILURE_DRIFT_CRITICAL_PP (default: 25)
• RUNTIME_DRIFT_WARN_RATIO (default: 1.25)
• RUNTIME_DRIFT_CRITICAL_RATIO (default: 1.6)
• FAIL_ON_CRITICAL (0 or 1, default: 0)

Collect run JSON

gh run view <run-id> --json databaseId,workflowName,event,conclusion,headBranch,headSha,createdAt,updatedAt,startedAt,url,repository \
  > artifacts/github-actions/run-<run-id>.json

Run

Text report:

RUN_GLOB='artifacts/github-actions/*.json' \
BASELINE_BRANCH_MATCH='^(main|release/.*)$' \
MIN_RUNS_PER_BRANCH=3 \
bash skills/github-actions-branch-drift-audit/scripts/branch-drift-audit.sh

JSON output with fail gate:

RUN_GLOB='artifacts/github-actions/*.json' \
OUTPUT_FORMAT=json \
FAIL_ON_CRITICAL=1 \
bash skills/github-actions-branch-drift-audit/scripts/branch-drift-audit.sh

Run with bundled fixtures:

RUN_GLOB='skills/github-actions-branch-drift-audit/fixtures/*.json' \
bash skills/github-actions-branch-drift-audit/scripts/branch-drift-audit.sh

Output contract

• Exit 0 in report mode (default)
• Exit 1 when FAIL_ON_CRITICAL=1 and one or more drift rows are critical
• Text mode prints summary + ranked branch drift rows
• JSON mode prints summary + drift rows + critical-only slice