GitHub Actions Failure Spike Audit

Detect sudden GitHub Actions failure-rate spikes by workflow group using recent-vs-baseline run windows.

Security Scan

The skill's code and instructions match its stated purpose (analyzing GitHub Actions run JSONs for failure-rate spikes); it requires only bash/python3, reads local JSON artifacts, and does not request secrets or perform network exfiltration.

Purpose & Capability

The skill claims to analyze GitHub Actions run JSON exports and the included script implements grouping, baseline/recent splits, failure-rate math, and reporting. Required binaries (bash, python3) are appropriate for the bundled shell+Python implementation.

Instruction Scope

Runtime instructions ask the user to collect run JSONs (example shows using the GitHub CLI `gh run view`) and then run the provided script against local JSON artifacts. The example references the `gh` CLI but `gh` is not listed as a required binary — this is a minor documentation mismatch (the script itself does not invoke `gh`). The script reads only files matched by RUN_GLOB and does not contact external endpoints.

Install Mechanism

This is instruction-only (no install spec). The code is bundled as a shell script that runs an embedded Python program; nothing is downloaded or written during install.

Credentials

No environment secrets or config paths are required. The script supports many optional environment variables for filtering and thresholds — these are proportionate to the skill's functionality and are not sensitive credentials. Note: if you use the `gh` CLI example to collect JSON, that CLI may require GitHub credentials (not part of this skill).

Persistence & Privilege

The skill does not request persistent/global privileges, does not set always:true, and does not modify other skills or system settings. It runs on-demand against local artifact files.

Assessment

This skill appears coherent and implements what it advertises: it reads local GitHub Actions run JSON files and reports failure-rate spikes. Before running it, confirm the RUN_GLOB path only matches the intended JSON artifacts (so you don't accidentally feed it unrelated local files). If you plan to use the SKILL.md's `gh run view` example, remember the GitHub CLI (gh) is not listed as a required binary and may need a GitHub token or login; that credential is for gh itself and is not requested by this skill. Finally, review the full script contents in your distribution (the provided file was partially shown) to ensure behavior and output formatting meet your needs.

Use this skill to catch workflows that recently degraded (new flaky tests, broken deploy gates, bad dependency updates, or infra outages) before they become long-running incidents.

What this skill does

• Reads GitHub Actions run JSON exports
• Groups by repository + workflow + branch + event
• Splits each group into recent runs and baseline history
• Compares recent failure rate to baseline failure rate
• Scores severity (ok, warn, critical) using spike + recent failure rate gates
• Emits text or JSON output for CI automation

Inputs

Optional:

• RUN_GLOB (default: artifacts/github-actions/*.json)
• TOP_N (default: 20)
• OUTPUT_FORMAT (text or json, default: text)
• RECENT_RUNS (default: 4)
• MIN_RECENT_RUNS (default: 3)
• MIN_BASELINE_RUNS (default: 4)
• WARN_SPIKE_PCT (default: 15)
• CRITICAL_SPIKE_PCT (default: 30)
• WARN_RECENT_FAILURE_RATE (default: 25)
• CRITICAL_RECENT_FAILURE_RATE (default: 45)
• WORKFLOW_MATCH (regex, optional)
• WORKFLOW_EXCLUDE (regex, optional)
• BRANCH_MATCH (regex, optional)
• BRANCH_EXCLUDE (regex, optional)
• EVENT_MATCH (regex, optional)
• EVENT_EXCLUDE (regex, optional)
• REPO_MATCH (regex, optional)
• REPO_EXCLUDE (regex, optional)
• FAIL_ON_CRITICAL (0 or 1, default: 0)

Collect run JSON

gh run view <run-id> --json databaseId,workflowName,event,conclusion,headBranch,headSha,createdAt,updatedAt,startedAt,url,repository \
  > artifacts/github-actions/run-<run-id>.json

Run

Text report:

RUN_GLOB='artifacts/github-actions/*.json' \
RECENT_RUNS=8 \
WARN_SPIKE_PCT=12 \
bash skills/github-actions-failure-spike-audit/scripts/failure-spike-audit.sh

JSON output + fail gate:

RUN_GLOB='artifacts/github-actions/*.json' \
OUTPUT_FORMAT=json \
FAIL_ON_CRITICAL=1 \
bash skills/github-actions-failure-spike-audit/scripts/failure-spike-audit.sh

Run against bundled fixtures:

RUN_GLOB='skills/github-actions-failure-spike-audit/fixtures/*.json' \
bash skills/github-actions-failure-spike-audit/scripts/failure-spike-audit.sh

Output contract

• Exit 0 in report mode (default)
• Exit 1 when FAIL_ON_CRITICAL=1 and one or more groups are critical
• Text mode prints summary + ranked failure-rate spike groups
• JSON mode prints summary + ranked groups + critical groups