GitHub Actions Rerun Effectiveness Audit

Audit GitHub Actions rerun dependency and success-after-rerun effectiveness to highlight workflows wasting CI time.

Security Scan

The skill does what it claims (analyzes GitHub Actions run JSON files locally) and its requirements are proportionate; the only minor mismatch is the SKILL.md demonstrates using the GitHub CLI (gh) but the declared required binaries do not list it.

Purpose & Capability

The skill's name/description (audit reruns) matches the included script and SKILL.md: it only processes exported GitHub Actions run JSON files and computes rerun metrics. Minor inconsistency: SKILL.md shows collecting runs with the 'gh' CLI (gh run view) but the declared required binaries list only bash and python3 — 'gh' is not declared even though the docs reference it.

Instruction Scope

Runtime instructions and the script operate on local JSON files matched by RUN_GLOB, apply filters, compute metrics, and print JSON/text output or set exit codes. The instructions do not direct data to external endpoints or attempt to read unrelated system config. Note: using the suggested 'gh' command to create the JSON files would invoke network access to GitHub and require a separate gh auth/token, which the skill does not request or manage.

Install Mechanism

No install spec is provided (instruction + shipped script only). Nothing is downloaded or written by an installer; the execution footprint is limited to running the included bash/python script locally.

Credentials

The skill declares no required credentials or config paths. It accepts many optional environment inputs (filters, thresholds, glob) which are reasonable for an analysis tool and do not include secrets. There is no attempt to read environment variables beyond the documented inputs.

Persistence & Privilege

always is false and the skill does not request persistent system-wide privileges or modify other skills. It simply runs locally and exits (optionally returning non-zero when FAIL_ON_CRITICAL is set).

Assessment

This skill appears coherent and runs entirely on local GitHub Actions run JSON exports. Before running: (1) review the JSON files matched by RUN_GLOB to ensure they contain only data you want processed; (2) if you follow the SKILL.md example using the 'gh' CLI to export runs, make sure you have gh installed and authenticated — the skill does not declare or manage gh nor request GitHub credentials; (3) be aware FAIL_ON_CRITICAL=1 will cause a non-zero exit code suitable for CI gating; (4) if you need to run this in an environment without gh, generate/export the run JSONs by other means and point RUN_GLOB at them.

Use this skill to measure how often workflows require reruns and whether reruns are actually recovering failures.

What this skill does

• Reads GitHub Actions run JSON exports
• Tracks rerun episodes using workflow run id + attempt history
• Measures rerun rate, rerun success rate, and extra rerun attempts
• Estimates wasted rerun minutes from attempt durations
• Emits severity (ok, warn, critical) for CI policy gates

Inputs

Optional:

• RUN_GLOB (default: artifacts/github-actions/*.json)
• TOP_N (default: 20)
• OUTPUT_FORMAT (text or json, default: text)
• GROUP_BY (workflow or workflow-branch, default: workflow)
• FAILURE_CONCLUSIONS (comma-separated, default: failure,cancelled,timed_out,startup_failure,action_required)
• SUCCESS_CONCLUSIONS (comma-separated, default: success)
• MIN_RUNS (minimum workflow runs required, default: 4)
• WARN_RERUN_RATE (0..1, default: 0.2)
• CRITICAL_RERUN_RATE (0..1, default: 0.35)
• WARN_RERUN_SUCCESS_RATE (0..1, default: 0.5)
• CRITICAL_RERUN_SUCCESS_RATE (0..1, default: 0.25)
• WARN_WASTED_MINUTES (default: 20)
• CRITICAL_WASTED_MINUTES (default: 60)
• WORKFLOW_MATCH / WORKFLOW_EXCLUDE (regex, optional)
• BRANCH_MATCH / BRANCH_EXCLUDE (regex, optional)
• EVENT_MATCH / EVENT_EXCLUDE (regex, optional)
• REPO_MATCH / REPO_EXCLUDE (regex, optional)
• ACTOR_MATCH / ACTOR_EXCLUDE (regex, optional)
• FAIL_ON_CRITICAL (0 or 1, default: 0)

Collect run JSON

gh run view <run-id> --attempt <attempt> \
  --json databaseId,runAttempt,workflowName,event,headBranch,headSha,conclusion,createdAt,updatedAt,runStartedAt,url,repository,actor,triggeringActor \
  > artifacts/github-actions/run-<run-id>-attempt-<attempt>.json

Run

Text report:

RUN_GLOB='artifacts/github-actions/*.json' \
bash skills/github-actions-rerun-effectiveness-audit/scripts/rerun-effectiveness-audit.sh

JSON output + fail gate:

RUN_GLOB='artifacts/github-actions/*.json' \
OUTPUT_FORMAT=json \
FAIL_ON_CRITICAL=1 \
bash skills/github-actions-rerun-effectiveness-audit/scripts/rerun-effectiveness-audit.sh

Run against bundled fixtures:

RUN_GLOB='skills/github-actions-rerun-effectiveness-audit/fixtures/*.json' \
bash skills/github-actions-rerun-effectiveness-audit/scripts/rerun-effectiveness-audit.sh

Output contract

• Exit 0 in report mode (default)
• Exit 1 when FAIL_ON_CRITICAL=1 and one or more groups are critical
• Text mode prints summary + ranked workflow groups
• JSON mode prints summary + ranked groups + critical groups