ops-ci-fix — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ops-ci-fix (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Diagnose failing CI/CD pipelines, identify the root cause, and apply automatic fixes when safe.
# List recent runs
gh run list --limit 20 --json databaseId,status,conclusion,name,createdAt,headBranch
# Identify workflow files
ls -la .github/workflows/| State | Criterion | Urgency |
|---|---|---|
| Failed | conclusion = failure | High |
| Stuck | status = in_progress for > 30 min | High |
| Cancelled | conclusion = cancelled (recurring) | Medium |
| Stale | No successful run for 7+ days | Low |
# Runner status
gh api repos/{owner}/{repo}/actions/runners --jq '.runners[] | {name, status, busy}'For each failing workflow:
# Logs of the failed run
gh run view <run-id> --log-failed| Category | Patterns in logs | Typical fix |
|---|---|---|
| Test failure | FAIL, AssertionError, expect( | Fix the test or the code |
| Build error | error TS, SyntaxError, cannot find | Fix the compilation error |
| Dep install | npm ERR!, ERESOLVE, peer dep | Fix package.json / lockfile |
| Auth/secrets | 401, 403, secret not found | Check the configured secrets |
| Timeout | timed out, exceeded deadline | Increase timeout or optimize |
| Disk space | no space left, ENOSPC | Clean caches / reduce artifacts |
| Rate limit | rate limit, 429 | Add retry / space out the requests |
| Runner offline | no runner matching, offline | Check self-hosted runners |
| Flaky test | Sometimes passes, sometimes fails | Identify the flaky test, stabilize it |
| Config error | invalid workflow, syntax error | Fix the workflow YAML |
# Reproduce locally
npm test # or pytest, go test, etc.
npm run build
npm run lintIf it passes locally but fails in CI: environment issue (versions, secrets, cache).
gh run rerun <run-id>.github/workflows/rm -rf node_modules package-lock.json && npm installgh run cancel <run-id>IMPORTANT: In --dry-run mode, show the proposed actions WITHOUT executing them.
| Action | Safe | Confirmation required |
|---|---|---|
| Re-run a workflow | Yes | No |
| Cancel a stuck run | Yes | No |
| Fix workflow YAML | Medium | Show the diff first |
| Regenerate lockfile | Medium | Show the diff first |
| Modify source code | Risky | Yes — propose, do not apply without approval |
| Modify secrets | Risky | Never — guide the user |
For each applicable fix:
After the fixes:
# Check that tests pass locally
npm test && npm run build && npm run lint
# If a workflow was re-run, check its status
gh run view <run-id> --json status,conclusion# CI Fix Report — YYYY-MM-DD
## Workflows analyzed
| Workflow | Branch | Status before | Cause | Action | Status after |
|----------|---------|-------------|-------|--------|-------------|
| ci.yml | main | Failed | Test failure | Fix test | Passing |
| deploy.yml | main | Stuck | Timeout | Cancel + re-run | In progress |
## Fixes applied
1. [Fix 1]: description, modified file, reason
2. [Fix 2]: ...
## Manual actions required
- [ ] Configure the `DEPLOY_TOKEN` secret (expired)
- [ ] Update the self-hosted runner v2.x → v3.x
## Recommendations
- Add a cache for npm ci (would reduce time by 3 min)
- The `auth.spec.ts` test is flaky (3 failures out of 10 runs)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.