ci — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ci (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
why-no-hook: skill workflow guidance; each step requires understanding the surrounding context (repo, task shape, prior state).
.gitlab-ci.yml -> glab, .github/ -> gh (review-time: see section note)(review-time: see section note)bash scripts/gh-ci-monitor.sh, resolved inside this skill's own directory (review-time: see section note)bash scripts/glab-ci-monitor.sh, resolved inside this skill's own directory (review-time: see section note)timeout_ms: 1800000, the Monitor maximum of 30 minutes (review-time: see section note)(review-time: see section note)(review-time: see section note)completed|* status: re-arm the same script, since CI pipelines can outlast 30 minutes. The restarted script re-emits the current status (review-time: see section note)no-runs|<branch>: no CI runs found for this branch - inform the user and stop (review-time: see section note)error|persistent-failure: the monitor script hit 5 consecutive errors - report and stop (review-time: see section note)in_progress|null → completed|success): acknowledge briefly (review-time: see section note)completed|success): (review-time: see section note)~/.agents/scripts/notify.sh "CI passed - <branch-name>" (review-time: see section note)(review-time: see section note)completed|manual, GitLab only): (review-time: see section note)(review-time: see section note)~/.agents/scripts/notify.sh "CI awaiting manual action - <branch-name>" (review-time: see section note)(review-time: see section note)completed|failure or any non-success conclusion): (review-time: see section note)a. Fetch the job log:
glab ci trace <job-id> (review-time: see section note)gh run view <run-id> --log-failed (review-time: see section note)b. Do NOT pipe output through head, tail, grep, or any other command - run the commands directly c. Analyze the root cause - identify the specific failure (test, lint, type check, build, coverage, etc.) d. Classify the failure as transient or real before proposing any change - transient = infra outage, rate limit, queued/timed-out runner, auth/network flake, registry or dependency propagation delay; real = a test/lint/type/build/coverage failure caused by the code under change. State the classification (review-time: see section note) e. If transient: re-run the failed job (gh run rerun <run-id> --failed / glab ci retry <job-id>) and keep monitoring - do NOT edit code for a transient failure. Escalate to the user only if it recurs after a re-run (review-time: see section note) f. Run ~/.agents/scripts/notify.sh "CI failed - <failure-summary>" g. If real, fix it: make the change, run npm run verify:fast when package.json declares it, otherwise /verify-done. Commit, push, and keep monitoring. The push hook runs the fast gate again (review-time: see section note) h. Before `gh pr ready`: with a declared verify, the hook needs <git-dir>/verify-passed equal to HEAD. Run npm run verify once if it is not (review-time: see section note) i. Report what failed and what changed in the same message as the next action (review-time: see section note)
The monitor scripts poll CI status every 30 seconds but only emit a line when the status changes. This means:
(review-time: see section note)(review-time: see section note)(review-time: see section note)gh/glab fails 5 times in a row (auth expired, network down), the script exits with an error notification (review-time: see section note)These commands require a TTY and will NOT work - never use them:
glab ci view (interactive TUI) (review-time: see section note)gh run watch (interactive watcher) (review-time: see section note)--web flag (opens browser) (review-time: see section note)Safe commands to use:
glab ci status, glab ci list, glab ci trace <job-id> (review-time: see section note)gh pr checks, gh run list, gh run view <run-id> --log-failed (review-time: see section note)(review-time: see section note)(review-time: see section note)--no-verify or skip hooks (review-time: see section note)(review-time: see section note)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.