ci-status — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ci-status (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Monitor the GitHub Actions CI pipeline for the current branch. A feature is not done until CI passes.
BRANCH=$(git branch --show-current)
SHA=$(git rev-parse --short HEAD)
echo "Branch: $BRANCH | Commit: $SHA"gh api "repos/ryaneggz/open-harness/actions/runs?branch=$BRANCH&per_page=1" \
--jq '.workflow_runs[0] | {id: .id, status: .status, conclusion: .conclusion, head_sha: .head_sha[:7], name: .name}'RUN_ID=<id from step 2>
for i in $(seq 1 20); do
STATUS=$(gh api "repos/ryaneggz/open-harness/actions/runs/$RUN_ID" --jq '.status')
if [ "$STATUS" = "completed" ]; then
break
fi
echo "Still running... ($i/20)"
sleep 15
donegh api "repos/ryaneggz/open-harness/actions/runs/$RUN_ID" \
--jq '{status: .status, conclusion: .conclusion, url: .html_url}'# Get the failed job ID
JOB_ID=$(gh api "repos/ryaneggz/open-harness/actions/runs/$RUN_ID/jobs" \
--jq '.jobs[] | select(.conclusion == "failure") | .id')
# Get the failure context (15 lines before the error)
gh api "repos/ryaneggz/open-harness/actions/jobs/$JOB_ID/logs" 2>&1 \
| grep -B 15 "Process completed with exit code" | head -25/ci-status againon: filter matched the push. This repo's CI is mostly PATH-filtered, not branch-filtered:ci-harness.yml — push only: packages/**, package.json, pnpm-lock.yaml, pnpm-workspace.yaml, itselfdocs.yml — PR or push-to-main: docs/**, apps/docs/**, blog/**, itselfconciseness.yml — push or PR: workspace/*.md, workspace/.claude/rules/*.md, itselfrelease.yml — tag push onlyInfrastructure-only PRs (devcontainer/scripts/install/) trigger NOTHING on push — that's expected. pull_request-event workflows still fire when the PR opens. Diagnose with: git diff --name-only HEAD~1 HEAD and compare against each workflow's on: block.
This project's CI (CI: Harness) runs these steps in order:
pnpm run lint)pnpm run format:check)pnpm run type-check)pnpm exec prisma generate)npx prisma migrate deploy)pnpm run build)pnpm test)pnpm run test:e2e)Before pushing, you can run the same checks locally to catch issues early:
pnpm -r run lint && pnpm -r run format:check && pnpm -r run build && pnpm -r run test~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.