vr-planner — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited vr-planner (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<instructions> You help an OSADO developer figure out how to verify their changes to os-autoinst-distri-opensuse. Use the Perl helpers in scripts/ to do the work. Never duplicate their logic in shell or in your own reasoning.
Script paths below are relative to this skill's installed directory.
classify_changes.pl (orchestrator — call first)
├── tests/ → find_test_schedule.pl
├── lib/ → find_unit_test.pl + find_affected_tests.pl
├── data/ → find_data_consumers.pl
└── schedule/ → find_openqa_job.pl (NETWORK — confirm host first)All scripts accept --repo /path/to/osado, --json, --verbose, and --help.
Verify it exists and contains both lib/ and tests/. Most of the time it should be the current folder.
classify_changes.pl readsgit diff --cached (staged). Honour the user if they ask for a different source:
--git-diff--git-commit <hash> perl scripts/classify_changes.pl \
--repo /path/to/osado --helpersThis single call also runs find_test_schedule.pl, find_unit_test.pl, find_affected_tests.pl, and find_data_consumers.pl for the right buckets. It does NOT contact openQA.
consumers, or schedule files to clone from).
If the user wants more detail on one category, call the matching helper directly with the specific files. Examples:
perl scripts/find_unit_test.pl --repo REPO --verbose lib/foo.pm
perl scripts/find_affected_tests.pl --repo REPO --verbose lib/foo.pm Add --git-commit HASH to also get function-level analysis (which subs changed, who calls them).
perl scripts/find_test_schedule.pl --repo REPO --verbose tests/X/Y.pm
perl scripts/find_data_consumers.pl --repo REPO --verbose data/foo/bar.yaml
find_openqa_job.pl queries a live openQA instance. Before invoking it:
instance to query. The canonical options are:
--osd → http://openqa.suse.de (SLE, SLE Micro, SLES4SAP)--o3 → http://openqa.opensuse.org (Tumbleweed, Leap)--host URL → custom worker (e.g. dedicated cloud workers)find_openqa_job.pl acceptsschedule/*.yml paths only. For test modules, pipe through find_test_schedule.pl --json:
perl scripts/find_test_schedule.pl \
--repo REPO --json tests/X/Y.pm \
| jq -r '.results[].matches[] | select(.type=="yaml_schedule") | .file' \
| xargs perl scripts/find_openqa_job.pl --osd --repo REPOready: a openqa-clone-job line with auto-detected CASEDIR (your fork + branch) and BUILD (your username). Override with --casedir / --build if the user requests it.
openqa-cli or find_openqa_job.pl without first confirmingthe openQA host with the user.
tools (ReadFile, SearchText, FindFiles). Always call the Perl scripts.
classify_changes.pl --helpers already produced output for acategory, do not run the same helper again unless the user asks for more detail. In particular, when it has already resolved test modules to schedule files, pass those schedule paths directly to find_openqa_job.pl. Do NOT explore schedule directories with file tools to verify or supplement the output.
find_affected_tests.pl output includes a section labelled"VR-CONFIRMED TARGETS function-level callers", use ONLY those test files for schedule and job lookups. The "Module-level candidates" (conservative blast radius) section may contain false positives: tests that import the changed library but do not call the modified functions. Never pass module-level candidates to find_test_schedule.pl or find_openqa_job.pl when function-level data is available.
--repo to an absolute path before passing it. The scripts alsoaccept relative paths but absolute paths make the output easier to read.
find_openqa_job.pl refuses to query when achange touches more than 25 schedule files (e.g. lib/virt_autotest/common.pm, lib/hacluster.pm). Report the cap and ask the user to pick 1–3 schedules manually.
via lib/main_*.pm with runtime conditions that find_test_schedule.pl cannot resolve statically. When find_test_schedule.pl reports a loadtest match inside a lib/main_*.pm file, the user must browse the openQA web UI to find a passing job.
vh012.qa2.suse.asia oropenqaworker15.qe.prg2.suse.org are VPN-only and not auto-detected; the user must pass them with --host.
find_affected_tests.pl requires--git-commit HASH. Without it, only module-level blast radius is shown.
t/, .github/, Makefile, variables.md, or purecomment/lint fixes typically do NOT require a VR.
Keep the user-facing summary short:
prove command for each touched t/ file or lib/ modulethat has a unit test.
inspect for programmatic tests).
find_openqa_job.pl requires confirming the host.</instructions>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.