fix(skill-management): remove broken agent refs and widen audit recall #1191
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR Checks | |
| on: | |
| pull_request: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} | |
| cancel-in-progress: true | |
| # Disable Bun's automatic bunfig.toml loading from CWD. `bun run` invocations | |
| # in this workflow run after checkout; without this, a malicious bunfig.toml | |
| # at the checkout root would have its preload array execute arbitrary code | |
| # before the intended script (RCE with workflow secrets). | |
| env: | |
| BUN_CONFIG_FILE: /dev/null | |
| jobs: | |
| # Pre-check job to detect automated PRs | |
| check-automated: | |
| name: Check Automated PR | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| outputs: | |
| is_automated: ${{ steps.check.outputs.is_automated }} | |
| category: ${{ steps.check.outputs.category }} | |
| skip_reason: ${{ steps.check.outputs.skip_reason }} | |
| # Skip CI for release/sync/action-update PRs, but NOT for dependency updates (which need testing) | |
| should_skip_ci: ${{ steps.check.outputs.is_automated == 'true' && steps.check.outputs.category != 'deps' }} | |
| steps: | |
| - uses: bullfrogsec/bullfrog@1831f79cce8ad602eef14d2163873f27081ebfb3 # v0.8.4 | |
| - name: Checkout repository (for composite action) | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| sparse-checkout: .github/actions | |
| sparse-checkout-cone-mode: false | |
| - name: Check for automated PR | |
| id: check | |
| uses: ./.github/actions/check-automated-pr | |
| with: | |
| branch_name: ${{ github.head_ref }} | |
| pr_title: ${{ github.event.pull_request.title }} | |
| validate: | |
| name: Validate Installation & Build | |
| needs: check-automated | |
| # Skip for automated PRs except dependency updates (which should still run tests) | |
| if: ${{ needs.check-automated.outputs.should_skip_ci != 'true' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| env: | |
| # Override nx.json defaultBase for PR target branch | |
| NX_BASE: origin/${{ github.base_ref }} | |
| NX_HEAD: HEAD | |
| steps: | |
| - uses: bullfrogsec/bullfrog@1831f79cce8ad602eef14d2163873f27081ebfb3 # v0.8.4 | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 | |
| with: | |
| node-version: ${{ vars.NODE_VERSION || '24' }} | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| with: | |
| bun-version: "1.3.12" | |
| - name: Verify bun.lock | |
| run: | | |
| echo "Checking if bun.lock is up to date..." | |
| bun install --frozen-lockfile | |
| if ! git diff --exit-code bun.lock; then | |
| echo "❌ bun.lock is out of sync!" | |
| echo "Please run 'bun install' and commit the updated bun.lock" | |
| exit 1 | |
| fi | |
| echo "✅ bun.lock is up to date" | |
| - name: Clean install dependencies | |
| run: | | |
| echo "Running bun install to validate clean installation..." | |
| bun install --frozen-lockfile | |
| echo "✅ bun install completed successfully" | |
| - name: Build changed packages | |
| run: | | |
| echo "Building changed packages..." | |
| bunx nx affected --target=build --verbose | |
| echo "✅ Build(s) completed successfully" | |
| - name: Run linting | |
| run: | | |
| echo "Running linters..." | |
| bunx nx affected --target=lint --verbose | |
| echo "✅ Linting passed" | |
| - name: Check formatting | |
| run: | | |
| echo "Checking code formatting..." | |
| bunx nx affected --target=format --verbose | |
| echo "✅ Formatting check passed" | |
| - name: Run tests | |
| run: | | |
| echo "Running tests..." | |
| bunx nx affected --target=test --parallel=3 --coverage --verbose | |
| echo "✅ Tests passed" | |
| validate-plugins: | |
| name: Validate Plugins | |
| needs: check-automated | |
| # Skip for automated PRs except dependency updates (which should still run tests) | |
| if: ${{ needs.check-automated.outputs.should_skip_ci != 'true' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: bullfrogsec/bullfrog@1831f79cce8ad602eef14d2163873f27081ebfb3 # v0.8.4 | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Setup Node.js | |
| uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 | |
| with: | |
| node-version: ${{ vars.NODE_VERSION || '24' }} | |
| - name: Validate all plugins | |
| uses: ./.github/actions/validate-plugins | |
| with: | |
| marketplace-path: '.claude-plugin/marketplace.json' | |
| fail-on-warning: 'false' | |
| # Summary job for automated PRs that were skipped | |
| skipped-summary: | |
| name: CI Skipped (Automated PR) | |
| needs: check-automated | |
| if: ${{ needs.check-automated.outputs.should_skip_ci == 'true' }} | |
| runs-on: ubuntu-latest | |
| permissions: {} | |
| steps: | |
| - uses: bullfrogsec/bullfrog@1831f79cce8ad602eef14d2163873f27081ebfb3 # v0.8.4 | |
| - name: Report skipped status | |
| env: | |
| SKIP_REASON: ${{ needs.check-automated.outputs.skip_reason }} | |
| run: | | |
| echo "::notice::CI checks skipped for automated PR: $SKIP_REASON" | |
| echo "✅ Automated PR detected - CI checks are not required for this PR type." |