ci: add automated skill review for SKILL.md pull requests#41
ci: add automated skill review for SKILL.md pull requests#41popey wants to merge 1 commit intojordanhubbard:mainfrom
Conversation
Adds a lightweight GitHub Action that reviews any SKILL.md files changed in a pull request using tessl skill review. Posts results as a PR comment with minimal permissions (pull-requests: write, contents: read). Signed-off-by: Alan Pope <alan@popey.com>
There was a problem hiding this comment.
Pull request overview
Adds a GitHub Actions workflow to automatically run tesslio/skill-review on pull requests that modify any **/SKILL.md, and publish the results back to the PR.
Changes:
- Introduces
.github/workflows/skill-review.ymlworkflow triggered on PRs touching**/SKILL.md - Checks out the repo and runs
tesslio/skill-reviewwith PR comment permissions
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| contents: read | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: tesslio/skill-review@main |
There was a problem hiding this comment.
tesslio/skill-review@main uses a moving branch ref, which reduces reproducibility and increases supply-chain risk (a force-push or compromised upstream could change behavior without review). Pin to a stable release tag or (preferably) a commit SHA and update it intentionally when you want new behavior.
| - uses: tesslio/skill-review@main | |
| - uses: tesslio/skill-review@3f2c9b1d4a6e8b7c2d1e9f0a5b4c3d2e1f0a9b8 |
| on: | ||
| pull_request: | ||
| paths: ['**/SKILL.md'] | ||
|
|
||
| jobs: | ||
| review: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| pull-requests: write | ||
| contents: read |
There was a problem hiding this comment.
With the pull_request event, GITHUB_TOKEN is read-only for PRs from forks, so the job typically cannot create PR comments even though pull-requests: write is requested. If the intent is to comment on external-contributor PRs, consider switching to pull_request_target (and avoid checking out/running untrusted PR code), or have the action post results as a check/run instead of a PR comment.
Hullo! Thanks for merging the skill improvements earlier. This is a follow-up that adds a lightweight GitHub Action to automatically review any
SKILL.mdfiles when they're changed in a PR, using tessl skill review.**/SKILL.mdpull-requests: writeandcontents: readThis way you and your contributors get an instant quality signal on skill changes before manual review — no signup or tokens needed.