Skip to content

ci: add automated skill review for SKILL.md pull requests#3015

Closed
popey wants to merge 1 commit intokurtosis-tech:mainfrom
popey:add-skill-review-ci
Closed

ci: add automated skill review for SKILL.md pull requests#3015
popey wants to merge 1 commit intokurtosis-tech:mainfrom
popey:add-skill-review-ci

Conversation

@popey
Copy link
Copy Markdown
Contributor

@popey popey commented Mar 30, 2026

Hullo! Thanks for merging the skill improvements earlier. This is a follow-up that adds a lightweight GitHub Action to automatically review any SKILL.md files when they're changed in a PR, using tessl skill review.

  • Triggers only on PRs that touch **/SKILL.md
  • Posts review results as a PR comment
  • Minimal permissions: pull-requests: write and contents: read

This way you and your contributors get an instant quality signal on skill changes before manual review — no signup or tokens needed.

Adds a lightweight GitHub Action that reviews any SKILL.md files changed
in a pull request using tessl skill review. Posts results as a PR comment
with minimal permissions (pull-requests: write, contents: read).

Signed-off-by: Alan Pope <alan@popey.com>
@barnabasbusa
Copy link
Copy Markdown
Collaborator

Thanks for the PR! We can't accept this as it introduces a closed-source binary (tessl CLI) into the CI pipeline of an open-source project. The action downloads a pre-built binary from install.tessl.io that can't be audited or built from source, and the action refs are pinned to mutable branches (@main, @v1) rather than commit SHAs.

We're not comfortable granting ongoing, mutable code execution to a third-party binary in our CI. Nothing personal — this is a general policy for supply chain security.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants