| name | ci |
| version | 1.0 |
| last_updated | 2026-08-07T00:00:00.000Z |
| id | ci |
| one_line_purpose | Debug and change repository GitHub Actions workflows. |
| entry_point | docs/skills/ci/SKILL.md |
| category | ci-ops |
| mcp_compliance_level | partial |
| optimization_status | draft |
| status | active |
| dependencies | [] |
| tags | ["ci","workflows","github-actions","triggers","debugging"] |
| description | Explains workflow triggers, path filters, reusable workflow calls, and how to read failing runs in this repository. Use when a workflow failed, did not start, or ran the wrong checks. |
| metadata | {"type":"runbook","source-of-truth":[".github/workflows/",".github/workflows/pr-validation.yml",".github/workflows/build-image-testing.yml"],"context7-sources":["/websites/github_en_actions","/podman-container-tools/buildah"]} |
CI
Use when
- A workflow failed, did not start, or ran the wrong checks.
- A trigger, permission, path filter, or reusable workflow call changes.
Do not use when
- The issue is purely local validation: use build.
- The change is package placement: use packages.
- The change is release procedure: use release-artifacts.
First checks
gh run list --repo projectbluefin/bluefin --limit 20
gh run view RUN_ID --repo projectbluefin/bluefin --log-failed
gh run rerun RUN_ID --repo projectbluefin/bluefin --failed-only
Read the actual workflow before describing or changing its behavior. Shared
logic belongs in the reusable workflow that owns it; callers should stay thin.
The unit-tests job in pr-validation.yml runs BATS with kcov and publishes
bats-tap-results plus bats-kcov-report artifacts for shell-test visibility.
Coverage runs route child bash <script> calls through
tests/coverage/bin/bash, because wrapping only the top-level BATS process
does not trace those child shells. The wrapper records each sandbox copy's
original source path, and merge_kcov.py combines those hits with kcov's
pre-parsed source inventory. A zero-line report is an instrumentation failure.
kcov is not packaged for Ubuntu 24.04, so the job builds v43 from a pinned,
SHA-256-verified source archive and caches the result. The coverage run must
redirect BATS output to a file: kcov captures child stdout through a pipe it
stops draining, so streaming the full TAP log through it deadlocks the job.
The instrumented rerun does not gate the job — Run unit tests owns pass/fail
— but merge_kcov.py fails when no source lines were executed.
Tests that source a library into the BATS process itself are not traced.
A pull request whose head branch lives on a fork reports zero checks until a
maintainer approves the run — identical to "checks still queued", so confirm:
gh pr view PR --repo projectbluefin/bluefin --json headRepositoryOwner,maintainerCanModify
gh api -X POST repos/projectbluefin/bluefin/actions/runs/RUN_ID/approve
Zero checks with no pending approval means the PR targets . Retarget
with ; rebuild branches cut from .
