메뉴
GitHub CLI for inspecting workflow runs, PRs, commits, releases, and deployments. Use to correlate an incident window with what changed, verify whether a merged PR actually deployed, inspect a specific commit, list recent releases, or check workflow run status. Read-only by default.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Use when a task involves Tsuga CLI commands, TQL log or trace search, aggregation bodies, metric temporality math, resource lookup or CRUD planning, service ownership, reliability posture, quality reports, monitor or dashboard context, notification rules, retention/tag policies, ingestion keys, docs lookup, command help, skeleton payloads, or Tsuga app deep links.
Use when asked to create, update, validate, delete, or review a Tsuga dashboard; add or fix widgets; correct layout; build a monitoring view for a service, team, system, SLO, capacity, latency, throughput, or error-rate question; verify dashboard payloads, widget queries, graph schemas, normalizers, formulas, table grouping, time presets, or layout rules.
One-shot procedure for turning a live Tsuga account + codebase list + ambient docs into the `skills/knowledge-company/` tree: top-level COMPANY_GENERAL_KNOWLEDGE.md + COMPANY_TELEMETRY_KNOWLEDGE.md, per-team TEAM_KNOWLEDGE.md, per-service SERVICE_KNOWLEDGE.md dossiers with ready-to-run `tsuga` CLI queries. Trigger this skill when bootstrapping knowledge-company from scratch for a new customer / company, refreshing it after a major service taxonomy change, or after a CLI rename that invalidates the existing ready-to-run commands. Inputs: Tsuga MCP / CLI access, list of GitHub codebases, optional `inputs/raw-docs/` for architecture notes. Outputs: populated `skills/knowledge-company/` ready for the runtime agent to load.
Primary entry point for active-incident investigation, post-incident RCA, or recurring-degradation triage. Use when a monitor fires, a customer reports slow / errored / missing telemetry, an incident is declared (P1–P5), or someone asks 'what's wrong with X right now?'. Coordinates parallel evidence branches — telemetry sweep (`tsuga` CLI), change correlation (git / gh), analogue search, codebase-grep, challenger review — tracking hypotheses behind evidence gates, and produces an operator-ready verdict with cited evidence plus two durable deliverables by default: a Tsuga investigation record and a proofs dashboard.
Use when choosing an OpenTelemetry signal, instrument, or telemetry name: metric vs span vs log, counter vs histogram vs gauge, span event vs child span, resource/span/log/metric attribute naming, semantic convention checks, deployment.environment migration, bounded dimensions, cardinality estimates, high-cardinality risk, or whether an observation belongs in traces, metrics, logs, or resource attributes.
One-shot procedure for turning a raw incident dump (Slack threads, incident reports, GitHub PRs, Tsuga CLI output) into a populated `skills/incident-history/references/incidents/` archive with one folder per incident, each containing a SUMMARY.md with a validated `## Diagnostic path` section. Trigger this skill when bootstrapping `incident-history` from scratch for a new deployment, refreshing an existing archive with new incidents, or reformatting an incident tracker's export into the shape your investigation runtime expects. Inputs: `inputs/incidents/<INC-id>/` directories holding raw material per incident. Outputs: `skills/incident-history/references/incidents/<INC-id>/SUMMARY.md` + `_inventory.csv`.
| name | gh |
| description | GitHub CLI for inspecting workflow runs, PRs, commits, releases, and deployments. Use to correlate an incident window with what changed, verify whether a merged PR actually deployed, inspect a specific commit, list recent releases, or check workflow run status. Read-only by default. |
Answer "what changed and what shipped." Pair with local git for exact file diffs.
Authenticated from GH_TOKEN at container start. Smoke-test: gh auth status.
gh run list -R owner/repo --created ">=2026-04-20T14:00" --json name,status,conclusion,createdAt,headSha,url,event
gh run list -R owner/repo --workflow deploy.yml --branch main --limit 20 --json conclusion,createdAt,headSha,url
gh run view <run-id> -R owner/repo --log
gh run view <run-id> -R owner/repo --json jobs
Green run ≠ change in prod. Red run ≠ nothing rolled out. Check per-env deploy status.
# PRs merged in a window
gh search prs --repo owner/repo --merged --merged-at "2026-04-20..2026-04-21" --json number,title,mergedAt,url,author
# PRs touching a path
gh search prs --repo owner/repo --merged -- "path/to/service"
# PR matching a SHA
gh pr list -R owner/repo --state merged --search "<sha>" --json number,title,mergedAt,url
# PR details
gh pr view <number> -R owner/repo --json files,title,body,mergedAt,author,url
gh pr diff <number> -R owner/repo
gh release list -R owner/repo --limit 10 --json tagName,name,publishedAt,isLatest
gh release view <tag> -R owner/repo --json body,tagName,publishedAt,assets
gh api repos/owner/repo/commits --jq '.[] | {sha, author: .commit.author.name, date: .commit.author.date, message: .commit.message | split("\n")[0]}' --paginate | head -40
gh api repos/owner/repo/commits/<sha> --jq '.files[] | .filename'
gh api repos/owner/repo/deployments --paginate --jq '.[] | {id, environment, created_at, sha, ref}' | head -20
gh api repos/owner/repo/deployments/<id>/statuses --jq '.[] | {state, created_at, description}'
gh issue list -R owner/repo --search "<keyword> in:title,body" --state open --json number,title,url,createdAt
gh issue view <number> -R owner/repo --json title,body,comments
gh api repos/OWNER/REPO/actions/runs --jq '.workflow_runs[0]'
gh api 'repos/OWNER/REPO/commits?since=2026-04-20T00:00:00Z&until=2026-04-21T00:00:00Z' --paginate
gh = remote history. git = exact file content in the incident window.
git log --since="2026-04-20 09:00" --until="2026-04-20 12:00" --oneline --decorate
git show <sha> --stat
git diff <old_sha>..<new_sha> -- path/to/config path/to/helm
git blame path/to/file.yaml
If git status is dirty, the working tree is NOT a safe proxy for the incident window. Warn before drawing conclusions.
merged ≠ deployed. Check workflow run / release / deployment status.main ≠ prod on every repo. Some deploy from release branch or tagged commit.Every change candidate includes:
deployed | merged only | unknown)Example citation: PR #4421 merged 2026-04-20T13:45Z, deployed via run #8192 at 14:02Z, touched services/payments/db.py [evidence: gh_pr, gh_run].