// Run this repo's GitHub Actions workflows locally in Docker with Agent CI to validate changes before pushing. Use before opening or updating a PR, after editing a workflow YAML under .github/workflows, or whenever catching a CI failure locally beats waiting on a remote runner.
Scans the codebase for bugs, logic errors, cache races, workflow problems, insecure defaults, security regressions in the diff, and variant analysis on prior findings. Spawns specialized Task agents per scan type, deduplicates findings, and produces an A-F prioritized report. Use when preparing a release, investigating quality issues, running pre-merge checks, or whenever a recent diff touches security-sensitive code.
Umbrella update skill for a Socket fleet repo. Runs `pnpm run update` (npm), validates `lockstep.json` via `pnpm run lockstep` (if present), optionally bumps submodules, checks workflow SHA pins, resolves open Dependabot security alerts, refreshes the README coverage badge when applicable, and audits GitHub repo + Actions settings drift via `scripts/lint-github-settings.mts`. Use when asked to update dependencies, sync upstreams, fix security advisories, refresh coverage, or prepare for a release.
Reference for locking down programmatic Claude invocations (the `claude` CLI in workflows/scripts, the `@anthropic-ai/claude-agent-sdk` `query()` in code). Loads on demand when writing or reviewing any callsite that runs Claude programmatically. Source: https://code.claude.com/docs/en/agent-sdk/permissions.
Resolve open GitHub Dependabot security alerts on a fleet repo. Fetches alerts via `gh api`, applies fixes (direct dep bump, pnpm override for transitives, or principled dismissal for unfixable), validates with `pnpm run check`, commits per-alert, and reports remaining advisories. Sibling of `updating-lockstep` under the `updating` umbrella.
Compact the current conversation into a handoff doc so a fresh agent can pick up the work. Use when context is getting thin, a session is about to end, or the next stage of the work needs a different agent / human.
Reference for the `Promise.race` cross-iteration handler-leak bug. Loads on demand when writing or reviewing concurrency code that uses `Promise.race`, `Promise.any`, or hand-rolled concurrency limiters.
| name | agent-ci |
| description | Run this repo's GitHub Actions workflows locally in Docker with Agent CI to validate changes before pushing. Use before opening or updating a PR, after editing a workflow YAML under .github/workflows, or whenever catching a CI failure locally beats waiting on a remote runner. |
| user-invocable | true |
| allowed-tools | Bash, Read, Edit |
Run the repo's CI pipeline locally before pushing. CI was green before you started, so any failure the local run surfaces comes from your changes.
RedwoodJS wrote the upstream tool and skill (MIT, https://github.com/redwoodjs/agent-ci). The fleet pins @redwoodjs/agent-ci in the wheelhouse catalog and runs it through pnpm exec, never npx. Edit only in socket-wheelhouse/template/; the cascade refreshes downstream copies.
greening-ci skill or remote CI.@redwoodjs/agent-ci is a fleet devDependency (catalog:), provisioned by pnpm install.pnpm exec agent-ci run --quiet --all --pause-on-failure
--all runs the PR/push workflows for the current branch. --pause-on-failure stops at the first failed step and holds the container open for retry. Pipes are safe: when stdout is not a TTY the launcher detaches and the foreground process exits 77 the moment a step pauses, so | tee log and > log.txt work.
When a step fails the run pauses. Fix the code, then retry the paused runner — don't restart the whole pipeline:
pnpm exec agent-ci retry --name <runner-name>
Re-run from an earlier step with --from-step <N>. Repeat fix → retry until every job passes. Don't push to trigger remote CI when agent-ci can run it locally.
--json event stream, the full requirements rationale, and the agent-ci-vs-remote-CI decision matrix: see reference.md.