Github ci agents

Skill m00kk/agent-skills-playbook/skills/github-ci-agents

15 production Agent Skills — MCP, LangGraph, RAG, security, Cursor SDK. MIT licensed.

Install

npx -y skills add m00kk/agent-skills-playbook --skill github-ci-agents

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Wires AI agents into GitHub Actions: PR review bots, eval gates, Cursor SDK jobs, and MCP-powered checks. Use for CI/CD with agents, GitHub Actions LLM, or automated code review on pull requests.

SKILL.md

1.8 KB, as published. Nobody here has run it

GitHub CI Agents

Common patterns

Pattern	Trigger	Agent role
PR review	`pull_request`	Comment risks + suggestions
Eval gate	`push` / `schedule`	Run golden evals; fail on regression
Fix bot	`issue_comment` / label	Open PR with patch
Docs sync	`push` to main	Update derived docs

Workflow skeleton

name: Agent eval
on:
  pull_request:
    branches: [main]
permissions:
  contents: read
jobs:
  eval:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run eval suite
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
        run: python -m evals.run --smoke

Secrets

Store keys in GitHub Actions secrets or OIDC — never in workflow YAML values
Separate staging vs production keys
Minimum permissions on GITHUB_TOKEN

PR review agents

Post summary comment + inline suggestions only on changed files
Block merge only on objective checks (tests, eval pass) — not subjective tone
Rate-limit comments to avoid noise

Cursor SDK in Actions

- name: Run Cursor agent
  env:
    CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}
  run: npx tsx scripts/run-agent.ts

Script should: create agent → prompt → wait → export diff artifact.

Safety

pull_request_target only when you understand fork secret exposure
Do not run untrusted code from fork PRs with secrets
Require human approval for write operations to repo

Pair with evaluate-agent-quality and cursor-sdk-automation.

Gives 0 of the 12 instructions most ci cd skills give

Counted across 392 of the 394 authors here whose files we hold, read 2026-08-06

pin third-party actions to full commit SHAsin 33 of 392
cache dependencies appropriatelyin 24 of 392, across 12 files
optimize pipelines exceeding ten minutesin 20 of 392, across 6 files
enforce all quality gates before mergein 20 of 392, across 7 files
Configure branch protection rulesin 19 of 392, across 5 files
use environments for deployment trackingin 19 of 392, across 7 files
implement manual gates for productionin 19 of 392, across 7 files
implement security scanningin 18 of 392, across 5 files
fix failing code instead of disabling checksin 18 of 392, across 4 files
use CI/CD variables for secretsin 18 of 392, across 6 files
move checks upstream in the pipelinein 17 of 392, across 3 files
use specific image tagsin 17 of 392, across 5 files

Said here and by no other author read

store keys in GitHub Actions secrets or OIDC
separate staging and production keys
post comments only on changed files
block merge only on objective checks
rate-limit comments to avoid noise
create agent then prompt then wait then export diff

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once.