Add fastcrw-research skill for recall-first arXiv paper retrieval #82
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR Skill Scan | |
| on: | |
| pull_request: | |
| paths: | |
| - "skills/**" | |
| - "scan_skills.py" | |
| - "scan_pr_skills.py" | |
| - "pyproject.toml" | |
| - "uv.lock" | |
| - ".github/workflows/pr-skill-scan.yml" | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| concurrency: | |
| group: pr-skill-scan-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| scan: | |
| name: Scan changed skills | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| steps: | |
| - name: Checkout PR | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Detect changed skills | |
| id: changed | |
| run: | | |
| set -euo pipefail | |
| BASE_SHA="${{ github.event.pull_request.base.sha }}" | |
| HEAD_SHA="${{ github.event.pull_request.head.sha }}" | |
| echo "Base: $BASE_SHA" | |
| echo "Head: $HEAD_SHA" | |
| # Files added/copied/modified/renamed under skills/<skill>/... | |
| CHANGED_FILES=$(git diff --name-only --diff-filter=ACMR "$BASE_SHA" "$HEAD_SHA" -- 'skills/**' || true) | |
| echo "Changed files under skills/:" | |
| echo "$CHANGED_FILES" | |
| # Derive unique top-level skill directories and keep only those that still exist with a SKILL.md | |
| SKILL_DIRS=$(echo "$CHANGED_FILES" \ | |
| | awk -F/ 'NF>=2 && $1=="skills" {print $1 "/" $2}' \ | |
| | sort -u) | |
| EXISTING="" | |
| for d in $SKILL_DIRS; do | |
| if [ -f "$d/SKILL.md" ]; then | |
| EXISTING="$EXISTING $d" | |
| fi | |
| done | |
| EXISTING=$(echo "$EXISTING" | xargs || true) | |
| echo "Skill dirs to scan: '$EXISTING'" | |
| echo "skill_dirs=$EXISTING" >> "$GITHUB_OUTPUT" | |
| - name: Set up uv | |
| if: steps.changed.outputs.skill_dirs != '' | |
| uses: astral-sh/setup-uv@v8.0.0 | |
| with: | |
| enable-cache: true | |
| cache-dependency-glob: uv.lock | |
| python-version: "3.13" | |
| - name: Install dependencies | |
| if: steps.changed.outputs.skill_dirs != '' | |
| run: uv sync --python 3.13 | |
| # Fork PRs do not receive SKILL_SCANNER_LLM_API_KEY. scan_pr_skills.py | |
| # detects the missing key, writes an explanatory sticky comment, and exits 0. | |
| - name: Run scanner on changed skills | |
| if: steps.changed.outputs.skill_dirs != '' | |
| id: scan | |
| env: | |
| SKILL_SCANNER_LLM_API_KEY: ${{ secrets.SKILL_SCANNER_LLM_API_KEY }} | |
| SKILL_SCANNER_LLM_MODEL: ${{ vars.SKILL_SCANNER_LLM_MODEL || 'claude-opus-5' }} | |
| run: | | |
| uv run python scan_pr_skills.py \ | |
| --output pr_scan_comment.md \ | |
| --fail-on HIGH \ | |
| ${{ steps.changed.outputs.skill_dirs }} | |
| - name: Prepare no-op comment | |
| if: steps.changed.outputs.skill_dirs == '' | |
| run: | | |
| cat > pr_scan_comment.md <<'EOF' | |
| <!-- skill-security-scan --> | |
| ## 🛡️ Skill Security Scan | |
| No skill directories (with a `SKILL.md`) were changed in this PR — nothing to scan. | |
| EOF | |
| - name: Upload scan comment as artifact | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: pr-skill-scan-comment | |
| path: pr_scan_comment.md | |
| if-no-files-found: ignore | |
| - name: Post or update PR comment | |
| if: always() && hashFiles('pr_scan_comment.md') != '' | |
| uses: marocchino/sticky-pull-request-comment@v2 | |
| with: | |
| header: skill-security-scan | |
| path: pr_scan_comment.md |