# Github

> GitHub code repository integration for investigating code changes, deployments, commits, PRs, and suggesting fixes during RCA

- Skill: `arvo-ai/github` (Agent Skill)
- Install (CLI): `npx skillmds@latest add arvo-ai/github`
- Raw SKILL.md: https://api.skillmd.com/api/skills/arvo-ai/github/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: Arvo-AI (https://skillmd.com/u/arvo-ai)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/arvo-ai/github

---


# GitHub Integration

## Overview
GitHub integration for investigating code changes during Root Cause Analysis and managing code fixes.
Connected account: {username}

## Instructions

### Multi-Repo Discovery
- Multiple repositories may be connected. Call `get_connected_repos` FIRST to list them with descriptions.
- Each repo has an LLM-generated summary describing what it contains — use these to pick the right repo for your task.
- If only one repo is connected, `github_rca` auto-selects it. If multiple, you MUST pass `repo='owner/repo'`.

### Tool Usage (use in this order)
1. `get_connected_repos` — Discover available repos + descriptions. Always call first.
2. `github_rca(repo='owner/repo', action=...)` — Investigate code changes for RCA:
   - `deployment_check` — GitHub Actions workflow runs (failures, suspicious timing)
   - `commits` — Recent commits with automatic 2-hour incident correlation
   - `diff` (requires `commit_sha`) — File-level changes for a specific commit
   - `pull_requests` — Merged PRs in the time window
   - Pass `incident_time` (ISO 8601) for automatic time window correlation
3. `github_fix(file_path=..., edits=[{old_string, new_string, replace_all?}, ...], fix_description=..., root_cause_summary=...)` — Suggest a code fix via anchored search-and-replace edits (stored for user review, not auto-applied). First call `get_file_contents` to read the current file so you can copy the exact `old_string` (with enough surrounding context to be unique).
4. `github_apply_fix(suggestion_id=...)` — Create a PR from an approved fix (only after user reviews)
5. `github_commit(repo=..., commit_message=...)` — Push generated Terraform (.tf) files from the IaC workflow to GitHub. This is NOT a general-purpose commit tool — it only pushes .tf files from the terraform working directory.

### MCP Tools (for direct GitHub API operations beyond RCA)
- Files: `get_file_contents`, `create_or_update_file`, `push_files`, `get_repository_tree`
- **Size limit:** `create_or_update_file` and `push_files` enforce a 50 KB per-file cap. Files exceeding this limit will be rejected. Do NOT attempt to work around this via terminal commands or other tools — the limit is intentional.
- **Updates:** When updating an existing file, the new content must be at least 50% of the original file size (for files over 10 KB). This prevents accidental truncation.
- Branches: `create_branch`, `list_branches`, `list_commits`, `get_commit`
- PRs: `create_pull_request`, `list_pull_requests`, `merge_pull_request`, `get_pull_request_files`
- Issues: `create_issue`, `list_issues`, `search_issues`, `add_issue_comment`
- Actions: `list_workflow_runs`, `get_workflow_run`, `get_job_logs`, `run_workflow`
- Security: `list_code_scanning_alerts`, `list_dependabot_alerts`, `list_secret_scanning_alerts`
- All MCP tools require `owner` and `repo` parameters (split from 'owner/repo').

### RCA Investigation Workflow
Code changes are a common root cause of incidents. Investigate GitHub early in the process.

**Important: Merged does not always mean deployed.** Many teams have separate CI (build) and CD (deploy) steps. When concluding that a commit caused an incident, check whether it was actually deployed. If deployment status cannot be confirmed, qualify your conclusion (e.g. "this commit is the likely cause if it was deployed").

**Step 1 — Discover repos:**
`get_connected_repos()` — returns all connected repos with descriptions.
Read the descriptions to pick the repo most relevant to the alert.

**Step 2 — Check deployments (did something ship?):**
`github_rca(repo='owner/repo', action='deployment_check', incident_time='<ISO8601>')`
Finds failed workflow runs and runs completed within 2 hours of the incident.

**Step 3 — Check commits (what code changed?):**
`github_rca(repo='owner/repo', action='commits', incident_time='<ISO8601>')`
Lists commits with automatic suspicious-commit flagging (within 2 hrs of incident).

**Step 4 — Inspect suspicious changes:**
`github_rca(repo='owner/repo', action='diff', commit_sha='<sha>')`
Shows file-level additions/deletions. Prioritize config/infra files (.yaml, .env, terraform/).

**Step 5 — Check merged PRs:**
`github_rca(repo='owner/repo', action='pull_requests', incident_time='<ISO8601>')`
Finds PRs merged in the time window; recently merged PRs are flagged.

**Step 6 — Suggest fix:**
First read the file with `get_file_contents(owner, repo, path)`. Then:
`github_fix(file_path=..., edits=[{old_string: "...", new_string: "..."}], fix_description=..., root_cause_summary=...)`
`old_string` must match the current file exactly (include 1–3 lines of surrounding context so the match is unique). Indentation counts. **Keep `old_string` narrow** — just the lines you're changing plus a little surrounding context. Do NOT pass the whole file as `old_string`; if a single edit covers more than ~half the file Aurora will reject it. For multi-section changes, send multiple smaller edits. Use `replace_all: true` only when `old_string` matches the file byte-for-byte and you want every occurrence touched. Aurora applies the edits server-side and stores the result for user review; `github_apply_fix` then creates the PR.

### Important Rules
- Pass `incident_time` on every github_rca call for automatic time correlation.
- Use `time_window_hours` (default 24) to widen/narrow the search.
- Repos are REMOTE — use MCP tools (`get_file_contents`) to read files, never local shell commands.
- Look for: config changes, k8s manifests, Terraform, dependency updates.
- When concluding a commit is the root cause, check if deployment_check confirms it was deployed. If not, qualify with "likely cause if deployed" rather than stating it definitively.