# Thalarch CI

> Diagnoses and reviews CI/CD, GitHub Actions, build pipelines, packaging, signing, and release automation. Use for failing checks or workflow changes. Separates log evidence from guesses, reviews untrusted input and token permissions, and never deploys/releases merely to test a fix unless explicitly authorized.

- Skill: `luc4n3x/thalarch-ci` (Agent Skill)
- Install (CLI): `npx skillmds@latest add luc4n3x/thalarch-ci`
- Raw SKILL.md: https://api.skillmd.com/api/skills/luc4n3x/thalarch-ci/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: LUC4N3X (https://skillmd.com/u/luc4n3x)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/luc4n3x/thalarch-ci

---


# Thalarch CI

## CI failure path

1. Identify the exact failing job/step.
2. Read the relevant log around the first actionable failure.
3. Map it to repository workflow/config/source.
4. Compare with the last known working configuration when possible.
5. Form and test one hypothesis.
6. Fix the smallest source/config surface.
7. Validate workflow syntax/config and targeted build locally where possible.

## Workflow security

For workflow changes inspect:
- untrusted event/input interpolation;
- `pull_request_target` / privileged trigger semantics;
- token permissions;
- secret exposure;
- mutable third-party actions;
- self-hosted runner exposure;
- artifact/download trust boundaries;
- shell injection through expressions/env.

## Side effects

Build/test is not permission to:
- publish;
- deploy;
- sign production artifacts;
- create a release;
- push/merge.

Those need explicit authorization.