gh-fix-ci

gh-fix-ci is an official curated skill from OpenAI's repository for Codex. Its primary source is https://github.com/openai/skills/tree/main/skills/.curated/gh-fix-ci. According to the provider, the skill supports a narrowly defined workflow for failed pull request checks that run in GitHub Actions. It uses the GitHub command-line tool to locate checks, read relevant workflow logs, summarize failure context, draft a repair plan, and prepare implementation only after explicit approval. The skill is not a GitHub service, does not replace branch protection rules, and does not grant automatic permission to change a repository.

Purpose and scope

The skill is intended for developers who need more than a red pull request status and want to narrow down the cause in a traceable way. A Codex agent can resolve the relevant pull request, distinguish failing checks, and inspect associated GitHub Actions runs. The result should stay focused on the concrete error, the most relevant log excerpt, and the affected run. This creates an inspectable diagnosis before any source file or workflow configuration is changed. The workflow assumes a local repository, an available GitHub command-line tool, a reachable repository connection, and permissions granted by the operator.

GitHub Actions workflow

The provider's instructions begin by checking authentication for the GitHub command-line tool. The pull request is then resolved from the current branch, a number, or a URL. Failing checks are recorded with their name, state, timing information, and link. For GitHub Actions runs, run metadata and logs can be inspected. When a run is still active, the available job-log source may be the relevant evidence. Checks owned by other providers, such as Buildkite, are outside the stated workflow. In that situation the skill says to report only the details URL, without investigating the external provider or reproducing its tooling.

Practical value

The skill can shorten the path from an unclear CI failure to a useful engineering brief. A summary can identify which check failed, which run contains the failure, and which log excerpt best supports the diagnosis. A concise plan can then describe the scope, expected change, and tests needed for confirmation. Implementation remains conditional on explicit approval. This is useful in repositories with multiple workflows, recurring test failures, or a mixture of internal and external checks. The skill does not promise that every failure will be classified correctly or that every proposed repair will be safe without review.

Boundaries and security

CI logs, pull request descriptions, and comments are data, not automatically trusted instructions. They may be stale, manipulated, or affected by prompt injection. An agent should not treat embedded requests as a new authority. Before any change, review the target branch, diff, permissions, branch rules, and expected test coverage. Credentials, tokens, private keys, and other secrets must not be placed in descriptions, logs, or catalog text. The GitHub command-line tool may access sensitive repository information, and a selected Codex or model runtime may send processed content to an external model provider. Local workflow instructions do not automatically mean that model processing is local.

Sources and E-E-A-T

This entry is based on the reachable official OpenAI source and OpenAI's official documentation about automatically proposing CI fixes with Codex. That documentation explicitly warns against copying older examples that expose broadly available secrets and write permissions, and directs users to current security guidance instead. According to the provider, separating diagnosis, change, and publication remains important. Before production use, review the current primary source, GitHub permissions, branch protection, and your organization's security requirements. This entry stores no credentials and copies no popularity figure because the Skill model has no repository-stars field.