360 Secure SkillHub
360 安全技能中心

heyeddi-ci-runners

该 Skill 指导用户将 GitHub Actions 的 Linux 作业通过 HEYEDDI_RUNS_ON 变量路由到 HeyEddi Spot，或在没有 GHA 的场景下编写封闭的 eddi-ci.yaml pipeline 作业；它强调先读取策略与仓库证据、不臆造测试命令，并在任何暗示执行结果的总结前用断言脚本校验声明。

分类：开发
HeyEddi-com
热度 0.00
最近更新 2026-11-05 05:35:25

安装

发给 Agent
帮我安装这个技能：npx secure-skills-cli add heyeddi-com/heyeddi-skills/heyeddi-ci-runners
兼容性
通用兼容
联网要求
联网要求未确认
数据出网
数据出网未确认
Metadata
name
heyeddi-ci-runners
description
Configure HeyEddi Spot runners — prefer GHA overflow/always with the HEYEDDI_RUNS_ON hook; author sealed eddi-ci.yaml pipeline jobs only for no-GHA or niche checks. Use when wiring runners, pipeline YAML, or Spot CI.
version
2.0.0
product-version
3.8.7
author
HeyEddi-com

HeyEddi CI Runners

Spot is shipped. Help the user wire the right runner path and never invent execution claims.

Two job kinds (do not collapse)

Kind Where Check name When to use
GHA on Spot .github/workflows/*.yml + workspace gha_spot_mode Same workflow Check Repos that already have Actions (default)
Sealed pipeline: eddi-ci.yaml pipeline: jobs HeyEddi Runner: {job_id} No (or minimal) GHA, or niche sealed checks

Golden rule: Never duplicate the same test/build in GHA and pipeline:. Prefer GHA + Spot routing; keep pipeline: {}.

Product docs: https://ci.heyeddi.com/docs · hub mirrors: see reference/runners.md.

Prefer GHA overflow / always

  1. Confirm .github/workflows/ exists (or user wants Actions-based CI).
  2. Ensure every Linux job uses:
runs-on: ${{ vars.HEYEDDI_RUNS_ON || 'ubuntu-latest' }}
  1. Tell the user to set workspace Runners mode on ci.heyeddi.com:
    • overflow — GitHub minutes first; Spot JIT when exhausted
    • always — Linux jobs on Spot from the first run
    • off — hosted only
  2. Keep eddi-ci.yaml Reviewer-only with pipeline: {} (use @heyeddi-ci-config).
  3. Limits: Linux only; private repos; prepaid/entitled workspace; platform kill switch is ops-owned. Overflow reliability can still gap — do not promise “always works.”

Sealed pipeline: (advanced / no-GHA)

  1. load_policy_contract — living knobs only.
  2. inspect_repo — evidenced commands + path prefixes; never invent pytest / npm test.
  3. Explicit user opt-in (billable runner time).
  4. Author argv-safe run (no shell operators, sudo, curl, wget), catalog image, filter.paths when possible.
  5. Jobs run on Spot when the workspace is entitled and Spot env is live; they post HeyEddi Runner: {job_id} Checks.

Prefer @heyeddi-ci-config for the create/update decision gate.

Evidence rule (mandatory)

  • Jobs can run under entitlement + Spot substrate.
  • A job did run only when you have Check / Spot evidence (HeyEddi Runner: …, workflow Check conclusion, Ops/logs).
  • YAML lint ≠ execution. Unknown → say so and use @heyeddi-ci-fails.
  • Before any summary that implies execution, run:
assert_runners_claims --check --agent-text "<your summary>"

Pipeline

load_policy_contract
inspect_repo
→ choose GHA-first vs sealed pipeline (never both for the same CI)
→ wire HEYEDDI_RUNS_ON hook and/or author pipeline: jobs
assert_runners_claims --check --agent-text "<your summary>"

Tools

Tool Purpose
load_policy_contract Living knobs / guide
inspect_repo Languages + evidenced commands
assert_runners_claims Block unsubstantiated execution claims

Safety

  • Never secrets in YAML
  • Never invent test commands
  • Never auto_merge
  • Never merge without authorize merge
  • Never claim correlated AI+runner timeline (Coming soon)