CI Push Approval Assistant
Handle CI configuration push blocks and approval handoffs
The skill directs CI pushes through a temporary approval flow and discloses the approval link to the user; however, it still recommends attempting the push first and lacks explicit pre-action confirmation, least-privilege detail, data-flow disclosure, rollback, and recovery boundaries. Official OpenAI provenance and the Apache-2.0 license provide limited attribution evidence only.
It identifies the restricted path, the failure feedback, and the condition to wait for approval propagation, making the main flow understandable. It provides no scripts, tests, environment prerequisites, or diagnosis for network, permission, or other push failures, so the static score remains modest.
The target scenario is clear: pushing GitHub CI configuration changes, handling rejection, and requesting an upload exception. Trigger boundaries, non-fit cases, alternative CI hosts, Chinese-language use, and link reachability are not specified, so points are deducted.
The name and description broadly match the CI-push approval topic, and the document is concise with a basic progressive flow. It lacks installation or dependency notes, parameter examples, FAQs, known limitations, versioning, changelog, and explicit maintenance ownership, so points are deducted.
It can direct the user to the approval process and resume after propagation, but it cannot obtain approval or verify the final push itself. It also lacks alternatives for failed approval or unrelated permission errors, leaving substantial user intervention and limiting the score.
The skill text is auditable, and the repository security material corroborates the existence of approval and security boundaries. However, there are no skill-specific tests, execution records, or independent reproduction evidence; unrelated repository tests do not verify this skill's behavior, so only limited credit is warranted.
- Obtain explicit confirmation before the external GitHub push and state the intended CI configuration scope.
- The approval link, propagation time, and user permissions are not verified in the supplied files; failure diagnosis and recovery steps are incomplete.
- The skill does not explain safe rollback of pushed CI changes or what repository data may be transmitted or exposed during the push.
What it does & when to use it
This skill focuses on pushing GitHub Actions configuration changes in the Codex repository. The repository restricts uploads to CI configuration, so users must request a temporary role through go/workflow-approvals. When a push is expected to fail, the skill still attempts it to verify whether the account already has approval. If the push is rejected, it gives the user the approval link and waits for permission propagation to GitHub.
Identifies pushes involving .github/**/*.yml and related files; attempts a push when the repository restriction is expected; handles rejection caused by CI configuration permissions; shares go/workflow-approvals with the user and asks them to return control after approval has propagated to GitHub.
- A Codex repository contributor needs to push a change to a GitHub Actions workflow.
- A developer receives a push rejection for CI configuration and needs to determine whether temporary approval is missing.
- A user has requested workflow approval and must resume the push after the permission reaches GitHub.
Pros & cons
- Provides a defined approval path for restricted CI configuration pushes.
- Attempts the push to verify whether the account already has the required permission.
- Explicitly states that the agent cannot request an exemption on the user's behalf.
- Its documented scope is the Codex repository's CI push restriction, not general CI/CD administration.
- Progress depends on the user requesting temporary approval and waiting for propagation to GitHub.
- The source provides no standalone test suite, platform matrix, or detailed error-handling documentation.
How to install
The skill is located at .codex/skills/pushing-ci-changes/SKILL.md in the Codex repository. The README does not document a separate installation procedure for this individual skill; it is part of the repository's skill collection. The README documents Codex CLI installation, including npm install -g @openai/codex, followed by running codex.
How to use
In a Codex session using this skill, request a CI configuration push, for example: “Push my changes to .github/workflows/example.yml.” If the push is rejected by the repository restriction, follow the provided go/workflow-approvals process and return control after the approval has propagated to GitHub. The source does not document a dedicated trigger syntax.