Skip to main content

​
Overview

OpenSRE can inspect failing GitHub Actions checks on a pull request or named branch, apply a code fix, commit it, push it, and wait for the new checks. It can also fix failing CI on a branch with no PR — say “fix the CI on main” and OpenSRE inspects the failing workflow runs on that branch’s head commit, applies a fix in a linked worktree, and pushes a fresh repair branch.
This is mutating. OpenSRE asks before checking out or creating a worktree, editing files, committing, and pushing.

​
Prerequisites

  • Local checkout of the same repository as the PR (origin must match)
  • gh on PATH for checks and logs
  • GitHub token with repo write access plus workflow/check read access (GITHUB_TOKEN / GH_TOKEN)
  • A coding-agent backend available (CODING_AGENT=auto by default)

​
Setup

There is no dedicated integrations setup target for this tool. Configure GitHub access and the coding workspace:
OpenSRE uses the configured coding-agent backend through CODING_AGENT=auto by default.

​
Credentials

​
Tools

Related skill: fixing-github-ci. Run /demo in the interactive shell for the guided CI/CD onboarding menu; its recommended first option is CI/CD analytics.

​
Use it

In the interactive shell:

​
What happens

  1. OpenSRE reads PR metadata or the latest failing Actions run on the target branch.
  2. It fetches compact log excerpts for failing Actions jobs.
  3. It verifies the local checkout’s origin matches the target repository.
  4. It refuses fork PRs because it only pushes to branches in the same repository.
  5. After approval, it checks out the PR head branch or creates a temporary linked git worktree for a branch target such as main.
  6. If GitHub reports the PR as conflicted with its base branch, it merges the base branch into the PR branch first. Conflicts go to the coding agent, lockfiles are regenerated rather than hand-merged, and the merge is committed only when no conflict remains.
  7. If files changed, it commits only the fix-run changes and pushes the PR branch or fresh repair branch.
  8. It verifies the exact pushed commit, allows one minute for its checks to register, waits for applicable workflows, and reports whether they passed, failed, were superseded by another push, or did not finish within 15 minutes. If GitHub still reports the pushed commit as conflicted, it says so immediately instead of waiting, because no checks will start.
If no checks are failing, OpenSRE says so and does not push. The one exception is a PR that conflicts with its base branch: GitHub never starts checks for it, so OpenSRE treats bringing the base branch in as the fix. It does not open a new PR. Merged or closed PRs are refused — if the failure already landed on the base branch, ask for the branch itself (“fix the CI on main”). In branch mode OpenSRE reads the failing workflow runs on the branch’s head commit, creates a linked worktree on a fresh opensre/ci-fix-* repair branch, pushes that branch, and waits for the pushed commit’s own workflow runs. It does not push directly to protected branches such as main.

​
Verify

There is no dedicated integrations verify target. Confirm readiness by:
  1. opensre integrations verify github (or a valid GITHUB_TOKEN / GH_TOKEN)
  2. gh available on PATH
  3. Local checkout origin matches the PR repository
  4. A coding agent CLI is installed/logged in if auto mode needs one

​
Troubleshooting

​
Security

  • Requires explicit confirmation before mutating the working tree or pushing.
  • Pushes only to the existing PR head branch in the same repository.
  • For branch targets, creates and pushes a fresh repair branch instead of pushing directly to main.
  • Store tokens in .env or your secret manager — not in source control.