Actual-sync: Command for Claude Code

CI Health Monitor

Check all GitHub Actions workflows for failures, create P0 tickets, gate each ticket, and auto-fix safe failures.

Process

Execute these phases in order. Stop early if all workflows are passing.

Phase 1: Discover and assess workflows

Auto-discover all workflow files:

ls .github/workflows/*.yml .github/workflows/*.yaml 2>/dev/null

Determine each workflow's run branch by its trigger — this is the common failure of a naive --branch development filter:

• push / pull_request workflows (ci-cd.yml, codeql-analysis.yml): runs are attributed to the branch that triggered them — check development (integration branch), and also main for the release-path workflows (auto-release.yml runs only on main).
• schedule-triggered workflows (dependency-update.yml daily cron, any CodeQL cron): GitHub attributes scheduled runs to the default branch (main), NOT to the branch the workflow checks out. A --branch development query returns zero runs for these and silently reports them green — the exact failure this monitor exists to catch. Query these without --branch (take the latest run regardless of branch), or with main.

Inspect each workflow's on: block to classify it, then query the latest run accordingly:

# push/PR workflow — filter by the branch it runs on:
gh run list --workflow <workflow-file> --branch <branch> --limit 1 --json databaseId,conclusion,createdAt,name,headBranch,event -q '.[0]'

# schedule-triggered workflow — do NOT filter by branch (runs are attributed to main):
gh run list --workflow <workflow-file> --limit 1 --json databaseId,conclusion,createdAt,name,headBranch,event -q '.[0]'

Include event and headBranch in the output so a misclassification is visible (a schedule event showing headBranch: main confirms the no-filter path was needed).

For each failing run, get failed jobs and error logs:

gh run view <RUN_ID> --json jobs --jq '.jobs[] | select(.conclusion == "failure") | .name'
gh run view <RUN_ID> --log-failed 2>&1 | tail -150