> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/skills/skillevaluator/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/skills/skillevaluator/_mcp/server.

# GitHub Actions

> Bring SkillEvaluator to your GitHub repository with a reusable workflow, clear results and optional PR feedback.

Bring skill evaluation to your GitHub repository with one workflow file.
Choose your skill folders; pull requests check changed skills automatically.
The shared image includes **Tier 1 and SkillSpector security scanning**.

#### [Use the CLI](/skills/skillevaluator/cli-onboarding)

Answer a few questions. The CLI prepares checks, optional hosted feedback and a setup PR.

#### [Copy the workflows](#get-started)

Copy the ready-to-use templates. No local CLI installation required.

## Get started

### Copy the ready-to-use template

Open [skill-checks.yml](https://github.com/NVIDIA/SkillEvaluator/blob/main/ci/bundles/0.7.2/skill-checks.yml)
from the [ready-to-use templates](https://github.com/NVIDIA/SkillEvaluator/tree/main/ci/bundles/0.7.2).
Use GitHub's **Raw** view to copy it into `.github/workflows/skill-checks.yml`.
The template already supplies pinned workflow and image versions.

### Point it at your skills

Edit these inputs in the downloaded file:

**`Your choices in skill-checks.yml`**

```yaml title="Your choices in skill-checks.yml"
with:
  paths: |-
    skills
    .agents/skills
  min-score: 70
  scan-mode: auto
  llm: false
```

Use your own skill folders. Keep `auto` to scan changed skills in PRs;
`all` checks the configured collection. If your default branch is not `main`,
update the template's push branch.

### Commit the workflow and open a skill PR

Merge the workflow onto your default branch, then open a PR changing a selected
skill. GitHub Actions must be enabled and allowed to use the referenced
reusable workflow and actions.

> **Note**
>
> The released template provides **checks and downloadable reports**.
> Hosted reports and PR comments need the [optional publisher setup](#enable-pr-comments).
> The same release also includes the optional publisher template.

#### I prefer to inspect the source templates

Browse the public [template catalog](https://github.com/NVIDIA/SkillEvaluator/blob/main/ci/templates/README.md)
and [skill-checks.yml source](https://github.com/NVIDIA/SkillEvaluator/blob/main/ci/templates/skill-checks.yml).
Source templates contain placeholders. Use the release-generated file when
onboarding; do not substitute `main` or `latest` for its immutable versions.

## See what happened

| Start here                                     | Then open                                                |
| ---------------------------------------------- | -------------------------------------------------------- |
| **PR → Checks**                                | The `skills / Tier 1 scan` result and its short summary. |
| **Actions → Skill checks**                     | The run and downloadable report artifact.                |
| **PR → Conversation**, with publishing enabled | The updated bot comment and **Open full report** link.   |

Download `skill-evaluator-tier1-attempt-N`, extract it, and open `index.html`.
Failed scans retain their available reports too. The HTML separates the
**verdict** from the **quality score**: a high score does not override a failed
required security or schema check.

![SkillEvaluator report table showing the skill verdict, score and link to its detailed report](/skills/skillevaluator/_fern-files/_img/77c006735e57d00fe906d37d294b34a7e16c1bce354441872a5cf05abcc54333.webp)

### On the pull request

With publishing enabled, one bot comment is updated for new results. Reviewers
see the issue and next step without reading the full Actions log.

**github-actions\[bot]**

**Tier 1 scan result: FAILED**

1 skill · 0 passed · 1 failed · 0 incomplete

| Skill                     | Status | Quality / 100 |
| ------------------------- | ------ | ------------- |
| `skills/glossary-builder` | FAIL   | 98.2 / A      |

**Problem:** Quality score 98.2/100 is below the required 100/100.

**Next step:** Open the skill report and address its quality findings.

**Open full report** · **View workflow run**

Browse the [public report and log examples](https://github.com/NVIDIA/SkillEvaluator/blob/main/ci/examples/README.md)
for more detail. No personal demo-repository access is needed.

## Enable PR comments

The optional publisher hosts the HTML and posts a comment **after deployment
succeeds**. It needs a second workflow plus one-time hosting and approval settings.

#### [Try the guided setup](/skills/skillevaluator/cli-onboarding)

The CLI recognizes an existing single-job scan, keeps its settings and
component version tag, and adds reporting in a setup PR. New repositories
get both workflows.

Copy [publish-skill-reports.yml](https://github.com/NVIDIA/SkillEvaluator/blob/main/ci/bundles/0.7.2/publish-skill-reports.yml)
from the same template folder as your scan workflow. Complete the one-time setup below,
or let the [CLI](/skills/skillevaluator/cli-onboarding) handle it.

#### What does manual publisher setup involve?

Start with the filled-in publisher template and follow the
[publisher setup guide](https://github.com/NVIDIA/SkillEvaluator/blob/main/ci/README.md#optional-hosted-reports-and-pr-feedback).
The main steps are:

1. Enable **Settings → Pages → Source: GitHub Actions** and initialize the
   `gh-pages` report-history branch. For private reports, an administrator
   must also select **Private** site visibility in GitHub's settings; see
   the private-hosting requirements below. Preserve any existing site or history.
2. Add `publish-skill-reports.yml` with your Pages URL. Keep the evaluator
   and publisher versions supplied by the release.
3. Grant the scan workflow `id-token: write`, then approve its exact contents
   in the publisher's `trusted-caller-blobs` input. Compute the value with
   `git hash-object .github/workflows/skill-checks.yml`; refresh it whenever
   that scan file changes.
4. Merge both workflow files into the default branch. Open a new skill PR
   to test checks, hosting and feedback together.

Keep the **Skill checks** workflow name, scan filename and default artifact
name. The publisher uses GitHub's automatic token; organization policies
must allow its permissions and referenced actions. Copying a second file
alone does not finish setup.

#### Who receives a comment, and who can read the report?

Comments are posted on open, current-head PRs from branches in the same
repository. Fork-origin PRs keep their available reports in Actions.
Pages is public unless explicitly configured as private; repository privacy
alone does not make its Pages site private. Reports may contain source
excerpts and unmerged findings. Use downloadable artifacts when public
hosting is unsuitable.

#### Can our private repository publish private reports?

Access-controlled Pages requires a private or internal project repository
owned by a GitHub Enterprise Cloud organization. An administrator first
selects **GitHub Actions** and **Private** in **Settings → Pages**. The
REST API cannot set Pages visibility. Personal repositories cannot host
private Pages.

The CLI verifies the existing private site and uses its assigned
`*.pages.github.io` URL. It accepts an existing SkillEvaluator report site
or a newly configured empty private site, and preserves unrelated websites.
If private hosting is unavailable, choose checks only. See
[private report hosting](/skills/skillevaluator/cli-onboarding#private-report-hosting) for the
guided path and [GitHub's access-control requirements](https://docs.github.com/en/enterprise-cloud@latest/pages/getting-started-with-github-pages/changing-the-visibility-of-your-github-pages-site).

## Fit it into your workflow

#### Will this wait for my existing workflows?

This workflow runs independently. Existing workflows remain separate; it
does not automatically wait for them to finish. Configure explicit workflow
dependencies if your pipeline needs that ordering.

#### Which changes trigger a scan?

`auto` selects affected skills on pull requests. Pushes to the default
branch and manual runs scan the configured collection. `all` scans that
collection each time. No changed skills is a successful **Skipped** result,
not a scanner pass. Changes to shared files outside the skill roots are not
inferred dependencies; use `all` when they should trigger a full scan.
Selection is capped at 100 skills. Timeouts retain completed results and
mark unfinished work incomplete. The workflow scans up to four skills at
once; `scan-workers` accepts 1–16.

#### How do I make this a merge gate?

After the first run, select its scan check in GitHub branch rules. The
current template emits `skills / Tier 1 scan`; use the actual check name
shown in your repository. `min-score` sets the quality threshold; required
security, schema and other checks remain independent. This integration
runs Tier 1 only.

#### The scan finished, but the comment is missing

Confirm setup is on the default branch and the PR is eligible for comments.
Open **Publish skill reports** to see whether deployment completed. If
hosting was skipped, check the scan's `id-token: write` permission and
`trusted-caller-blobs` value. A new scan must use the updated workflow;
rerunning an old job keeps its original workflow. The scan's downloadable
report remains a separate way to inspect available findings.

#### Our organization uses a shared workflow wrapper

Keep the component reference in your existing caller, for example
`your-org/ci/.github/workflows/skill-checks.yml@v3`, then run
`skillevaluator ci init` in each consumer repository. The CLI recognizes
`.github/workflows/skill-checks.yml` with the name **Skill checks** and one
reusable scan job. It preserves inputs, triggers and the version tag while
adding the publisher and any needed scan-job `id-token: write` permission.

The component maintainer must first grant `id-token: write` in the job
calling the evaluator. The CLI checks that prerequisite before applying
reporting setup; a consumer permission alone cannot grant it downstream.

With delegation, the publisher approves the exact component path and tag
in `trusted-wrapper-workflows` and `delegated-evaluator-wrapper`. Updating
`v3` then updates future scans centrally, with no consumer workflow edit.
Published execution receipts record the resolved component and evaluator
commit SHAs for each run. The component still pins its evaluator and image
immutably. Use a full component SHA when you want to hold that version fixed.

Use SkillEvaluator 0.7.2 or later and its reviewed publisher for these delegation inputs; the
archived 0.7.1 publisher does not. Direct callers keep an immutable
evaluator approval. For manual configuration, follow the
[shared-workflow setup](https://github.com/NVIDIA/SkillEvaluator/blob/main/ci/README.md#calling-through-a-shared-workflow)
guide. PR comments follow successful report deployment; private reports
require the private Pages setup described above.

#### Do the checks need an LLM key or network access?

Default Tier 1 checks use no model key. Dependency audits can contact
vulnerability services and submit package metadata; packages are not
installed and build scripts are not run. Optional LLM checks use a separate
[manual workflow](https://github.com/NVIDIA/SkillEvaluator/blob/main/ci/templates/skill-checks-llm.yml),
your provider key and provider charges. They send selected content to that
provider and are outside the default publisher allowlist.

#### [Set up with the CLI](/skills/skillevaluator/cli-onboarding)

See the guided setup and try your first test PR.

#### [GitLab CI/CD](/skills/skillevaluator/gitlab-ci)

Use the shared scanner image with a GitLab pipeline.