[upstream-sync] .github/workflows/pr-skill-scan.yml from K-Dense-AI/scientific-agent-skills@9c9bd2e9 [unknown]

upstream/K-Dense-AI-scientific-agent-skills/catalogue/.github/workflows/pr-skill-scan.yml

@@ -0,0 +1,124 @@
+---
+title: "Pr Skill Scan"
+task: ""
+lineage_type: import
+upstream_source: https://github.com/K-Dense-AI/scientific-agent-skills/blob/9c9bd2e9/.github/workflows/pr-skill-scan.yml
+upstream_sha: 9c9bd2e9
+imported_at: 2026-06-26
+prompt_class: unknown
+upstream_changes: accepted
+author: upstream
+validated: false
+---
+
+name: PR Skill Scan
+
+on:
+  pull_request:
+    paths:
+      - "skills/**"
+      - "scan_skills.py"
+      - "scan_pr_skills.py"
+      - "pyproject.toml"
+      - "uv.lock"
+      - ".github/workflows/pr-skill-scan.yml"
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: pr-skill-scan-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    name: Scan changed skills
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+
+    steps:
+      - name: Checkout PR
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Detect changed skills
+        id: changed
+        run: |
+          set -euo pipefail
+          BASE_SHA="${{ github.event.pull_request.base.sha }}"
+          HEAD_SHA="${{ github.event.pull_request.head.sha }}"
+          echo "Base: $BASE_SHA"
+          echo "Head: $HEAD_SHA"
+
+          # Files added/copied/modified/renamed under skills/<skill>/...
+          CHANGED_FILES=$(git diff --name-only --diff-filter=ACMR "$BASE_SHA" "$HEAD_SHA" -- 'skills/**' || true)
+          echo "Changed files under skills/:"
+          echo "$CHANGED_FILES"
+
+          # Derive unique top-level skill directories and keep only those that still exist with a SKILL.md
+          SKILL_DIRS=$(echo "$CHANGED_FILES" \
+            | awk -F/ 'NF>=2 && $1=="skills" {print $1 "/" $2}' \
+            | sort -u)
+
+          EXISTING=""
+          for d in $SKILL_DIRS; do
+            if [ -f "$d/SKILL.md" ]; then
+              EXISTING="$EXISTING $d"
+            fi
+          done
+          EXISTING=$(echo "$EXISTING" | xargs || true)
+
+          echo "Skill dirs to scan: '$EXISTING'"
+          echo "skill_dirs=$EXISTING" >> "$GITHUB_OUTPUT"
+
+      - name: Set up uv
+        if: steps.changed.outputs.skill_dirs != ''
+        uses: astral-sh/[email protected]
+        with:
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+          python-version: "3.13"
+
+      - name: Install dependencies
+        if: steps.changed.outputs.skill_dirs != ''
+        run: uv sync --python 3.13
+
+      - name: Run scanner on changed skills
+        if: steps.changed.outputs.skill_dirs != ''
+        id: scan
+        env:
+          SKILL_SCANNER_LLM_API_KEY: ${{ secrets.SKILL_SCANNER_LLM_API_KEY }}
+          SKILL_SCANNER_LLM_MODEL: ${{ vars.SKILL_SCANNER_LLM_MODEL || 'claude-sonnet-4-6' }}
+        run: |
+          uv run python scan_pr_skills.py \
+            --output pr_scan_comment.md \
+            --fail-on HIGH \
+            ${{ steps.changed.outputs.skill_dirs }}
+
+      - name: Prepare no-op comment
+        if: steps.changed.outputs.skill_dirs == ''
+        run: |
+          cat > pr_scan_comment.md <<'EOF'
+          <!-- skill-security-scan -->
+          ## 🛡️ Skill Security Scan
+
+          No skill directories (with a `SKILL.md`) were changed in this PR — nothing to scan.
+          EOF
+
+      - name: Upload scan comment as artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: pr-skill-scan-comment
+          path: pr_scan_comment.md
+          if-no-files-found: ignore
+
+      - name: Post or update PR comment
+        if: always() && hashFiles('pr_scan_comment.md') != ''
+        uses: marocchino/sticky-pull-request-comment@v2
+        with:
+          header: skill-security-scan
+          path: pr_scan_comment.md