agentclash-ci-release-gate

Files (1)

• SKILL.md

SKILL.md (first lines)

# AgentClash CI Release Gate

## Purpose
Wire an AgentClash candidate build/deployment into a repo-tracked CI manifest, compare it against a baseline run, and turn the release gate verdict into CI status.

## Use When
- A pull request or mainline workflow should run AgentClash only when relevant files or labels match.
- A user needs a `.agentclash/ci.yaml` manifest for a candidate agent, workload, baseline, gate, and regression promotion policy.
- CI should fail on AgentClash release gate failures, warnings, insufficient evidence, setup errors, run timeouts, or candidate run failures.
- A GitHub Actions workflow should use the repo-local `.github/actions/agentclash-ci` composite action.

## Do Not Use When
- The agent build spec does not exist yet; use `agentclash-agent-build-author`.
- Runtime profiles, provider accounts, model aliases, or workspace tools are not configured; use `agentclash-runtime-resources-setup`.
- The challenge pack or input set is not validated and published; use the challenge-pack skills first.
- The task is only to read scorecards or failure evidence from an existing run; use `agentclash-scorecard-reader` or `agentclash-regression-flywheel`.

## Environment
Use hosted production by default:

```bash
export AGENTCLASH_API_URL="https://api.agentclash.dev"
export AGENTCLASH_TOKEN="<token>"
export AGENTCLASH_WORKSPACE="<workspace-id>"
```

In GitHub Actions, pass tokens through secrets or the composite action inputs. Do not print tokens. `ci run` exits with code `10` and a JSON error envelope when workspace context is missing, so set `AGENTCLASH_WORKSPACE`, pass `--workspace`, or use saved CLI workspace config.

## Manifest Shape
Create a sample with:

```bash
agentclash ci init .agentclash/ci.yaml
agentclash ci init .agentclash/ci.yaml --force
```

The CLI sample manifest is:

```yaml
version: 1
trigger:
  paths:
    - .agentclash/agent.json
    - prompts/**
    - tools/**
  labels:
    - agentclash/eval
candidate:
  build:
    agent_build_id: 00000000-0000-0000-0000-000000000001
    spec_file: .agentclash/agent.json
  deployment:
    name: pr-candidate
    runtime_profile_id: 00000000-0000-0000-0000-000000000002
    provider_account_id: 00000000-0000-0000-0000-000000000003
    model: gpt-5.5
evaluation:
  challenge_pack_version_id: 00000000-0000-0000-0000-000000000005
  input_set_id: 00000000-0000-0000-0000-000000000006
  regression_suites:
    - 00000000-0000-0000-0000-000000000007
baseline:
  run_id: 00000000-0000-0000-0000-000000000008
  refresh: manual
  max_age_days: 30
gate:
  fail_on: regression
regressions:
  promote_failures: proposed
```

Exact fields the current CLI parses:

- `version`: must be `1`.
- `trigger.paths`: required, nonblank doublestar globs; `trigger.labels`: optional labels that can force a run.
- `candidate.build.agent_build_id`: required existing agent build ID.
- `candidate.build.spec_file`: required relative path inside the repository; absolute paths and `..` escapes are rejected by `ci run`.
- `candidate.deployment.name`: optional deployment name; if blank, `ci run` generates `agentclash-ci-<unix>`.
- `candidate.deployment.runtime_profile_id`: required.
- `candidate.deployment.provider_account_id` and `candidate.deployment.model`: optional individually, but required together when `ci run` creates the candidate deployment. Remote validation checks that the provider account exists.
- `evaluation.challenge_pack_version_id`: required.
- `evaluation.input_set_id`, `evaluation.regression_suites`, and `evaluation.regression_cases`: optional; blank regression entries are invalid.
- `baseline.run_id`: locked baseline run, preferred for PR gates.
- `baseline.run_agent_id`: optional but only valid with `baseline.run_id`.
- `baseline.deployment_id`: moving baseline selector; mutually exclusive with `baseline.run_id`.
- `baseline.refresh`: optional `manual`, `propose`, or `auto_on_main`; default behavior is `manual`.
- `baseline.max_age_days`: optional non-negative freshness limit; `0` means no age check.
- `gate.fail_on`: required, one of `regression`, `warning`, or `insufficient_evidence`.
- `gate.policy_file`: optional schema field, but the current `agentclash ci run` implementation does not read or post it.
- `regressions.promote_failures`: required, one of `disabled`, `proposed`, or `auto_on_main`.

Important gate fidelity note: today `ci run` posts `baseline_run_id`, `candidate_run_id`, and optional run-agent IDs to `/v1/release-gates/evaluate`. It does not pass `gate.fail_on`, does not load `gate.policy_file`, and has no `--fail-on` or `--policy-file` flag. The backend normalizes an empty policy to the default release gate policy. Do not claim manifest gate fields customize evaluation until the CLI source wires that behavior.

## Validation Commands
Validate locally first:

```bash
agentclash ci validate .agentclash/ci.yaml
agentclash ci validate .agentclash/ci.yaml --json
```

Use remote validation when workspace credentials are available:

```bash
agentclash ci validate .agentclash/ci.yaml --remote --json
```

Structured `validate` output includes:

```json
{
  "path": ".agentclash/ci.yaml",
  "valid": true,
  "manifest": {},
  "remote": {
    "workspace_id": "<WORKSPACE_ID>",
    "valid": true,
    "checks": [
      {

From agentclash/agentclash, MIT.

More from agentclash/agentclash