Gate skill quality in CI
Run a review on every pull request and fail the build when a skill scores below your threshold.
A review tells one person whether a skill is good. Gating in CI applies that check to everyone, automatically, so a substandard skill cannot reach your shared repository in the first place.
Fail a build below a threshold
Pass --threshold to exit non-zero when a review score falls below your bar:
tessl review run ./my-skill --workspace engteam --threshold 80--threshold takes a 0-100 integer. The default is 0, which never fails. Any value above 0 causes the command to exit non-zero - and fail the CI step - when the score falls below it.
Add --json when you need machine-readable output, for example in a script that reads the score programmatically:
tessl review run ./my-skill --workspace engteam --json --threshold 80--workspace is required when --json is set, because a non-interactive run cannot prompt for one. In practice, always pass --workspace in CI regardless.
You can also re-check an existing run against a threshold without starting a new review:
tessl review view <run-id> --json --threshold 80Authenticating in CI
A review runs against your workspace, so CI needs to authenticate without an interactive login. Create an API key for your workspace:
tessl api-key create --workspace engteamSet the key as a repository secret named TESSL_TOKEN. The CLI and the Tessl GitHub Action both read it from that variable.
Keys expire after 30 days
Every API key expires. Unless you pass --expiry-date or --ttl, the key you just created is valid for 30 days from creation, and the CLI prints the exact date when it issues the key.
This matters most in CI, because nothing fails at the moment the key expires. Your pipeline stays green for a month and then starts failing authentication on a run that changed nothing. Put a reminder in your calendar, or pass a longer --expiry-date when you create the key:
You can also set a duration using the local clock just before the creation request, such as --ttl 4w for four weeks, --ttl 2mo for 60 days, or --ttl 1y for 365 days. Use one expiry flag at a time.
Rotating a CI key
Rotation is always something you run from your own machine, never from inside the pipeline. An API key cannot create another API key, which means a leaked CI credential cannot renew itself. That is deliberate.
Two paths, depending on whether the key has already expired.
The key has already expired. Your pipeline is broken, so there is no window to protect. Replace it under the same name:
The key is still valid. Create the replacement under a new name first, confirm a run passes with it, and only then remove the old key. Your pipeline is never without a working credential:
Key names are unique per workspace, which is why the second path needs a different name rather than reusing ci.
Both paths involve reading your pipeline to find which secret feeds TESSL_TOKEN, and that secret can be named anything. tessl agent can do that part for you: ask it to rotate your Tessl CI key and it finds the secret, shows you a plan naming where each fact came from, and waits for a go-ahead before it changes anything.
Nothing to install. The skill behind this ships with the CLI.
Use tessl api-key list --workspace engteam --json when you want key ids, roles, or expiry dates in a script.
Where the key lives on each CI platform
Whatever your platform, the CLI reads the key from the TESSL_TOKEN environment variable. What changes is where the secret behind that variable is stored. The secret itself can be named anything, so check your pipeline definition to see which one it maps to TESSL_TOKEN.
GitHub Actions
Settings > Secrets and variables > Actions
gh secret set <secret>
GitLab CI
Settings > CI/CD > Variables
glab variable set <variable>
CircleCI
Project Settings > Environment Variables
Buildkite
Pipeline Settings > Secrets
bk secret set <secret>
Azure Pipelines
Pipelines > Library
az pipelines variable update
Jenkins
Manage Jenkins > Credentials
Bitbucket Pipelines
Repository settings > Pipelines > Repository variables
TeamCity
Build Configuration > Parameters
When a key expires, the CLI names your platform and its secret location in the error, so you do not have to come back to this table.
Run it on pull requests
Tessl publishes a GitHub Action that installs the CLI and runs this gate on pull requests, so you do not have to wire up the CLI by hand. For the complete workflow, see Review, lint & publish with GitHub Actions.
Next
Define your own quality standards - gate against your organisation's own rubric, not just the default.
Check a skill's quality using review - full reference for
tessl review run, score interpretation, and applying fixes.
Last updated