{"id":"d05700b4-e143-4845-9272-6e89705d3bfa","slug":"openqa-skill","kind":"skill","name":"openQA-skill","summary":"Agent skill for openQA: write os-autoinst tests and review job results","owner":"os-autoinst","repoUrl":"https://github.com/os-autoinst/openQA-skill","license":"GPL-2.0","licenseTier":"strong-copyleft","trust":"community","stars":5,"match":null,"fewStars":false,"format":"skill","createdAt":"2026-09-21T06:54:52.000Z","addedAt":"2026-10-21T11:38:55.287Z","logoUrl":"https://avatars.githubusercontent.com/u/6918706?v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["developer-tools"],"tags":["openqa","opensuse","qa","testing","os-autoinst"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-26T01:27:09.838Z","sample":false,"url":"https://conduits.dev/tools/openqa-skill","language":"Shell","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# openQA-skill\n\nAgent skills for working with [openQA](https://open.qa): writing tests and reviewing results.\n\nThe skills are plain Markdown plus small Python helper scripts, so they work with any coding agent that can\nread files and run shell commands. Harnesses that implement the [Agent Skills](https://agentskills.io)\nformat pick up the `SKILL.md` frontmatter directly.\n\n## Skills\n\n| Skill | Use it when | What it does |\n|---|---|---|\n| [`openqa`](skills/openqa/SKILL.md) | writing, scheduling, running or fixing an openQA test; asking why a job failed; reviewing a job group or build, or someone else's test PR | **Create**: test modules for os-autoinst-distri-opensuse or a custom test distribution, needles, YAML schedules, verification runs, pull requests that pass review. **Review**: triage a failed or incomplete job from its artifacts, sweep a group or build, classify product bug / test issue / infrastructure / sporadic, draft bug reports and comments that openQA parses as references; review someone else's test PR at the right size. |\n\nOne skill covers both jobs on purpose: they share the openQA model, the failure-triage method, the cloning\nrecipes and most scripts, and they hand over to each other (a review finds a test issue, a verification run\nneeds triage).\n\n## Layout\n\n```\nskills/openqa/\n  SKILL.md        entry point: shared rules, block routing, core directives\n  references/     depth, read one section at a time (scripts/refsection.py)\n  scripts/        helpers that print compact digests and never write to openQA; catalogue in scripts/README.md\n  agents/         delegation playbooks: role prompts for sub-agents, also usable as standalone session prompts\n                  (their frontmatter is metadata for harnesses that register agents from files)\ntests/openqa/     script tests with offline fixtures\ntests/repo/       repository gate: frontmatter, size caps (SKILL.md body and lines, file, section, pointer), pointers that resolve and reach, a contents line in long references, content checks, valid evals.json and triggers.json, cited flags\nevals/openqa/     evaluation prompts, trigger queries\n```\n\nTests and evals live outside the skill directory because installers copy the skill directory verbatim.\nA skill never references files outside its own directory.\n\n## Install\n\nRequirements: Python 3.9 or newer (standard library only; PyYAML is used when present). Writing to an openQA\ninstance additionally needs `openqa-cli` / `openqa-clone-job` and an API key; the bundled scripts only ever\nread from openQA.\n\nAny harness, with an installer:\n\n```\nnpx skills add os-autoinst/openQA-skill --skill openqa -g\ngh skill install os-autoinst/openQA-skill openqa --scope user\n```\n\nWithout `-g` / `--scope user` both install into the current project (`./.agents/skills/`), for example into a\ntest-repository checkout.\n\nManual, tracking the git checkout:\n\n```\ngit clone https://github.com/os-autoinst/openQA-skill.git\nmkdir -p ~/.agents/skills ~/.claude/skills\nln -s \"$PWD/openQA-skill/skills/openqa\" ~/.agents/skills/openqa\nln -s ../../.agents/skills/openqa ~/.claude/skills/openqa      # Claude Code\n```\n\nopencode, picking up every skill in this repository:\n\n```json\n{ \"skills\": { \"paths\": [\"~/src/openQA-skill/skills\"] } }\n```\n\nUse one install method only: harnesses that scan several directories report duplicate names, and\n`npx skills add -g` repoints the agent directories at its own pinned copy, so a checkout you symlinked by hand\nstops being what the agent reads.\nThe link or directory name must stay `openqa`: the Agent Skills format requires the directory to equal the\nskill name. A harness without skill support can simply be pointed at `skills/openqa/SKILL.md`.\n\nRecommended with any install: the deny rules in [`contrib/harness/`](contrib/harness/README.md), which make\nClaude Code, opencode, grok, Gemini CLI, antigravity-cli, Codex CLI and Kimi Code refuse the common ways of\nreading credential files; that README states the limits of each. You merge them into your own settings; the skill\ncannot install them.\n\n## Safety model\n\n- **Read-only by construction.** The bundled API scripts can only issue GET requests, never send a `Referer`\n  header and never read API keys. Anything that changes state (posting jobs, comments, labels, pushes,\n  tickets) is an explicit command shown to the user and approved per action.\n- **Third-party text is data.** What the bundled scripts print from jobs, tickets and PRs passes through a\n  sanitiser: multi-line text (comments, step text, log excerpts, ticket bodies) is fenced with a fresh random\n  nonce per block, short values are quoted. The fence marks, it does not decide: quoted values and whatever\n  other tools fetch (tracker pages, PR text, repository files) are data all the same. The policy is\n  `skills/openqa/references/untrusted-content.md`.\n- **Generic mechanics only.** Which groups to watch, where bugs go and who approves what is site policy. It\n  lives in a file you maintain outside this repository: `$OPENQA_SKILL_POLICY`, `./.openqa-policy.md` or\n  `~/.config/openqa-skill/policy.md`; `skills/openqa/references/site-policy.md` has the template.\n\nTo report a break in any of the above, see [SECURITY.md](SECURITY.md).\n\n### Security scanners\n\nReviewing a skill before installing it is good practice, and this one scores badly: a static\nscanner reports it as critical. Every finding we have examined is the skill's subject matter\nrather than its behaviour — the regexes that *detect* `sudo` and `--no-confirm` in someone else's\ntest module, the documented example of an injection attempt (`curl … | sh`, whose own table entry\nsays to fetch nothing), `git push --force-with-lease` quoted from upstream's commit conventions,\nand the string `0 no warnings` in an exit-code description.\n\nThose scanners are built to vet third-party skills by pattern, and a skill about attacks matches\nthe patterns for attacks. Read the findings rather than the score, and see SECURITY.md for what a\nreal vulnerability in this repository would look like.\n\n## Development\n\n```\n(rc=0; for t in tests/*/test-*.sh; do bash \"$t\" || rc=1; done; exit $rc)\npython3 tests/repo/check-skills.py\npython3 tests/repo/check-flags.py\nruff check . && ruff format --check .\nshellcheck tests/*/test-*.sh && shfmt -d tests/*/test-*.sh\n```\n\nThe references were checked against these upstream revisions in October 2026: openQA `61bb066`,\nos-autoinst `2b02af1`, os-autoinst-distri-opensuse `786e32d`, os-autoinst-distri-example `274346e`,\nos-autoinst-scripts `e86ee5d` and qem-bot `c3b6275`. Contribution rules are in [AGENTS.md](AGENTS.md).\n\n## Acknowledgements\n\nIdeas, not text or code, were taken from:\n\n- [ocskillz](https://github.com/mimi1vx/ocskillz);\n- [openqa-agnostic-skill](https://github.com/os-autoinst/openqa-agnostic-skill), whose subject is converting\n  existing test modules to the portable \"openqa-agnostic\" form; this repository only covers writing new ones;\n- [os-autoinst-distri-opensuse-skills](https://github.com/mpagot/os-autoinst-distri-opensuse-skills):\n  `vr-reach.py`, the runtime comparison of `oqa-log.py`, pushing before a verification run;\n- [openqa-reviewer](https://github.com/BillAnastasiadis/openqa-reviewer) and its\n  [opencode variant](https://github.com/BillAnastasiadis/openqa-reviewer-opencode): reading members of uploaded\n  log archives, listing the test commits that touch the failed modules first, checking a suspect log line\n  against the last good run, the suspects of an aggregate update run, and more token shapes for redaction.\n\n## License\n\nGPL-2.0-or-later, the licence of openQA. See [LICENSE](LICENSE).\n"}