Improve your GitHub Actions setup with/ci-score
Install the agent skill to check your repo against best practices and enforce them.
Runs on your machine. Nothing is scored on demand here.
CI Score Leaderboard
Popular public repositories scored with the ci-score skill, ci-score-v0.1.3. Collected July 29, 2026.
- 01vitejs/vite (opens in new tab)100/100
- 02immich-app/immich (opens in new tab)89/100
- 03vercel/next.js (opens in new tab)82/100
- 04react/react (opens in new tab)78/100
- 05calcom/cal.diy (opens in new tab)73/100
- 06fastapi/fastapi (opens in new tab)67/100
- 07usememos/memos (opens in new tab)63/100
- 08psf/requests (opens in new tab)56/100
- 09discordjs/discord.js (opens in new tab)45/100
- 10coollabsio/coolify (opens in new tab)22/100
Where the checks come from, and how they add up.
CI Score gauges best-practice adherence on CI speed and gate hygiene: a straightforward pass/fail rubric of best-practice checks computed from a repo's workflow configuration.
Every check is one of the GitHub Actions best practices we publish a guide for. Those guides cite GitHub’s own documentation, show real repositories already doing it, and several link the pull request where we shipped the fix. The score asks one question per guide: does this repository do it?
Read the workflow files
Every check is a configuration fact: something present or absent in the repository's own GitHub Actions YAML, and in the composite actions and build-tool config it references.
Mark each check pass, fail, or not applicable
A check whose subject does not exist in the repo (no build tool, no OIDC, no third-party actions) is not applicable and leaves the denominator entirely, and a mechanism the scan cannot see is never marked as a failure.
Divide and round
The score is checks passed divided by checks applicable, times 100, rounded half up. Nothing is computed at render time: a page prints the number the scorer stamped, or it prints nothing.
11 best practices
Each one is something present or absent in the repository’s own files, so its maintainer can check any result against their own YAML in under a minute.
Frequently asked questions
Does the score predict how fast my CI runs?
No. It measures configuration adherence to CI best practices, not speed. A repository can score well and still have slow CI. Wall-clock diagnosis is what /ci-speedup does.
Why a number and not a letter grade?
With at most eleven applicable checks, the instrument cannot separate adjacent values. A letter would imply a precision the rubric does not have, so published pages render the number only.
Does any of this reach StarSling?
No. ci-score reads your workflow YAML from a local checkout. Nothing is sent to StarSling, and you do not need a StarSling account to run it.
What happens to a check my repository cannot meet?
A check whose subject does not exist in your repo, such as no build tool, no OIDC, or no third-party actions, is not applicable and leaves the denominator entirely. A mechanism the scan cannot see is never counted as a failure.
Will it change my repository?
Only after you choose a finding to fix. ci-score writes its findings and a ready-to-run fix prompt into a report; your coding agent applies the changes you choose, in your working tree for review. ci-score never commits, pushes, or opens a pull request on its own.
Fix slow GitHub Actions with /ci-speedup
ci-speedup samples your own Actions runs, finds the check that gates your pull requests, and hands your coding agent the evidence to shorten it.
Measured in minutes from your real runs.
See how ci-speedup worksClose critical attack vectors in GitHub Actions with /ci-secure
ci-secure scans your GitHub Actions workflows for the ten critical attack vectors, explains each finding as a plain-English attacker scenario, and fixes the ones you pick on your working tree for review.
Scanned against the ten critical attack vectors.
See how ci-secure worksScore your own repo on your own machine.
Run ci-score against a local checkout. It writes a report with your score, every check and the evidence behind it, and a ranked fix for each gap with a prompt for your coding agent.