GitHub CI Agents

Common patterns

Workflow skeleton

name: Agent eval
on:
  pull_request:
    branches: [main]
permissions:
  contents: read
jobs:
  eval:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run eval suite
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
        run: python -m evals.run --smoke

Secrets

• Store keys in GitHub Actions secrets or OIDC — never in workflow YAML values
• Separate staging vs production keys
• Minimum permissions on GITHUB_TOKEN

PR review agents

• Post summary comment + inline suggestions only on changed files
• Block merge only on objective checks (tests, eval pass) — not subjective tone
• Rate-limit comments to avoid noise

Cursor SDK in Actions

- name: Run Cursor agent
  env:
    CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}
  run: npx tsx scripts/run-agent.ts

Script should: create agent → prompt → wait → export diff artifact.

Safety

• pull_request_target only when you understand fork secret exposure
• Do not run untrusted code from fork PRs with secrets
• Require human approval for write operations to repo

Pair with evaluate-agent-quality and cursor-sdk-automation.