CI Log Triage — offline CLI

Download note: the hosted source is named triage_ci.txt because static hosting permits text files. Save it locally as triage_ci.py before running it.

The CLI uses only Python 3 standard-library modules. It does not make network requests.
Treat its output as heuristic investigation hints, not a diagnosis.

Run from a file:
  python3 triage_ci.py failing-job.log

Run from stdin and emit JSON:
  cat failing-job.log | python3 triage_ci.py --format json

Before sharing output, review the sanitized excerpt. Automatic redaction catches common
token shapes but cannot guarantee removal of every credential or private value.

Published browser version: https://agent-ci-log-triage.constalabs.com/
Scoped repair intake: https://agent-automation-intake.constalabs.com/

CI context collector

Save collect_ci_context.txt locally as collect_ci_context.py, then run:
  python3 collect_ci_context.py /path/to/project -o ci-context.json

For hashes, sizes, and tool versions without workflow or lockfile contents:
  python3 collect_ci_context.py /path/to/project --metadata-only -o ci-context.json

The collector only considers allowlisted CI/workflow and dependency files, excludes
symlinks and known credential paths, executes no project code, and makes no network
requests. Redaction is best-effort: always review the JSON before sharing it.

Sample paid-deliverable format

Open sample-deliverable.txt to see the evidence, repair plan, security notes, acceptance criteria, and confidence boundaries used for a scoped CI repair. It is illustrative and is not presented as a completed customer order.

GitHub Actions permission auditor

Save audit_workflow_permissions.txt locally as audit_workflow_permissions.py, then run:
  python3 audit_workflow_permissions.py /path/to/project

For machine-readable output:
  python3 audit_workflow_permissions.py /path/to/project --format json

The auditor performs static heuristic checks only. It does not execute workflow code or make network requests. It flags pull_request_target checkouts of pull-request head code, broad write permissions, secret references in privileged workflows, persisted checkout credentials, and actions not pinned to full commit SHAs. Review every finding against the repository intent before changing a workflow.

Scoped CI repair inquiry

If the local tools are not enough, use the privacy-conscious intake at https://agent-ci-triage-intake.constalabs.com/. Do not send credentials or unsanitized private logs. A submission is an inquiry only, not an order or payment.

CI log redactor

Save redact_ci_log.txt locally as redact_ci_log.py, then run:
  python3 redact_ci_log.py build.log -o sanitized.log --report

The tool works locally without network access. Pattern-based redaction is not a guarantee: inspect sanitized.log manually and never submit credentials, private keys, cookies, customer data, or unnecessary private logs.

Safe CI case preparer

Save prepare_ci_case.txt as prepare_ci_case.py beside redact_ci_log.py, then run:
  python3 prepare_ci_case.py build.log --repository REPOSITORY --check CHECK --output case.md

The tool works locally, redacts the log, selects bounded failure context, and creates a private Markdown draft for manual review. It does not send data, and pattern-based redaction cannot guarantee removal of every secret.