Sc Git

/sc-git — GitHub Actions Replacement & Repo CRUD

Use when user wants to stop GitHub Actions cloud minutes burn, audit workflow files across rahmanef63 repos, migrate CI/CD to pre-push hooks + VPS, or do generic repo/workflow CRUD via gh API.

Pre-requisites

• gh CLI authed with repo + workflow + admin:repo_hook scopes
• Local clones live in /home/rahman/projects/ (some repos remote-only — skill handles both)
• VPS srv614914 accessible via SSH for runner/cron subcommands

CORE RULES

1. Never destructive without backup: before patching any .github/workflows/*.yml, copy to *.yml.bak. Never delete .bak files.
2. Never force-push, never push directly to main: all changes land via new branch chore/reduce-github-actions-usage. PR is user's call.
3. Never touch secrets / env / deploy targets: skill only edits triggers (on:), concurrency:, paths:. Leaves env:, secrets:, runs-on:, job steps alone unless explicitly told.
4. Never run failing workflows on cloud: when listing recent runs, do not retrigger.
5. Self-hosted runner only on private repos: GitHub strongly recommends. All rahmanef63 active repos are private — safe. Refuse runner setup if target repo isPrivate === false.
6. gh CLI, not raw curl: reuse the existing gh auth + scopes. Fall back to gh api for endpoints without dedicated subcommands.
7. Idempotent: re-running disable on already-disabled workflow is a no-op (detect existing workflow_dispatch: only + no push:/pull_request:/schedule:).

Scripts

audit.js — Sweep + report

Scans all rahmanef63 repos, lists workflows, recent run volume, identifies burn risks.

node scripts/audit.js                       # markdown report stdout
node scripts/audit.js --json                # machine-readable
node scripts/audit.js --since 2026-04-15    # custom window
node scripts/audit.js --repo          # single repo

Output: per-repo trigger map, run count since window, risk tags (cron, push-no-paths, pr-fanout, matrix-heavy, failing-burn).

disable.js — Strip auto-triggers

Patches workflow YAML so it only fires on workflow_dispatch:. Backs up to .bak. Creates branch chore/reduce-github-actions-usage, commits, leaves push to user.

node scripts/disable.js --repo                     # all workflows in repo
node scripts/disable.js --repo  --workflow   # one specific
node scripts/disable.js --repo  --dry-run          # diff only

nuke.js — Disable Actions on repo (API)

Settings → Actions → "Disable actions". Use only for dormant repos.

node scripts/nuke.js --repo           # disable
node scripts/nuke.js --repo  --revert # re-enable

ci.js — Local CI runner

Detects package manager (pnpm/npm/yarn) + scripts, runs typecheck + lint + test + build in order. Equivalent to most repo ci.yml. Aborts on first failure.

node scripts/ci.js                           # current dir
node scripts/ci.js --repo              # cd into ~/projects/
node scripts/ci.js --skip lint,test          # skip steps
node scripts/ci.js --quiet                   # only show fail output

hook.js — Pre-push husky setup

Installs husky + .husky/pre-push that runs node ~/.claude/skills/sc-git/scripts/ci.js. Aborts push on fail.

node scripts/hook.js install --repo 
node scripts/hook.js uninstall --repo 

runner.js — Self-hosted GH Actions runner

Registers a runner at VPS srv614914. Multi-repo via labels [self-hosted, linux, x64]. Free minutes forever.

node scripts/runner.js setup                          # bootstrap runner host
node scripts/runner.js register --repo          # join repo
node scripts/runner.js list --repo              # registered runners + their ids
node scripts/runner.js remove --repo  --id  # --id from `runner.js list --repo `

status.js — Commit status API

POST repos/:o/:r/statuses/:sha to mark a commit pass/fail without Actions. Useful for webhook-based CI.

node scripts/status.js --repo  --sha  --state success --context ci
node scripts/status.js --repo  --sha  --state failure --description "lint failed"

cron.js — VPS crontab CRUD

Registers a cron entry on VPS that calls a skill or shell command. Replaces schedule: triggers.

node scripts/cron.js add --name notion-sync --schedule "0 19 * * 0" --cmd "..."
node scripts/cron.js list
node scripts/cron.js remove --name notion-sync

webhook.js — GitHub webhook → VPS endpoint

Creates a push webhook pointing at VPS endpoint, so CI/deploy fires without Actions.

node scripts/webhook.js create --repo  --url 
node scripts/webhook.js list --repo 
node scripts/webhook.js delete --repo  --id 

Migration Playbook

Standard order to move a repo off cloud Actions:

1. node scripts/audit.js --repo — confirm what's burning.
2. node scripts/hook.js install --repo — pre-push local CI.
3. node scripts/disable.js --repo — strip auto-triggers (backup retained).
4. (Optional, if PR gate needed) node scripts/runner.js register --repo then revert YAML runs-on: → [self-hosted].
5. (Optional, for schedule:) move cron to VPS via cron.js add.
6. Verify: gh api repos/rahmanef63//actions/runs?per_page=5 --jq '.workflow_runs[].name' — should be empty for new pushes.

Common patterns by repo type

| Repo type | Strategy | |---|---| | Solo dev, frontend (Next.js) | hook.js install + disable.js all + Dokploy webhook redeploy | | Deploy-only YAML (SSH) | disable.js + replace with Dokploy auto-deploy webhook | | Convex deploy | /sc-convex push di pre-push hook + disable.js | | Cron sync (second-brain) | cron.js add (VPS) + disable.js | | Multi-collaborator + branch protect | runner.js register + keep YAML runs-on: [self-hosted] | | Dormant | nuke.js |

Cost-reduction flow

How the subcommands compose to move a repo off GitHub Actions cloud minutes:

flowchart TD
    A["audit.jsmeasure burn rate(runs, risk tags)"] --> B["disable.jsstrip on: triggers →workflow_dispatch-only(.bak backup)"]
    B --> C{Replacementfor each trigger?}

    C -->|push / pull_request CI| D["Local CIci.js + hook.js(pre-push husky)"]
    C -->|PR gate / branch protect| E["runner.jsself-hosted runner @ VPS(runs-on: [self-hosted])"]
    C -->|schedule: cron| F["cron.jsVPS crontab entry"]
    C -->|push → deploy| G["webhook.jspush webhook → VPS endpoint"]

    D --> H["status.jsPOST commit status(pass/fail, no Actions)"]
    E --> H
    G --> H

    A -.dormant repo.-> N["nuke.jsdisable Actions entirely"]

    H --> Z(["$0 cloud minutesweb stays current"])
    F --> Z
    N --> Z

Environment variables

These env vars change script behavior; each has a sensible default, so set only what you need to override.

| Variable | Default | Read by | Purpose | |---|---|---|---| | GH_OWNER | rahmanef63 | _shared.js (all subcommands) | GitHub owner/org for every gh api call. | | PROJECTS_DIR | ~/projects | _shared.js (all subcommands) | Root dir scanned for local repo clones (workflowFiles, localRepoPath). | | SC_GIT_WEBHOOK_SECRET | (empty) | webhook.js (create) | HMAC secret for the created webhook. Read from env (or stdin) so it never lands on argv / shell history. | | SC_GIT_VPS_HOST | srv614914 | runner.js | SSH host where the self-hosted runner is bootstrapped/registered. | | SC_GIT_RUNNER_HOME | ~/actions-runner | runner.js | Install path of the runner on the VPS. | | SC_GIT_RUNNER_VERSION | 2.319.1 | runner.js | actions-runner release version to download during setup. |

cron.js reads no env vars — it edits the local crontab directly.

Reference

• gh api repos/{owner}/{repo}/actions/workflows — list workflows
• gh api repos/{owner}/{repo}/actions/runs — list runs
• gh api -X PUT repos/{owner}/{repo}/actions/permissions -f enabled=false — disable Actions
• gh api repos/{owner}/{repo}/actions/runners/registration-token — runner token
• gh api -X POST repos/{owner}/{repo}/statuses/{sha} — commit status
• gh api -X POST repos/{owner}/{repo}/hooks — create webhook

Linked skills

• [[sc-dokploy]] — Dokploy redeploy trigger (replaces deploy.yml)
• [[sc-convex]] — Convex self-hosted push (replaces convex-deploy.yml)
• [[audit-bp]] — local audit run (replaces audit-bp.yml)

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: rahmanef63
• Source: rahmanef63/si-coder-agent
• License: MIT

Install and usage instructions live in the source repository linked above.