Analyze CI Failures
DevOps & Securityanalyze-ci-failuresAnalyze CI Failures is an Agent Skill for devops & security published in the Azure/azure-sdk-for-net repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Analyze CI failures on Azure SDK for .NET pull requests and post a comment with how-to-fix instructions. Use when a PR has failing checks, CI is red, or someone asks for help fixing CI.
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/Azure/azure-sdk-for-net/blob/HEAD/.github/skills/analyze-ci-failures/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/analyze-ci-failures, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
Skill: analyze-ci-failures
Analyze CI failures on an Azure SDK for .NET pull request and post a GitHub comment with actionable fix instructions.
When Invoked
Trigger phrases: "analyze CI failures", "fix CI", "why is CI failing", "help with CI", "analyze PR checks", "CI is red", "failing checks".
Inputs
The user must provide a PR number, PR URL, or pipeline build ID. If not provided, ask the user.
Workflow
1. Gather information
- Fetch PR details, check statuses, changed files, and workflow runs using GitHub MCP tools.
- Extract service directory and package name from changed file paths (
sdk/<service>/<package>/). - If a pipeline build ID is available (often in auto-generated PR descriptions), use
azure-sdk-mcp-azsdk_analyze_pipelinefor deeper log analysis. - For failed GitHub Actions jobs, use
github-mcp-server-get_job_logswithreturn_content: trueto get logs.
2. Identify failures
Classify each failure using the CI check mapping and log symptom patterns below. Also inspect the PR's code directly (e.g., read generated files for compile errors, check for missing scaffolding files).
3. Post a comment
Compose a GitHub comment with:
- Header:
## 🔍 CI Failure Analysis for PR #<number> - Summary table: All checks with ✅ ❌ ⏳ status
- Per-failure sections: Specific to THIS PR — include actual error messages, affected files, and concrete fix commands with
<service>/<package>filled in - Quick fix command at the end if applicable
Before posting, check existing comments for ## 🔍 CI Failure Analysis to avoid duplicates.
CI Check Name → Failure Mapping
These are the Azure DevOps and GitHub checks that run on SDK PRs. The check names are repo-specific and not discoverable from general knowledge.
| Check Name Pattern | What It Validates | Key Script |
|---|---|---|
Build Analyze PRBatch | Umbrella: code generation, API export, snippets, spelling, CPM, build + pack | eng/scripts/CodeChecks.ps1 |
Verify Generated Code | Generated code matches what the generator produces | eng/scripts/CodeChecks.ps1 |
Validate CPM Compliance | Central Package Management policy | eng/scripts/Validate-CpmCompliance.ps1 |
Build / Pack | Compilation + NuGet packaging (ApiCompat runs during pack only) | dotnet pack |
Analyze | Samples, READMEs, snippets compile | eng/scripts/Build-Snippets.ps1 |
check-spelling | Spell-checking changed files | cspell via eng/common/scripts/check-spelling-in-changed-files.ps1 |
verify-links | Markdown link validation | eng/common/scripts/Verify-Links.ps1 |
checkenforcer | Meta-check: waits for all other checks to pass | .github/workflows/event-processor.yml |
Log Symptom → Root Cause Mapping
These are exact strings/patterns to search for in CI logs. They are specific to this repo's scripts and not inferrable from general knowledge.
| Log symptom | Root cause | Category |
|---|---|---|
Generated code is not up to date | Generated code out of sync | Regenerate code |
git diff --exit-code failure in CodeChecks | Generated or API files changed after re-running scripts | Regenerate + export API |
error CS####: | C# compilation error | Build failure — inspect the specific error code |
Build FAILED | Compilation failure | Build failure |
MembersMustExist / TypesMustExist | ApiCompat breaking change (only surfaces in dotnet pack) | API compatibility |
ManagePackageVersionsCentrally / VersionOverride | CPM policy violation | CPM compliance |
cspell unknown words | Spelling error in code or API surface | Spelling |
Spell check failed | Spelling error in API surface files | Spelling |
README instruction format / NuGet\\Install-Package | README uses wrong install format (must use dotnet add package) | README validation |
verify-links broken URL | Broken markdown links | Link verification |
| Path length exceeded | File path > 210 chars | File path issue |
New Package Checklist
For PRs that introduce a new SDK package (all files are added, no prior version exists), also check for these commonly missing scaffolding files:
CHANGELOG.mdREADME.mdDirectory.Build.props(must import parent props)ci.mgmt.yml(for management-plane) or CI pipeline configapi/*.cs(public API surface listings — generated viaExport-API.ps1)assets.json(test recording assets)
Without ci.mgmt.yml, the Azure DevOps CI pipeline won't trigger — this is a common reason for checkenforcer staying permanently pending.