fix(ci): pass tessl-token to skill-review and fix env scope

[amondnet]

Summary

The Tessl Skill Review check has been failing on every PR since 2026-07-27 (last green run was 2026-07-20). In the logs, every skill returns score: -1, then the action crashes with:

##[error]String.prototype.repeat argument must be greater than or equal to 0 and not be Infinity

The negative score feeds a repeat() call — a bug upstream already fixed in commit 5aefcf5e.

Root cause: our pin 22e928dd is from March 2026 and predates three upstream changes:

• c9357d38 — reviews now require Tessl auth; the unauthenticated path is closed server-side
• b8d7e7dc — migrated to tessl review run quality
• 5aefcf5e — the score-range crash fix

Fix:

• Bump the tesslio/skill-review pin to 7e7ea574722a6d72752aa5a316bcc813d06b7cd2 (latest main)
• Pass the new tessl-token input from the existing TESSL_TOKEN secret
• Move TESSL_TOKEN from job-level env down to the guard step only

The env move matters because the upstream composite now sets its own step-level TESSL_TOKEN from the tessl-token input, which shadows any job-level value — without passing the input, auth would be silently empty even though our guard step passed.

Deliberate deviations from issue #265

• No new TESSL_API_TOKEN secret. TESSL_TOKEN already exists as an org secret visible to this repo, and it's what tessl-publish.yml already uses.
• Kept a SHA pin instead of @main, per the org's GitHub Actions SHA-pinning standard.

Open caveat

It could not be verified whether the org TESSL_TOKEN sees more than one Tessl workspace (the local tessl CLI is not authenticated here). If it sees several, the run fails with an explicit request to set a workspace: input — a clear, self-describing failure. The workflow's header comment documents this; worth watching the check on this PR to confirm.

Note for reviewers

This PR only touches .github/workflows/tessl-skill-review.yml, so the Tessl Skill Review check itself will not trigger here — its path filter is plugins/**/skills/**. The fix will first be exercised on the next PR that touches a skill. Don't expect a green Tessl check on this PR as proof; validation here is actionlint + YAML parsing.

Validation

• actionlint passes on the workflow
• YAML parses cleanly

Related issue

Closes #265

Checklist

• PR title follows Conventional Commits
• Tests added or updated, and the suite passes (bun run test)
• Lint/format pass (actionlint)
• Documentation updated (workflow header comment refreshed)
• No breaking change, or a BREAKING CHANGE: note is included

---

Summary by cubic

Restores Tessl Skill Review by updating the tesslio/skill-review action and passing the required Tessl token. Previously the check ran unauthenticated, returned -1 scores, and crashed; now it authenticates, uses the updated command, and avoids the score-range crash.

• Updates tesslio/skill-review to the latest main; adopts upstream auth requirement and bug fix.
• Passes the token via the tessl-token input from the existing TESSL_TOKEN secret; scopes TESSL_TOKEN to the guard step to avoid being shadowed by the composite.
• The check will not run on this PR due to path filters; it will validate on the next PR that changes a skill.
• If TESSL_TOKEN spans multiple Tessl workspaces, set a workspace: input to select one.

^{Written for commit 42f87f3. Summary will update on new commits.}

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
claude-code-plugins	Ready	Preview	Aug 13, 2026 2:05pm

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[greptile-apps]

Greptile Summary

Restores authenticated Tessl skill reviews by updating the pinned action and passing the existing organization token through the action’s supported input.

• Narrows TESSL_TOKEN environment scope to the configuration guard.
• Updates tesslio/skill-review to the auth-capable, score-fix revision.
• Documents the potential need for explicit workspace selection when a token can access multiple workspaces.

Confidence Score: 5/5

The PR appears safe to merge, with no actionable changed-code defects identified.

The guard retains access to the secret at step scope, while the review action receives the same secret through its supported input; missing secrets still cause an intentional skip rather than an authentication failure.

Important Files Changed

Filename	Overview
.github/workflows/tessl-skill-review.yml	Correctly updates the action pin, passes the Tessl token through the new input, and preserves graceful skipping when the secret is unavailable.

_{Reviews (1): Last reviewed commit: "fix(ci): pass tessl-token to skill-revie..." | Re-trigger Greptile}

[cubic-dev-ai]

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

Architecture diagram

sequenceDiagram
    participant GH as GitHub Actions
    participant WF as tessl-skill-review.yml
    participant Guard as Check TESSL_TOKEN step
    participant Action as tesslio/skill-review@7e7ea574
    participant SetupTessl as tesslio/setup-tessl
    participant TesslCLI as tessl CLI
    participant TesslSvc as Tessl Service

    Note over GH,TesslSvc: Tessl Skill Review - Authenticated Flow

    GH->>WF: Trigger on PR (path filter: plugins/**/skills/**)
    WF->>Guard: Run guard step
    Guard->>Guard: Read TESSL_TOKEN from step-level env
    alt TESSL_TOKEN not set
        Guard->>GH: Warning + set skip=true
        Note over GH: Job no-ops silently
    else TESSL_TOKEN set
        Guard->>GH: Set skip=false
    end

    alt skip != true
        WF->>Action: Invoke with tessl-token input
        Action->>SetupTessl: Forward token
        SetupTessl->>TesslCLI: Configure auth with token
        Action->>TesslCLI: Run "tessl review run quality"
        TesslCLI->>TesslSvc: Authenticated review request
        alt Token sees exactly one workspace
            TesslSvc-->>TesslCLI: Review scores (0-100)
            TesslCLI-->>Action: Valid score range
            Action->>GH: Post PR comment with scores
            alt Score below fail-threshold
                Action->>GH: Fail check
            else Score at/above threshold
                Action->>GH: Pass check
            end
        else Multiple workspaces detected
            TesslSvc-->>TesslCLI: Ambiguous workspace error
            TesslCLI-->>Action: Explicit failure (requests workspace input)
            Action->>GH: Fail check with self-describing message
        end
    end

Loading

_{Re-trigger cubic}