pixee-workflow
starsforks
How to install pixee-workflow?
pixee/pixee-cli/pixee-workflow
$npx -y skills add pixee/pixee-cli --skill pixee-workflowList, create, update, run, and delete Pixee workflows on a repository with partial-update semantics across event kinds.
SKILL.md
| 1 | # pixee workflow |
| 2 | |
| 3 | > **PREREQUISITES:** Read `../pixee-shared/SKILL.md` for global flags, exit codes, and error |
| 4 | > handling, `../pixee-auth/SKILL.md` if authentication needs to be configured, and |
| 5 | > `../pixee-repo/SKILL.md` for the `--repo` resolution protocol. |
| 6 | |
| 7 | `pixee workflow` manages Pixee workflows for a single repository: list, create, update, run, and |
| 8 | delete. |
| 9 | |
| 10 | ## pixee workflow list |
| 11 | |
| 12 | ``` |
| 13 | pixee workflow list --repo <name-or-uuid> |
| 14 | ``` |
| 15 | |
| 16 | - `--repo` is **required**. |
| 17 | - Text output is tab-separated with columns `id`, `event`, `action`, `tool`. |
| 18 | - Pagination is transparent — every workflow on the repo is emitted in one call. There is no |
| 19 | `--paginate` flag here; `--paginate` only lives on `pixee api`. |
| 20 | |
| 21 | ## pixee workflow create |
| 22 | |
| 23 | `pixee workflow create` does not take an `--event` flag. Event kind is selected via a subcommand: |
| 24 | |
| 25 | - `pixee workflow create schedule` — cadence-based. |
| 26 | - `pixee workflow create new-scan` — triggered when a new scan is uploaded on a branch. |
| 27 | - `pixee workflow create pull-request-scan` — triggered on pull-request scans. |
| 28 | |
| 29 | All three share the [shared create flags](#shared-create-flags) below; event-specific flags |
| 30 | differ: |
| 31 | |
| 32 | **schedule** — `--cadence <daily|weekly>` (required), `--start <iso8601>` (optional start time |
| 33 | with timezone, e.g. `2026-05-01T00:00:00Z`), `--branch <name>` (exact branch name; defaults to |
| 34 | the repo's default branch). |
| 35 | |
| 36 | **new-scan** — `--branch <pattern>` (optional; supports a `*` suffix, e.g. `release/*`; defaults |
| 37 | to the repo's default branch). |
| 38 | |
| 39 | **pull-request-scan** — `--target-branch <pattern>`, `--source-branch <pattern>` (each optional; |
| 40 | supports `feature/*` style patterns). |
| 41 | |
| 42 | ### Shared create flags |
| 43 | |
| 44 | Every `create` subcommand accepts: |
| 45 | |
| 46 | - `--repo <name-or-uuid>` — **required**. Target repository. |
| 47 | - `--tool <tool>` — **required**. Scanner tool (`sonar`, `semgrep`, `codeql`, etc.). |
| 48 | - `--action <kind>` — **required**. `create-patch` or `none`. |
| 49 | - `--severity-labels <csv>`, `--min-severity-score <int>`, `--max-severity-score <int>`, |
| 50 | `--min-fix-confidence <high|medium|low|no-rating>`, `--finding-limit <int|none>` — optional |
| 51 | severity filters. **All require `--action create-patch`**; they have no meaning for |
| 52 | `--action none`. |
| 53 | |
| 54 | `--severity-labels` and `--min/max-severity-score` are **mutually exclusive**: pick either |
| 55 | label-based or score-based filtering. The CLI rejects mixed usage at parse time (exit code 1) |
| 56 | before any network call. |
| 57 | |
| 58 | ## pixee workflow update |
| 59 | |
| 60 | `pixee workflow update` is a **partial update**: only the flags you pass are changed; everything |
| 61 | else is left as-is on the server. Like `create`, the event kind is selected via subcommand, and |
| 62 | the workflow ID is a positional argument: |
| 63 | |
| 64 | - `pixee workflow update schedule <workflow-id>` — for cadence-based workflows. |
| 65 | - `pixee workflow update new-scan <workflow-id>` — for new-scan workflows. |
| 66 | - `pixee workflow update pull-request-scan <workflow-id>` — for PR-scan workflows. |
| 67 | |
| 68 | The subcommand must match the workflow's existing event kind; you cannot retype a `schedule` |
| 69 | workflow into a `new-scan` via update. There is no `--repo` flag — the workflow UUID |
| 70 | disambiguates by itself. |
| 71 | |
| 72 | Event-specific flags mirror `create`: |
| 73 | |
| 74 | - **schedule** — `--cadence`, `--branch`, `--start`. |
| 75 | - **new-scan** — `--branch`. |
| 76 | - **pull-request-scan** — `--target-branch`, `--source-branch`. |
| 77 | |
| 78 | ### Shared update flags |
| 79 | |
| 80 | Every `update` subcommand also accepts: |
| 81 | |
| 82 | - `--name <name>` — rename the workflow. |
| 83 | - `--enabled` / `--disabled` — toggle the workflow on or off. **Mutually exclusive**; pass at |
| 84 | most one. |
| 85 | - `--action <kind>`, `--severity-labels`, `--min-severity-score`, `--max-severity-score`, |
| 86 | `--min-fix-confidence`, `--finding-limit` — same semantics and same `--action create-patch` |
| 87 | requirement as on `create`. The `--severity-labels` vs `--min/max-severity-score` mutual |
| 88 | exclusion still applies. |
| 89 | - `--unset <field>` — repeatable. **Clears** a nullable field back to `null` instead of setting |
| 90 | it; use this to drop a filter rather than change it. Per-subcommand fields: |
| 91 | - schedule: `start`, `severity-labels`, `min-severity-score`, `max-severity-score`, |
| 92 | `min-fix-confidence`, `finding-limit`. |
| 93 | - new-scan: `severity-labels`, `min-severity-score`, `max-severity-score`, |
| 94 | `min-fix-confidence`, `finding-limit`. |
| 95 | - pull-request-scan: `target-branch`, `source-branch`, `severity-labels`, |
| 96 | `min-severity-score`, `max-severity-score`, `min-fix-confidence`, `finding-limit`. |
| 97 | |
| 98 | Action-scoped fields (`severity-labels`, `min/max-severity-score`, `min-fix-confidence`, |
| 99 | `finding-limit`) require `--action create-patch` on the same call, even when only unsetting. |
| 100 | |
| 101 | ## pixee workflow run |
| 102 | |
| 103 | ``` |
| 104 | pixee workflow run <workflow-id> |
| 105 | ``` |
| 106 | |
| 107 | Trigger a scheduled workflow on dem |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
