How the No AI Slop CI/CD Pipeline Is Configured: GitHub Actions Workflow Explained

The No AI Slop repository automates validation and release through a GitHub Actions workflow defined in .github/workflows/plugin.yml, which validates every pull request and creates official releases only from version tags.

The open-source petergyang/no-ai-slop project uses a continuous integration and continuous deployment (CI/CD) pipeline to ensure code quality and streamline plugin distribution. This automated system validates every code change before allowing merges and handles the entire release process when maintainers push version tags. Understanding this setup helps contributors reproduce builds locally and ensures releases meet quality standards before reaching users.

GitHub Actions Workflow Architecture

The CI/CD implementation relies on a single workflow file located at .github/workflows/plugin.yml that orchestrates two distinct jobs: validate and release. These jobs run sequentially, with the release phase depending on successful completion of validation checks.

Workflow Triggers and Structure

According to the source code, the pipeline activates on three distinct events:

• Pull requests – Every PR triggers the validate job to ensure proposed changes build correctly
• Pushes to main – Direct commits to the main branch undergo the same validation
• Version tags – Pushes to tags matching the v* pattern (e.g., v1.0.7) trigger both jobs, culminating in an automated release

This trigger configuration ensures that every change is tested while only tagged versions become official releases.

Job Dependencies and Permissions

The workflow implements a dependency chain where the release job depends on the validate job completing successfully. The release job requires elevated permissions defined in the workflow YAML:

permissions:
  contents: write
  actions: read

The contents: write permission allows the workflow to create GitHub Releases, while actions: read enables artifact downloading between jobs.

The Validate Job: Automated Build Verification

The validate job serves as the quality gate for the No AI Slop plugin. Running on every pull request and main branch push, this job ensures the plugin package can be built successfully and passes integrity checks.

Environment Setup and Dependencies

The job executes on a standard GitHub-hosted runner and sets up Python 3.12 using actions/setup-python@v7. The environment initialization follows this sequence:

steps:
  - uses: actions/checkout@v7
  - uses: actions/setup-python@v7
    with:
      python-version: '3.12'

After checkout, the job proceeds to execute the build validation logic.

Build Script Execution (scripts/build_plugin.py)

The core validation logic resides in scripts/build_plugin.py, which performs several critical functions:

1. Manifest verification – Reads .codex-plugin/plugin.json and validates required metadata fields
2. Asset compilation – Copies source assets to a staging directory
3. Archive creation – Generates the ZIP file at dist/no-ai-slop-plugin-<version>.zip
4. Sanity checks – Validates file listings, content integrity, and ZIP structure

If any validation step fails, the script exits with a non-zero status, aborting the job and preventing artifact publication.

Artifact Publishing

Upon successful build completion, the workflow uploads the resulting ZIP file using actions/upload-artifact@v7:

- uses: actions/upload-artifact@v7
  with:
    name: no-ai-slop-plugin
    path: dist/*.zip

This uploads the validated plugin as an artifact named no-ai-slop-plugin, making it available for the release job or manual download from the workflow run summary.

The Release Job: Automated GitHub Releases

The release job handles the final distribution step, executing only when a version tag is pushed and the validate job succeeds.

Trigger Conditions and Security

This job includes a conditional check ensuring it runs exclusively for version tags:

if: startsWith(github.ref, 'refs/tags/v')
needs: validate

The dependency on the validate job ensures that broken builds never reach the release stage. The job downloads the previously validated artifact using actions/download-artifact@v8 rather than rebuilding the plugin, guaranteeing that the released file matches the tested version exactly.

Release Creation with GitHub CLI

The final step uses the GitHub CLI (gh) to create the release:

gh release create ${{ github.ref_name }} \
  dist/no-ai-slop-plugin-*.zip \
  --generate-notes \
  --verify-tag

This command automatically generates release notes from commit history, attaches the plugin ZIP file, and verifies the tag signature before publishing.

Local Development and Testing

Contributors can reproduce the CI/CD validation locally to catch issues before pushing changes. The following commands mirror the automated pipeline behavior.

To build the plugin locally:

# From the project root:

python scripts/build_plugin.py

This creates dist/no-ai-slop-plugin-<version>.zip and runs the same validation checks as the CI environment.

For manual validation testing without executing the full build:

python - <<'PY'
import json, pathlib, zipfile, shutil
ROOT = pathlib.Path(__file__).resolve().parents[1]
MANIFEST = ROOT / ".codex-plugin" / "plugin.json"
manifest = json.loads(MANIFEST.read_text())

from scripts.build_plugin import validate_source, build_plugin, validate_build
validate_source(manifest)
plugin_root, archive = build_plugin(manifest)
validate_build(plugin_root, archive)
print("Local validation succeeded")
PY

To simulate the release process locally after building:

# After building, create a local test release:

gh release create v1.0.0 dist/no-ai-slop-plugin-1.0.0.zip --generate-notes --verify-tag

Summary

• GitHub Actions drives the CI/CD pipeline for petergyang/no-ai-slop, defined in .github/workflows/plugin.yml
• The validate job runs on every PR and main branch push, executing scripts/build_plugin.py to verify the plugin package and uploading it as the no-ai-slop-plugin artifact
• The release job triggers only on version tags (v*), downloads the validated artifact, and uses gh release create to publish official GitHub Releases
• Local validation is possible by running python scripts/build_plugin.py, which performs the same checks as the CI environment
• The workflow requires contents: write permissions for release creation and ensures only vetted, version-tagged builds become official releases

Frequently Asked Questions

What triggers the CI/CD pipeline in No AI Slop?

The pipeline triggers on three events: pull requests against any branch, pushes to the main branch, and pushes to tags matching the v* pattern. Pull requests and main branch pushes execute only the validate job, while version tags trigger both the validation and release jobs sequentially.

How does the validate job ensure plugin quality?

The validate job executes scripts/build_plugin.py, which reads the manifest from .codex-plugin/plugin.json, verifies required metadata fields, copies source assets, creates the ZIP archive, and runs integrity checks on the file structure and contents. If any step fails, the job aborts and prevents artifact publication.

What permissions does the release job require?

The release job requires contents: write permission to create GitHub Releases and actions: read permission to download the validated artifact from the previous job. These permissions are explicitly declared in the workflow file to follow the principle of least privilege.

Can I run the build process locally?

Yes. Contributors can run python scripts/build_plugin.py from the project root to execute the same build and validation logic used in the CI pipeline. The script creates the distribution ZIP in the dist/ directory and runs all sanity checks locally, enabling debugging without triggering remote workflow runs.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}