--- name: miro-ci-integration-249dbcdae325 description: "Design and implement repository-side Miro CI gates with schema-faithful fixtures, protected live-test handoffs, test-board isolation, and cleanup proof. Use when adding Miro checks to CI. Trigger with \"test Miro in CI\"." argument-hint: "[pipeline] [test-scope]" allowed-tools: Read, Glob, Grep, WebFetch, Write, Edit version: 1.9.0 author: Jeremy Longshore license: MIT tags: - saas - miro - ci - testing model: inherit effort: high compatibility: Designed for Claude Code; live work requires an authorized Miro app and redacted evidence --- # Miro CI Contract Tests ## Overview Keep pull-request checks credential-free and reserve live Miro calls for protected, explicitly scoped lanes. A test must never mutate a collaboration board by accident; use the evidence produced here to make the next decision explicit and reviewable. ## Prerequisites - CI trust-boundary and fork policy - Pinned schemas/fixtures and test command - Dedicated app, team, board, identity, and cleanup owner for live tests ## Tool Discipline Use `Read`, `Glob`, and `Grep` to inspect the repository, configuration names, adapters, tests, and evidence. Use `WebFetch` only for current official Miro documentation. Use `Write` or `Edit` after confirming the requested mode, target environment, tenant, board, and approval boundary. These declared tools do not call authenticated Miro APIs or deployment CLIs; implement client, configuration, and test changes, then return exact operator commands or an approval-gated handoff for live execution. ## Current Contract - Untrusted fork workflows must not receive Miro credentials. - Live traffic consumes production-like per-user/application credits even on test resources. - Bulk create is transactional but cleanup still needs an explicit inventory and board guard. - OAuth refresh rotation can invalidate concurrent jobs sharing one installation. ## Authentication For REST work, use OAuth 2.0 Authorization Code with the narrowest Miro scopes. Bind each encrypted token record to its user, application, authorized team, and granted scopes. Never print access tokens, refresh tokens, client secrets, authorization codes, or board content. ## Instructions 1. Split formatting, unit, schema, security, and fixture tests from the protected live lane. 2. Assert that PR/fork lanes have no credential context and cannot invoke live helpers. 3. Pin dependencies and validate captured fixtures against current official response contracts. 4. Serialize protected live jobs per installation, assert app/team/board guards, and use bounded read-first tests. 5. Mark any created item with the run identity, reconcile it, then clean only confirmed run-owned IDs. 6. Fail the gate on leaked data, ambiguous writes, cleanup residue, unexpected schema, or quota-policy breach. ## Approval Boundaries Do not expose credentials to forks, share one rotating token across parallel jobs, or enable destructive live tests without repository and board-owner approval. Pause when the responsible owner or exact target is uncertain. ## Output Return lane/trust map, fixture provenance, protected-resource guards, test results, credits used, cleanup receipt, and gate conclusion. State what was not inspected or changed so the receipt cannot overclaim coverage. ## Error Handling | Condition | Response | |---|---| | Fork lane can read secrets | Disable the live path and repair workflow permissions before merging. | | Refresh collision occurs | Serialize jobs or isolate installations. | | Cleanup cannot prove ownership | Leave content intact and fail the lane. | | Rate headroom is low | Skip live mutations and report capacity pressure. | ## Examples The example is a redacted operator receipt; identifiers are hashes or bounded labels, not board content or credentials. ```text unit=46/46; schemas=12/12; fork-secrets=0; live-read=passed; live-writes=0; cleanup-residue=0 ``` ## Resources - [Skill-specific official documentation](references/official-docs.md) - [OAuth guide](https://developers.miro.com/docs/getting-started-with-oauth) - [Rate limits](https://developers.miro.com/reference/rate-limiting) --- Source attribution: jeremylongshore Original project: https://github.com/jeremylongshore/claude-code-plugins-plus-skills/blob/ab85a061f7bcc039dac13ee193de7a4cd4388571/plugins/saas-packs/miro-pack/skills/miro-ci-integration/SKILL.md License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License Copyright (c) 2025 Jeremy Longshore Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: jeremylongshore Original project: https://github.com/jeremylongshore/claude-code-plugins-plus-skills/blob/ab85a061f7bcc039dac13ee193de7a4cd4388571/plugins/saas-packs/miro-pack/skills/miro-ci-integration/SKILL.md Attribution basis: Source repository record Fields of work: Development & Engineering, Marketing Roles: Backend Developer, DevOps / SRE, Growth Marketer Specialties: API, DevOps Tools: GitHub, Miro Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: fb9624af40f921eaeb0fdd3badb7728a2d89e9b697cb1681f9e52bc8826ffd5b