GitHub Actions Failure Analyzer

Turn a failed GitHub Actions workflow or pasted CI/CD build log into deterministic, structured diagnostic findings. It identifies recognizable failures such as TypeScript, npm, and CMake errors, then returns representative root-cause candidates, evidence, and next steps—without running your code or changing your repository.

Use it in the Apify Store, from the API, or from an MCP-enabled AI agent.

Quick start: analyze a log without credentials

Paste a failed build log into rawLog, then run the Actor. This mode does not contact GitHub, needs no GitHub token, and is the reliable public demo input.

{
  "rawLog": "npm run build\n\n> example@1.0.0 build\n> tsc --noEmit\n\nsrc/index.ts(12,7): error TS2322: Type 'string' is not assignable to type 'number'.\nError: Process completed with exit code 2."
}

The default input form is prefilled with the same example. It produces one default-dataset item and an OUTPUT key-value record.

Analyze a GitHub Actions run

Provide exactly one input mode: rawLog, or a full workflow-run URL in url (preferred) or runUrl (the supported legacy field).

{
  "url": "https://github.com/OWNER/REPOSITORY/actions/runs/RUN_ID",
  "githubToken": "YOUR_GITHUB_TOKEN"
}

githubToken is an optional secret input, but GitHub commonly requires it to download job logs—even for public repositories. Use a fine-grained token with access to the repository and Actions: Read; authorize organization SSO where applicable. For private repositories, repository access is required. Add Contents: Read only if GitHub requires it for your setup. Do not grant write permissions. A classic PAT may require repo for private repositories.

Anonymous GitHub API access is not a reliable way to retrieve workflow job logs. Raw-log mode is the credential-free option.

What you get

Each run writes one final record to the default dataset and to OUTPUT. Key fields include:

• analysisStatus and analysisCoverage, so callers can distinguish a complete analysis from partial or unavailable log coverage.
• findings, rootCauses, and primaryRootCause, with category, error code, evidence, confidence, and recommendation.
• GitHub workflow identity and failed-job details for URL mode; those fields are omitted or null for raw-log mode.
• diagnosticGroups, recommendations, and safe log-retrieval details such as logErrors and truncatedLogs.

For the TS2322 quick-start input, the relevant result is:

{
  "analysisMode": "raw_build_log",
  "analysisStatus": "complete",
  "analysisCoverage": "complete",
  "primaryRootCause": {
    "category": "typescript",
    "code": "TS2322",
    "message": "Type 'string' is not assignable to type 'number'.",
    "confidence": "high",
    "evidence": {
      "line": "src/index.ts(12,7): error TS2322: Type 'string' is not assignable to type 'number'.",
      "lineNumber": 6
    },
    "suggestion": "Inspect the TypeScript diagnostic and fix the indicated type, import, or module resolution setting."
  }
}

Input reference

Field	Required	Description
rawLog	One of rawLog or URL	Pasted CI/CD build log. No GitHub API request is made.
url	One of rawLog or URL	Full GitHub Actions workflow-run URL.
runUrl	Legacy alternative	Backward-compatible URL field for existing API and MCP clients.
githubToken	Sometimes	Secret GitHub token used only for URL analysis.
maxJobs	No	Jobs to scan: 1–500; default 100.
maxLogBytesPerJob	No	Bounded log capture per failed job: 10,000–2,000,000; default 500,000.
maxConcurrentLogDownloads	No	Concurrent log downloads: 1–16; default 4.
analysisDeadlineMs	No	Overall deadline: 1–600,000 ms; default 120,000.
feedback	No	Optional helpful or not_helpful only; never add free text or repository details.

MCP integration

The bundled MCP server exposes analyze_github_actions_failure. It accepts exactly one of runUrl or rawLog; githubToken is optional for URL analysis. APIFY_TOKEN is always required by the MCP server to invoke the Actor. The result is returned as MCP structured content, including findings, root causes, recommendations, status, and coverage.

Build the server once:

npm run mcp:build

Then add it to your MCP client's configuration (replace the paths and token):

{
  "mcpServers": {
    "github-actions-failure-analyzer": {
      "command": "node",
      "args": ["/absolute/path/to/github-actions-failure-analyzer/mcp/dist/index.js"],
      "env": {
        "APIFY_TOKEN": "YOUR_APIFY_TOKEN",
        "APIFY_ACTOR_ID": "BS8HCeGB4zQUAhSwo"
      }
    }
  }
}

Example tool call with a raw log:

{
  "rawLog": "src/index.ts(12,7): error TS2322: Type 'string' is not assignable to type 'number'."
}

Example URL-mode tool call:

{
  "runUrl": "https://github.com/OWNER/REPOSITORY/actions/runs/RUN_ID",
  "githubToken": "OPTIONAL_GITHUB_TOKEN_FOR_LOG_ACCESS",
  "maxJobs": 25
}

Invalid or missing input modes, an invalid run URL, missing APIFY_TOKEN, API errors, and an empty or mismatched dataset response are returned as MCP tool errors. The related MCP tools—get_github_actions_fix_context, resolve_github_actions_repository, and get_github_actions_repair_context—remain URL-only because they use workflow and repository identity.

Supported error categories

The analyzer recognizes common patterns for TypeScript (TS####), npm dependency resolution (ERESOLVE), CMake package discovery, Python exceptions, Java exceptions, Rust compiler errors, Go compiler errors, .NET compiler errors, shell command failures, build-tool failures, tests, permissions, GitHub rate limits, runner problems, and Docker build failures. It also reports failed workflow steps when GitHub job metadata is available.

Limitations and security

• Diagnostics are pattern-based. primaryRootCause is a representative finding, not proof of workflow-wide causality or a prescribed code change.
• URL mode analyzes failed-job logs only. Job, log-size, concurrency, and deadline bounds can cause partial coverage.
• GitHub permissions, SSO, retention, rate limits, and temporary log-download redirects can prevent retrieval.
• The Actor does not use AI, check out or execute repository code, modify repositories, create pull requests, or trigger workflows.
• githubToken is a secret input and is used only for requested GitHub calls. The Actor does not use a publisher token or fallback credential. It redacts recognized credentials from persisted evidence, but redaction is not a guarantee that arbitrary sensitive log text is safe to submit.
• Raw logs and normal diagnostic outputs can contain repository or diagnostic evidence. Submit only logs and repositories you are authorized to process.

Store publishing checklist

After publishing this build in Apify Console, retain the existing dejvidos/github-actions-failure-analyzer slug and set the Store description from .actor/actor.json. Select only relevant available categories (for example, Developer tools, if offered) and use the README as the Store README. Update the existing public Task to use the prefilled rawLog sample, leave githubToken empty, run it once, and confirm its dataset has the TS2322 record before making it the public demo.

Pricing

This public Store release uses Apify Pay per usage with no additional developer, AI-model, per-result, or paid-feature charge. Normal Apify platform usage costs may still apply.