Our review
Builds and audits deterministic CI pipelines for Ideogram adapters, with sanitized fixtures, secret isolation and an optional live lane restricted to trusted contexts.
Strengths
- Cleanly separates mandatory offline tests gating merge from the paid live lane, which requires approval and a spend ceiling.
- Enforces concrete assertions: multipart field names, mutually exclusive prompts, typed errors, safety outcomes, async terminal states, signature verification and download limits.
- Builds in secret scanning of fixtures and artifacts, deletion of generated images and no retention of vendor URLs.
- Pins a reviewed OpenAPI snapshot or hash and reports drift without blindly overwriting team-owned contracts.
Limitations
- Assumes a CI trust model, branch policy, test runner and secret provider are already defined.
- Heavily Ideogram-specific (multipart, V4, webhooks), so it does not transfer directly to another SaaS vendor.
- Does not supply fixture data or cost thresholds; those must be set by the named owners.
Use it when adding or auditing automated Ideogram integration tests, especially to secure a CI workflow that untrusted forks can influence.
Avoid it for a one-off manual check of the Ideogram API or in a repository with no CI and no secret management in place.
Security analysis
SafeThe skill only uses Read, Glob, Grep, Write, and Edit for inspecting and authoring CI configuration, tests, and documentation. It explicitly instructs against adding secrets, enabling paid fork jobs, or changing required checks without authority, and contains no destructive, exfiltrating, or obfuscated actions. It is an advisory workflow for secure CI integration and poses no meaningful execution risk.
No concerns found
Examples
Test Ideogram in CI: add a pull-request workflow that runs our multipart, safety, error and webhook fixtures fully offline with no IDEOGRAM_API_KEY available.Secure an Ideogram GitHub workflow: gate a single V4 live smoke behind a protected environment with manual approval, a 30s timeout, one output and a hard cost ceiling.Audit our existing Ideogram CI workflow for fork secret exposure, fixture key leakage and retained image artifacts, then report the offline gate status, secret-scan result and OpenAPI drift.name: ideogram-ci-integration description: >- Build deterministic CI for Ideogram adapters with sanitized schemas, fixtures, secret isolation, and a trusted optional live lane. Use when adding or auditing automated integration tests. Trigger with "test Ideogram in CI", "build Ideogram contract tests", or "secure an Ideogram GitHub workflow". allowed-tools: Read,Glob,Grep,Write,Edit argument-hint: "<ci-provider> <test-command> <trusted-live-policy>" version: 1.11.0 license: MIT author: Jeremy Longshore jeremy@intentsolutions.io tags: [saas, ideogram, ci] model: inherit effort: high compatibility: "Designed for Claude Code; normal CI runs entirely offline"
Ideogram Continuous Integration
Overview
Make Ideogram integration quality reproducible without granting untrusted changes a paid credential. Use fixtures and schema checks for every pull request, then isolate any live smoke test behind trusted-branch, synthetic-content, spend, and concurrency controls.
Prerequisites
- CI trust model, branch policy, test runner, adapter seam, and secret provider.
- Sanitized fixtures covering sync, async, safety, errors, webhook, polling, and storage.
- Named owners for schema refresh, live-smoke spend, and failed-run cleanup.
Current Contract
The first-party OpenAPI is machine-readable, while endpoint pages carry important behavioral details such as multipart requirements, unsafe empty URLs, and current V4 rendering constraints. CI must preserve both schema and documented semantic assertions.
Authentication
Pull-request jobs must run without IDEOGRAM_API_KEY. A separately approved live job may receive a short-lived or environment-scoped secret server-side and send it only as Api-Key to https://api.ideogram.ai.
Instructions
- Inventory workflows, fork behavior, secret exposure, cache artifacts, and existing paid calls.
- Add offline tests for multipart field names, mutually exclusive prompts, typed errors, safety outcomes, async terminal states, signature verification, download limits, and storage cleanup.
- Pin a reviewed OpenAPI snapshot or hash and report drift without blindly replacing owned contracts.
- Scan fixtures and artifacts for keys, prompts, URLs, image bytes, and customer identifiers.
- Gate any live smoke to a trusted protected context with manual or environment approval, one synthetic request, strict timeout, output count, and cost ceiling.
- Persist no vendor URL, delete generated test assets, and publish only content-free status evidence.
- Require offline tests for merge; keep vendor availability from making normal pull requests flaky.
Tool Discipline
Use Read, Glob, and Grep to inspect workflows and tests. Use Write and Edit for approved CI, fixture, and documentation changes. Do not add secrets, enable paid fork jobs, or change required checks without repository authority.
Approval Boundaries
Require approval for workflow permissions, new secret access, live spend, external artifact upload, required-check changes, and branch-protection changes. Fork-originated code must never receive the Ideogram key.
Error Handling
- Fail on fixture secrets, undocumented schema changes, unsafe-output bypass, or retained image artifacts.
- Quarantine vendor outage in the optional live lane; do not weaken deterministic merge gates.
- Cancel timed-out jobs and reconcile any accepted async generation before retrying.
Output
Return workflow and test paths, trust boundaries, assertion counts, OpenAPI hash, secret-scan result, offline gate status, live-lane status and spend, cleanup receipt, and rollback plan.
Examples
- Run multipart and webhook fixtures on every pull request; run one V4 smoke only after protected-environment approval.
- Report
offline=pass; secrets=0; live=skipped-untrusted-fork; required_gate=pass.
Validation
Test trusted and untrusted event paths, inspect effective permissions, rerun the offline suite, and verify artifacts contain no content. Exercise cancellation and confirm any live-created object is deleted.
Resources
- Current first-party evidence map — use the dated endpoint, webhook, billing, team, and training links as the contract index for this workflow.
- Recheck the endpoint-specific page and current OpenAPI description before relying on an enum, limit, beta feature, or lifecycle claim.
- Record live observations as environment-specific evidence, not as universal vendor guarantees.
TDD Red-Green-Refactor
Testing
Skill that guides Claude through the complete TDD cycle.
Web Accessibility Audit
Testing
Performs a comprehensive web accessibility audit following WCAG standards.
UAT Test Case Generator
Testing
Generates structured and comprehensive user acceptance test cases.