jwmossmoz/worker-image-build
skills/worker-image-build/SKILL.md
Trigger GitHub Actions workflows in mozilla-platform-ops/worker-images to build Firefox CI Windows worker images (FXCI Azure trusted and untrusted, win10-2009 / win11-24h2 / win11-a64 / win2022). Use to start an image build or check the status of a triggered run. DO NOT USE FOR debugging an existing image's failures (use worker-image-investigation).
$ install --global
skillsauthnpx skillsauth add jwmossmoz/agent-skills worker-image-buildInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 14, 2026, 7:06 AM139.1s1 file scanned
SKILL.md
- name:
- worker-image-build
- description:
- >
- version:
- 1.0
Worker Image Build
Build Firefox CI worker images by triggering GitHub Actions workflows.
Supported Workflows
| Workflow | Name | Purpose |
|----------|------|---------|
| sig-nontrusted.yml | FXCI - Azure | Build untrusted Windows images |
| sig-trusted.yml | FXCI - Azure - Trusted | Build trusted Windows images |
Available Configs
Untrusted (FXCI - Azure)
win10-64-2009-alpha win10-64-2009
win11-64-2009-alpha win11-64-2009
win11-64-24h2-alpha win11-64-24h2
win11-64-24h2-alpha-v6
win11-a64-24h2-tester-alpha win11-a64-24h2-tester
win11-a64-24h2-builder-alpha win11-a64-24h2-builder
win2022-64-2009-alpha win2022-64-2009
win2022-64-2009-alpha-v6
Trusted (FXCI - Azure - Trusted)
trusted-win11-a64-24h2-builder
trusted-win2022-64-2009
Trigger a Build
# Untrusted image
gh workflow run "FXCI - Azure" \
--repo mozilla-platform-ops/worker-images \
-f config=<CONFIG_NAME>
# Trusted image
gh workflow run "FXCI - Azure - Trusted" \
--repo mozilla-platform-ops/worker-images \
-f config=<CONFIG_NAME>
Example:
gh workflow run "FXCI - Azure" \
--repo mozilla-platform-ops/worker-images \
-f config=win11-64-24h2-alpha
Check Build Status
After triggering, get the run URL:
# Get latest run for untrusted
gh run list --repo mozilla-platform-ops/worker-images \
--workflow "FXCI - Azure" --limit 1 \
--json databaseId,url,status,createdAt
# Get latest run for trusted
gh run list --repo mozilla-platform-ops/worker-images \
--workflow "FXCI - Azure - Trusted" --limit 1 \
--json databaseId,url,status,createdAt
Watch a specific run:
gh run watch <RUN_ID> --repo mozilla-platform-ops/worker-images
View run logs:
gh run view <RUN_ID> --repo mozilla-platform-ops/worker-images --log
Build Process
- Access check against
.github/relsre.json - Azure login with FXCI credentials
- Packer build (30-60 min)
- SBOM generation
- Release notes PR created
Naming Conventions
-alphasuffix: Test/staging images- No suffix: Production images
trusted-prefix: Trusted pool images-a64-: ARM64 architecture-64-: x64 architecturetester/builder: Pool role
More Examples
See references/examples.md for additional command examples.
Gotchas
- Access is gated by
.github/relsre.jsonin mozilla-platform-ops/worker-images — if your gh user isn't on that list, the workflow rejects the trigger immediately. - Builds take 30-60 min (Packer). Use
gh run watchrather than pollinggh run listin a tight loop. -alphaconfigs build to staging galleries; non-suffixed configs go to production. Always validate image changes through-alphafirst.trusted-prefixed configs require the trusted workflow (FXCI - Azure - Trusted); they fail if you trigger them on the untrusted workflow and vice versa.- After a successful build, a release-notes PR is opened automatically — don't merge it until the alpha image has been validated through
os-integrations.
Repository
https://github.com/mozilla-platform-ops/worker-images
Related Skills
jwmossmoz/azure-cost-duckdb
development
VerifiedTrustedCommunity
Download Azure Cost Management exports and query local Parquet/CSV in DuckDB. Use when refreshing local Azure cost caches or writing DuckDB SQL over exports. DO NOT USE FOR live Cost Management API diagnosis; use azure-cost-analysis.
3SKILL.mdUpdated May 30, 2026
jwmossmoz/self-review
data-ai
VerifiedTrustedCommunity
Use when creating performance self-reviews from local notes, prior reviews, review prompts, and verified evidence. Helps draft H1/H2, annual, and promotion self evaluations, example answers, and rich review-form paste output. Do not use for routine status or 1:1 summaries; use one-on-one.
3SKILL.mdUpdated May 23, 2026
jwmossmoz/one-on-one
tools
VerifiedTrustedCommunity
Prepare one-on-one/status bullets from ~/moz_artifacts using qmd and copy a topic-organized HTML/RTF list with embedded links to the macOS clipboard. Use when summarizing recent Mozilla work for a manager, 1:1, or status update. DO NOT USE FOR generating raw daily logs; use daily-log.
3SKILL.mdUpdated May 20, 2026
jwmossmoz/worker-ready-tracing
development
VerifiedTrustedCommunity
Use when tracing Taskcluster Azure VM startup from worker-manager request through in-VM boot scripts to generic-worker `workerReady` with tc-logview, paperctl, Splunk Web, and Yardstick Prometheus. Applies to Windows worker provisioning latency. DO NOT USE FOR task failure triage (use worker-image-investigation).
3SKILL.mdUpdated May 16, 2026