Agent skill · software engineering · jeremylongshore
canva-ci-integration
Build credential-free Canva contract tests with a separately protected live read. Use when testing adapters, OAuth boundaries, OpenAPI drift, fork behavior, or deployment readiness. Trigger with: "test Canva in CI", "add Canva contract tests", "secure Canva GitHub Actions".
Why this skill is useful
Provides specific CI/CD pipeline configurations and integration testing patterns for the Canva API that the AI wouldn't reliably generate on its own.
What it needs
Requires gh, npm installed locally. Requires canva, github account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Canva Fork-Safe CI Contract Lane Overview Keep pull-request validation offline and deterministic. Reserve one minimal live read for trusted commits after environment protection, without rotating production tokens inside CI. Prerequisites Existing test framework and repository-defined command Pinned Canva OpenAPI snapshot or validated fixtures Protected environment with dedicated test integration and cleanup owner Instructions Step 1: Inventory workflow trust Use Read and Grep to map pull-request events, fork execution, secret references, generated clients, artifact uploads, and any code path that creates Canva resources. Step 2: Define offline contracts Use Write or Edit to test request construction, error parsing, explicit-scope checks, async job states, redaction, and unknown response fields against fixtures. Step 3: Pin provider inputs Version the OpenAPI snapshot or its checksum and make drift visible. Do not silently regenerate clients during an unrelated test run. Step 4: Add a protected live read Use an approved test user to call a non-mutating identity or metadata endpoint. Assert authorization and response shape, not volatile content. Step 5: Close secret boundaries Do not use privileged pull-request events to run untrusted code. Keep client secrets and refresh tokens outside job logs, artifacts, caches, and fork contexts. Step 6: Emit exact-head evidence Record commit, commands, fixture version, live endpoint pattern, protected environment, redaction result, and cleanup status. Authentication Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically. Tool Discipline Use Read and Grep for discovery and evidence. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/canva-ci-integration