Add /ort-ci skill for triaging and re-running CI checks (#29721)
### Description
Adds a new `/ort-ci` agent skill that documents how to trigger, re-run,
and unblock ONNX Runtime CI checks on a GitHub pull request, plus a
helper script that safely re-runs only genuinely failed/cancelled GitHub
Actions workflows. The skill emphasizes diagnosing each failure before
re-running, since most CI failures require a code change and re-running
them just fails again.
### Key Changes
| File | Change |
|---|---|
| `.agents/skills/ort-ci/SKILL.md` | New skill documenting ORT CI triage
and management: classifying a check's provider, gathering PR/check
context, per-failure triage (download log -> classify -> fix or re-run),
and targeted playbooks. |
| `tools/scripts/rerun_failed_ci.sh` | New helper that re-runs a PR's
failed/cancelled GitHub Actions runs for the current head commit,
skipping workflows that already have a newer queued/in-progress run to
avoid duplicate runs. Supports `--dry-run` and auto-detects
`owner/repo`. |
| `AGENTS.md` | Adds a `CI` section pointing to the new `/ort-ci` skill.
|
The skill covers the current ORT CI topology (as of 2026-07): nearly all
checks run as GitHub Actions; only `Linux Android Emulator QNN CI
Pipeline` remains on Azure Pipelines, plus the bot-driven `license/cla`
and `Python format` checks. It includes step-by-step playbooks for:
- Re-running transient GitHub Actions failures (via
`rerun_failed_ci.sh`)
- Unblocking `license/cla`
- Fixing the `Python format` required check
- Triggering the Azure Pipelines QNN Android Emulator check (`/azp run`
and direct fallback)
- Fixing the `Windows GPU Doc Gen CI` check when operator docs are out
of date
- Safety rules and post-trigger verification
### Testing Notes
- Documentation- and tooling-only change; no product code or runtime
behavior is affected.
- `rerun_failed_ci.sh` was exercised in `--dry-run` mode against live
PRs (e.g. `./rerun_failed_ci.sh <pr> --dry-run`) to confirm it correctly
lists failed/cancelled workflows and triggers nothing.
- The script requires an authenticated `gh` CLI and uses only `gh`'s
built-in `--jq` (no external `jq` binary needed).