In short
- The workflow runs every Monday at 08:00 UTC, gets your top mission, and opens one draft pull request labeled serpkin.
- It stops while a Serpkin pull request is still open, so missions never pile up.
- Claude Code gets file tools only, and a separate job rejects workflow, dependency, env and git changes.
- Weekly runs use no Serpkin credits. GitHub Actions and Anthropic usage are billed by those providers.
Weekly pull requests are Serpkin's hands-off mode. Every Monday, a GitHub Actions workflow asks Serpkin for your top mission, has Claude Code implement it on a new branch, and opens one draft pull request for you to review. Nothing is merged or deployed without you. This page explains what each run does, how to turn it on, what the pull request contains and when a run decides to stop.
What happens each week
- 1Check the queueThe run stops if a pull request labeled serpkin is still open. Otherwise it gets the next mission and marks it in progress.
- 2ImplementClaude Code reads the mission file and edits files in a checkout. It gets file tools only, no shell and no secrets.
- 3Check the changeA separate job rejects changes to workflows, dependencies, env files or git internals, and scans for secrets.
- 4Open a draftThe rest is committed to a new branch and opened as a draft pull request with the serpkin label.
The default schedule is Mondays at 08:00 UTC. A run typically takes a few minutes. Your own CI and preview deployment then test the pull request, and the mission waits in Serpkin as implemented until you verify it after deploying. You can also start a run by hand from the Actions tab with workflow_dispatch, which is useful after changing secrets or checking that the setup works.
Turn it on
- Add the workflow files
In your repository, run
npx serpkin weekly. It writes.github/workflows/serpkin-weekly.ymland, if you don't have one yet, the preview SEO check at.github/workflows/serpkin.yml. Existing files are kept.--forcereplaces the weekly workflow, and in a monorepo you run the command from the app folder so the files land at the repository root. - Add two secrets and one variable
The workflow needs a Serpkin agent key as
SERPKIN_API_KEY, an Anthropic key asANTHROPIC_API_KEY(or a Claude subscription token asCLAUDE_CODE_OAUTH_TOKEN), and your site id as the repository variableSERPKIN_SITE_ID. The command prints the exactgh secret setandgh variable setlines.ghasks for each value, so a key never lands in your shell history. - Commit, push, and run it once
Commit the workflow files and push. Then run the workflow by hand once and read the log. When it succeeds, the pull request appears under Pull requests with the label
serpkin, and the mission in Serpkin shows as implemented with the pull request URL attached.
The full setup, including the optional SERPKIN_PR_TOKEN for letting your CI run on the pull request, is in Serpkin in GitHub Actions. That page also has the complete workflow file if you prefer to copy it by hand.
What the pull request contains
- A branch per run: named
serpkin/<mission>-<run>. The workflow never pushes to your default branch. - A title from the mission:
SEO: <mission title>, trimmed to fit GitHub. - A description in three parts: what changed and why, the files changed, and each acceptance check with how the agent met it.
- The label:
serpkin, which is also how the next run knows a pull request is still waiting for you. - A note at the bottom: a reminder that your CI and preview deployment test the change, and that you merge and deploy it yourself.
The pull request is a draft on purpose. Mark it ready when you have read the diff. If the mission can't be done safely in code, for example because it needs a DNS change or a new dependency, Claude Code changes no files and writes the reason to the run summary. The workflow then dismisses the mission in Serpkin with a note, so next week's run moves on instead of retrying the same blocked task. You can restore the mission in Serpkin and do it yourself.
How it stays safe
Mission text can quote page titles, search queries and competitor copy from the web, so a page could try to steer the agent. The workflow is built so that even a misled agent cannot do damage. It runs in three separate jobs with different permissions:
| Job | Can do | Cannot do |
|---|---|---|
| prepare | Call Serpkin with your agent key and read the mission | Run repository code |
| implement | Read and edit files in the checkout and the mission folder | Run shell commands, use the network, commit, push or see the Serpkin key |
| publish | Apply the patch, push a new branch and open a draft pull request | Run repository code or change protected files |
The publish job rejects changes to .github/, git internals, package.json, lockfiles, env files, deploy configuration such as vercel.json, symlinks and submodules. It also refuses a patch or description that looks like it contains a key or token, before anything is pushed. The patch is built in a fresh checkout with git hooks and user config disabled, so the agent cannot plant settings that the workflow would then trust. Actions are pinned to commit SHAs, every job has a timeout, and a concurrency group stops two runs from overlapping.
Review, merge, then verify
- Read the description and the diff
Start with the three sections in the description, then check the diff against the mission steps. The change should be focused on one mission. If it isn't, close the pull request and dismiss the mission with a reason instead of editing it into shape.
- Let CI and the preview check finish
Your normal CI runs on the branch. If the preview SEO check is installed, it compares the preview with production and fails on regressions such as a new
noindex, a removed canonical or a broken sitemap. A red check is information, not a blocker you should ignore. - Merge and deploy
Mark the draft ready, merge it, and deploy the way you normally do. Serpkin does not deploy anything for you and does not need deploy access.
- Verify the mission in production
Ask your agent to verify the mission, or run
npx serpkin check <production-url>first. A passed verification starts the measurement window, with results at 14 and 28 days. See Verification and results.
Weekly runs use no Serpkin credits. Missions, submissions and verification are included in your plan. GitHub Actions minutes and Anthropic usage are billed by those providers, not by Serpkin.
When a run skips or stops
| What you see | Why | What to do |
|---|---|---|
| A notice that a Serpkin pull request is still open | The previous week's pull request is waiting for review | Review and merge it, or close it and dismiss the mission |
| A notice that there is no open mission | Everything is done or still being measured | Nothing to do. New missions appear after the next scan or data refresh |
| A warning that no change was made | The mission needs work outside the code | Read the run summary, restore the mission in Serpkin, and do it yourself |
| An error about files the workflow doesn't allow | The mission needed a workflow, dependency or config change | Nothing was pushed. Restore the mission and make that change yourself |
| A 401 from Serpkin | The agent key is missing, revoked or for another workspace | Create a new agent key and set the secret again |
| CI did not run on the pull request | It was opened with the default GitHub token | Add the optional SERPKIN_PR_TOKEN secret |
GitHub can delay scheduled runs when Actions is busy. In public repositories it also turns scheduled workflows off after 60 days without repository activity, so run the workflow by hand to wake it up. If your team works in several time zones, change the cron line to a time that suits the person who reviews the pull request.
Change the schedule and scope
| Change | Where |
|---|---|
| Another day or time | The cron line, in UTC. 0 8 * * 1,4 runs Mondays and Thursdays. |
| Claude Pro or Max instead of an API key | Comment out anthropic_api_key and uncomment claude_code_oauth_token. |
| Another Serpkin server | npx serpkin weekly --server https://seo.example.com, or edit SERPKIN_SERVER. |
| A pull request against another base branch | Start the workflow by hand from that branch. The base is the branch the run started on. |
| No pull requests at all | Remove the workflow file. Missions still work through your agent on demand; you lose the automatic weekly start. |
The schedule is a starting point, not a rule. Teams that review quickly often run it twice a week; teams that deploy rarely leave it weekly and let a pull request stay open until they have time. The one-open-pull-request guardrail keeps either rhythm from piling up work.
Questions
Does Serpkin merge or deploy the pull request?
No. The workflow opens a draft pull request. You review the diff, your CI and preview deployment test it, and you merge and deploy it yourself.
What if I don't review last week's pull request?
Next week's run skips and writes a notice. Nothing piles up. Review or close the open pull request and the following run picks up the next mission.
Can I run it more than once a week?
Yes. Change the cron line to any schedule, or start the workflow by hand. The one-open-pull-request guardrail still applies.
Does the workflow need my source code?
It checks out your repository inside GitHub Actions, which is your own infrastructure. Serpkin receives the mission and the pull request URL, not your source code.