pr-workflow
|
它会碰到什么
逐条看命中(30 条严重或高危)
- 严重
references/commit-conventional.md:80cred-paths- `chore: add .env to .gitignore`
- 严重
references/commit-examples.md:22cred-pathsblock `.env`, `*credentials*`, `*secret*`, `*.pem`, `*.key`, `.npmrc`, or `.pypirc` into a commit because credentials in git history are permanent -- removing t
- 严重
references/commit-examples.md:22cred-pathsblock `.env`, `*credentials*`, `*secret*`, `*.pem`, `*.key`, `.npmrc`, or `.pypirc` into a commit because credentials in git history are permanent -- removing t
- 严重
references/commit-examples.md:22cred-pathsblock `.env`, `*credentials*`, `*secret*`, `*.pem`, `*.key`, `.npmrc`, or `.pypirc` into a commit because credentials in git history are permanent -- removing t
- 严重
references/commit-examples.md:27cred-pathsgit diff --cached --name-only | grep -iE '\.(env|pem|key)$|credentials|secret|\.npmrc|\.pypirc'
- 严重
references/commit-examples.md:27cred-pathsgit diff --cached --name-only | grep -iE '\.(env|pem|key)$|credentials|secret|\.npmrc|\.pypirc'
- 严重
references/commit-examples.md:35cred-pathsThis scan applies to every commit, including documentation-only changes, because doc commits can accidentally include `.env` files staged alongside them.
- 严重
references/commit-examples.md:172cred-paths**Cause**: Files matching sensitive patterns (`.env`, `*credentials*`, `*.key`) found in changes.
- 严重
references/commit-examples.md:174cred-paths1. Add to `.gitignore`: `echo ".env" >> .gitignore`
- 严重
references/commit-examples.md:175cred-paths2. Unstage if already staged: `git reset HEAD .env`
- 严重
references/commit-examples.md:176cred-paths3. If already tracked: `git rm --cached .env`
- 严重
references/commit-workflow-examples.md:77cred-pathsif git diff --cached --name-only | grep -iE '\.(env|pem|key)$|credentials|secret|\.npmrc|\.pypirc'; then
- 严重
references/commit-workflow-examples.md:77cred-pathsif git diff --cached --name-only | grep -iE '\.(env|pem|key)$|credentials|secret|\.npmrc|\.pypirc'; then
- 严重
references/pipeline.md:63cred-paths- `.env`, `.env.*`
- 严重
references/pipeline.md:63cred-paths- `.env`, `.env.*`
- 严重
references/pipeline.md:64cred-paths- `credentials.json`, `secrets.*`
- 严重
references/pipeline.md:321cred-pathsCause: User's changes include .env, credentials, keys, or other secrets
- 严重
references/sync.md:79cred-pathsStage files selectively by name rather than using `git add -A`, because blind staging catches unintended files -- build artifacts, `.env` files, editor configs,
- 严重
scripts/validate_state.py:23cred-paths(r"\.env$", "Environment file", "critical"),
- 严重
scripts/validate_state.py:24cred-paths(r"\.env\..*", "Environment file pattern (.env.*)", "critical"),
- 严重
scripts/validate_state.py:24cred-paths(r"\.env\..*", "Environment file pattern (.env.*)", "critical"),
- 严重
scripts/validate_state.py:25cred-paths(r".*\.env$", "Environment file pattern (*.env)", "critical"),
- 严重
scripts/validate_state.py:38cred-paths(r"\.npmrc$", "NPM authentication config", "critical"),
- 严重
scripts/validate_state.py:39cred-paths(r"\.pypirc$", "PyPI authentication config", "critical"),
- 严重
scripts/validate_state.py:40cred-paths(r"\.netrc$", "Network authentication config", "critical"),
- 严重
scripts/validate_state.py:46cred-paths(r"id_rsa$", "SSH private key", "critical"),
- 严重
scripts/validate_state.py:48cred-paths(r"id_ed25519$", "SSH private key", "critical"),
- 高
references/pr-risk-policy.md:18identity-config-write| `.claude/settings.local.json` | Local permission overrides |
- 高
scripts/coordinator-validate.py:132exec-spawnresult = subprocess.run(
- 高
scripts/miner.py:286cred-envreadtoken = os.environ.get("GITHUB_TOKEN")
这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。
技能内容
PR Workflow Skill
Umbrella skill for the entire pull request lifecycle. Routes to the correct reference based on the PR task requested.
Reference Loading Table
Detect the user's intent and load the appropriate reference file:
| Intent | Trigger phrases | Reference |
|--------|----------------|-----------|
| Sync (default) | "push", "create PR", "sync", "ship this" | ${CLAUDE_SKILL_DIR}/references/sync.md |
| Pipeline | "submit PR", "full PR", "end-to-end PR", "open PR" | ${CLAUDE_SKILL_DIR}/references/pipeline.md |
| Fix | "fix PR comments", "address review", "pr-fix", "resolve feedback" | ${CLAUDE_SKILL_DIR}/references/fix.md |
| Status | "pr status", "branch status", "is my PR ready", "check CI" | ${CLAUDE_SKILL_DIR}/references/status.md |
| Cleanup | "clean up branches", "delete merged branch", "prune" | ${CLAUDE_SKILL_DIR}/references/cleanup.md |
| Feedback | "process PR feedback", "address reviews", "what did reviewers say" | ${CLAUDE_SKILL_DIR}/references/feedback.md |
| Miner | "mine PRs", "extract review comments", "tribal knowledge", "reviewer patterns" | ${CLAUDE_SKILL_DIR}/references/miner.md |
| Branch name | "generate branch name", "validate branch name", "name branch", "branch convention", "git branch name" | ${CLAUDE_SKILL_DIR}/references/branch-name.md |
| CI check | "check CI", "CI status", "actions status", "did CI pass", "build status", "CI passed" | ${CLAUDE_SKILL_DIR}/references/ci-check.md |
| Commit | "commit changes", "stage and commit", "commit my changes", "commit my files", "commit these" | ${CLAUDE_SKILL_DIR}/references/commit.md |
| Codex review | "codex review", "second opinion", "code review codex", "gpt review", "cross-model review" | ${CLAUDE_SKILL_DIR}/references/codex-review.md |
| Land | "land PR", "land the PR", "merge contributor PR", "rebase and merge PR" | ${CLAUDE_SKILL_DIR}/references/land-pr.md |
| Body safety | any gh call writing or reading a PR/issue body | ${CLAUDE_SKILL_DIR}/references/gh-body-safety.md |
| Changelog | "update changelog", "release notes", "curate changelog" | ${CLAUDE_SKILL_DIR}/references/changelog-curation.md |
| Decision brief | "decision brief", "authorization tier", "ask the owner", "is it decision-ready" | ${CLAUDE_SKILL_DIR}/references/owner-decision-briefs.md |
| Risk classify | automatic pre-review step; also "classify PR risk", "pr risk", "risk check" | ${CLAUDE_SKILL_DIR}/references/pr-risk-policy.md |
| INDEX conflict | "INDEX.json conflict", "INDEX conflict on rebase", "two PRs regenerated INDEX", "regenerate INDEX after rebase" | ${CLAUDE_SKILL_DIR}/references/index-conflict-resolution.md |
Default action: When invoked with no arguments or ambiguous intent, load sync.md (the most common PR use case).
Review scope
Before dispatching reviewers, load references/pr-risk-policy.md. It owns risk classification, roster selection, and review reuse. Preserve explicit user and /do rosters and repository requirements; do not start a second review at each PR phase.
PR body
Use Summary → Changes → Notes, following .github/pull_request_template.md. Passing --body or --body-file supplies the body instead of loading that template.
- Summary: State what changes and why in 1–3 plain sentences; name the relevant issue or ADR.
- Changes: One fact per line: what changed and where. Summarize large lists by shape and count; let the diff enumerate them.
- Notes: Include non-obvious decisions, deliberate omissions, follow-ups, gotchas, superseded PRs, and material plan deviations. Also include manual verification, gaps in CI coverage, migration/rollout ordering, and security-sensitive changes. Omit the section only when none apply.
Keep command dumps out of the body; GitHub Checks records CI results. Retain verification facts that CI does not establish, such as “Apply the column migration before deploying” or “Not covered by CI — Terraform plan checked manually.”
Use existing planning artifacts for intent and completed work; otherwise use the diff and commits. Describe the final change, not the conversation or abandoned approaches unless they explain a tradeoff.
Write the body to a temporary file with a quoted heredoc, then pass --body-file, following ${CLAUDE_SKILL_DIR}/references/gh-body-safety.md. Read the body back before submitting it.
Execution
Load the matching reference and execute within the user's existing authorization. Ask only for an uncovered action or an explicit applicable repository requirement; do not ask again for actions already authorized. Preserve repository branch protection and review requirements.
想直接用这个技能?
本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。