pr-to-main — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited pr-to-main (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create a PR for a feature/fix branch targeting main in the cc-wf-studio monorepo.
This is a pnpm monorepo with four packages (packages/core, packages/mcp, packages/cli, packages/vscode) and versioning is driven by Changesets, not commit messages. Two monorepo facts shape this workflow:
.changeset/*.md file in the same PR. Without it, the change merges but never gets released — and pending changesets later block promotion to production.fix(vscode):).So the job here is not just "open a PR" — it's "open a PR that the release pipeline can actually act on."
git status (no -uall)git diff (staged + unstaged) and git diff origin/main...HEAD for the full branch deltagit log origin/main..HEAD --oneline for every commit on the branchls .changeset/*.md to see whether a changeset already existspackages/core → @cc-wf-studio/core, packages/mcp → @cc-wf-studio/mcp, packages/cli → @cc-wf-studio/cli, packages/vscode → cc-wf-studio (the VSCode extension). Changes outside packages/ (root config, .github/, docs) usually need no release.fix: / fix(vscode): → fix, feat: / feat(core): → feat, improvement: → improvement. Review all commits on the branch, not just the latest..changeset/*.md already covers this change, confirm it names the right package(s) and bump level, and move on.pnpm changeset — select the affected package(s) from step 2, choose patch/minor/major, and write a one-line summary (this becomes the CHANGELOG entry). Note: bumping @cc-wf-studio/core auto-bumps its dependents, so you don't author separate changesets for cli/mcp.pnpm changeset add --empty so the pipeline isn't left guessing.docs/release-flow.md for the release side — releasing is a human-only action, not something to self-trigger.)pnpm check && pnpm build from the repo root (Biome + type-checks, then full compilation). Reviewers and CI expect a clean tree, and catching breakage now is cheaper than after review.fix: → assets/fix-template.mdfeat: → assets/feat-template.mdimprovement: → assets/improvement-template.mdgit push -u if it has no upstream.gh pr create --base main, filling the chosen template.main merges via squash, so the PR title becomes the squash commit subject. It must therefore follow the commit convention: <type>(<scope>): <description>.<type>: matches the change type from step 2 — fix / feat / improvement / docs / refactor / chore / ci.<scope>: the affected package/area from step 2 — vscode, cli, mcp, core (use the directory name, not the npm name). List several as (cli, mcp). Omit the scope for repo-wide changes (root config, .github/, top-level docs), e.g. ci: guard against pending changesets.<description>: imperative mood, no trailing period, concise (aim ≤50 chars per the commit guideline; GitHub appends a (#NN) suffix, with a leading space, on squash — so don't pad it).fix(vscode): parse Changesets-format CHANGELOG, feat(cli): ccwf install-skills subcommand, docs: add root README for the monorepo.packages/vscode/src/..., packages/core/...), not generic placeholders.patch changeset for cc-wf-studio" or "No release needed (empty changeset)".assets/fix-template.md — Problem/Solution with Current vs Expected behavior.assets/feat-template.md — Summary/Motivation/Changes.assets/improvement-template.md — Before/After comparison.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.