finishing-a-development-branch — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited finishing-a-development-branch (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Guide the completion of development work on a branch — decide how to integrate, verify readiness, execute the choice, and clean up.
Core principle: Verify before you ship. Present options, don't assume. Clean up after yourself.
NO MERGE WITHOUT GREEN TESTS AND CLEAN STATUSIf tests fail or uncommitted changes exist, STOP. Fix first. No exceptions.
Corollary: Never push directly to main/master. Always use a PR for protected branches.
MANDATORY. Complete every item before proceeding.
# 1. All tests pass
npm test # or: yarn test, pytest, go test ./...
# 2. No type errors
npx tsc --noEmit # or equivalent for your language
# 3. No uncommitted changes
git status # must be clean
# 4. Branch is up to date with base
git fetch origin
git merge-base --is-ancestor origin/<base> HEAD # exit 0 = up to datetsc --noEmit or equivalent)git status shows nothing)Any blocking item fails? STOP. Fix it. Re-run the checklist.
digraph decision {
rankdir=TB;
node [shape=diamond, style=filled, fillcolor="#ffffcc"];
start [label="Pre-completion\nchecklist passed?", shape=diamond];
keep [label="Work worth\nkeeping?"];
protected [label="Target branch\nprotected?"];
review [label="Changes need\nreview?"];
simple [label="Single commit,\npersonal branch?"];
stop [label="STOP\nFix issues first", fillcolor="#ffcccc", shape=box];
abandon [label="PATH C\nCleanup / Abandon", fillcolor="#ffcccc", shape=box];
pr [label="PATH B\nCreate PR", fillcolor="#ccffcc", shape=box];
merge [label="PATH A\nMerge Directly", fillcolor="#ccccff", shape=box];
start -> keep [label="yes"];
start -> stop [label="no"];
keep -> abandon [label="no"];
keep -> protected [label="yes"];
protected -> pr [label="yes"];
protected -> review [label="no"];
review -> pr [label="yes"];
review -> simple [label="no"];
simple -> merge [label="yes"];
simple -> pr [label="no"];
}| Condition | Path |
|---|---|
| Checklist fails | STOP — fix first |
| Work not worth keeping | PATH C — Cleanup/Abandon |
| Target branch is protected | PATH B — Create PR |
| Changes need review | PATH B — Create PR |
| Simple change, personal branch | PATH A — Merge Directly |
| Unsure which path | PATH B — Create PR (safe default) |
For simple, single-commit changes on unprotected personal branches.
# 1. Update base branch
git checkout <base>
git pull origin <base>
# 2. Merge feature branch
git merge <feature-branch>
# 3. Push
git push origin <base>WARNING: Never use PATH A if <base> is main/master or any protected branch. Use PATH B instead.
When to use: Solo work, unprotected branch, trivial change, no review needed.
If merge conflicts arise: Resolve conflicts, run tests again, then commit. If conflicts are complex, abort with git merge --abort and switch to PATH B.
The safe default for most workflows. Use the pr-all-in-one skill if available.
# 1. Push feature branch
git push -u origin <feature-branch>
# 2. Create PR (adjust title and body as needed)
gh pr create \
--title "feat: description of change" \
--body "## Summary
- What changed and why
## Test plan
- [ ] Tests pass
- [ ] Manual verification done
Closes #<issue-number>"Squash before PR (if commits are messy):
# Clean up commits (use interactive rebase for manual control,
# or --autosquash for automated fixup commits)
git rebase -i origin/<base>
# Then force-push (ALWAYS use --force-with-lease, NEVER --force)
git push --force-with-leaseWhen to use: Team projects, protected branches, changes needing review, anything non-trivial.
For experimental, superseded, or failed work.
Before abandoning, check for salvageable work:
# Review what would be lost
git log origin/<base>..HEAD --oneline
git diff origin/<base>..HEAD --stat
# Cherry-pick specific commits if needed
git checkout <base>
git cherry-pick <commit-hash>Then proceed to Phase 4 cleanup.
# 1. Switch to base branch
git checkout <base>
git pull origin <base>
# 2. Delete local branch (-d is safe; use -D only if unmerged and intentional)
git branch -d <feature-branch>
# 3. Delete remote branch (if merged or abandoned)
git push origin --delete <feature-branch>IMPORTANT: Remove worktree BEFORE deleting the branch.
# 1. Leave the worktree directory
cd <main-repo-path>
# 2. Remove the worktree
git worktree remove <worktree-path>
# 3. Prune stale worktree references
git worktree prune
# 4. NOW delete the branch (-d is safe; use -D only if unmerged and intentional)
git branch -d <feature-branch>Why this order matters: You cannot delete a branch that is checked out in a worktree. Attempting to do so will fail. Always remove the worktree first.
# Confirm cleanup
git branch # feature branch should be gone
git branch -r # remote branch should be gone
git worktree list # no stale worktrees| Excuse | Reality |
|---|---|
| "Tests mostly pass" | Mostly ≠ all. Fix the failures. |
| "I'll clean up commits later" | Later never comes. Squash now. |
| "Direct push is faster" | Fast now, broken later. Use a PR. |
| "It's just a small change" | Small changes break things too. Follow the checklist. |
| "I'll delete the branch later" | Stale branches accumulate. Clean up now. |
| "The worktree is fine to leave" | Orphaned worktrees waste disk and cause confusion. Remove it. |
| "Force push is fine here" | Use --force-with-lease. Always. No exceptions. |
| "No one reviews my PRs anyway" | The PR is the review record. Create it anyway. |
| "I'll rebase after merge" | Rebase before. Conflicts after merge are worse. |
git push --force (use --force-with-lease)Any red flag means: STOP. Go back to Phase 1.
Before marking branch work as complete:
Can't check all boxes? You're not done yet.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.