workflow-pr — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited workflow-pr (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Degree of freedom: MIXED. Feedback judgment [HIGH freedom]; validations, poll loop, and merge-only-if-asked [LOW freedom — run exactly].
Full checklist for an already-committed branch or an open PR.
Uncommitted / staged / untracked working tree that still needs review, commit, and a merge-ready PR is `workflow-release-prep`. This skill does not own that sequence.
| Skill | Owns |
|---|---|
| workflow-pr (this) | Existing PR lifecycle: review, bot feedback, conflicts, merge if asked |
workflow-release-prep | Uncommitted working tree to a merge-ready PR; never merges |
workflow-build-feature | Feature end to end: spec, TDD, tests, Playwright, then PR |
workflow-fix-and-ship | One bug-fix lifecycle: triage, debug, test, fix, then PR |
workflow-mobile-native-uiux | Full native UI/UX run on Capacitor, Expo, or RN to a PR |
Validate:pnpm typecheck && pnpm testgreen; no.envin the diff. Open: PR uses the repo template; titlefix(checkout): handle deleted SKU. Drive: CI red on lint → fix, push, re-poll; reply + resolve the bot thread. Gate:mergeable_state=clean, 0 threads; user did not ask to merge → report merge-ready and stop.
workflow-release-prepmergeable: true as approvalworkflow-release-prep; keep-green loop after open → babysitasked to merge.
babysit owns the green loop; the caller stops before merge.
JavaScript/TypeScript:
pnpm typecheck && pnpm build && pnpm test
# or: npm run typecheck && npm run build && npm testPython:
mypy . && python -m pytest && ruff check .With Makefile:
make typecheck && make build && make testBefore committing, verify:
/Users/username/...)pull_request_template.md in repoCheck every 60-90 seconds until checks complete:
Understanding Check Status:
mergeable: true → Only means no git conflictsmergeable_state: "clean" → ALL checks passed, safe to mergeMergeable State Values:
| State | Meaning | Action |
|---|---|---|
"clean" | ✅ All passed | Safe to merge |
"unstable" | ⚠️ Pending/failing | Wait, poll again |
"blocked" | ❌ Protection rules | Check requirements |
"behind" | ⚠️ Needs update | Update branch |
When reviews complete:
After pushing fixes:
SUCCESSTwo gates must pass:
| Gate | Check |
|---|---|
| Gate 1 | mergeable_state == "clean" |
| Gate 2 | unresolved_thread_count == 0 |
Both must be TRUE to merge.
Only after both gates pass and the user explicitly asked to merge:
gh pr merge --mergeOtherwise report that the PR is merge-ready and stop.
Confirm merge was successful and report status.
| Situation | Action |
|---|---|
| Checks fail 3x | Pause, ask for guidance |
| Unclear feedback | Ask clarifying questions |
| Merge blocked | Check protection rules, report |
| Checks stuck | Run local validation, ask permission |
mergeable_state is "unstable"Fix: Always check mergeable_state, poll again if unstable
mergeable: true as approvalFix: mergeable ≠ mergeable_state. Check the latter.
Fix: After every push, re-fetch comments for new threads
Fix: After addressing each comment, mark thread resolved
# Check PR status
gh pr status
# View checks
gh pr checks <number>
# View comments
gh pr view <number> --comments
# Merge (only when both gates pass)
gh pr merge <number> --merge~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.