git-conventions — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited git-conventions (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
git commit, git push, and gh pr create are invoked only when the human explicitly types /commit-push-pr or /sync (or one of their listed Trigger Phrases). The slash commands themselves are not invoked autonomously — wait for the human trigger. The Version bump: AskUserQuestion in /commit-push-pr is non-skippable; refuse to proceed without an explicit human selection.
See CLAUDE.md Critical Rule 13.
Pattern: {type}/{short-description}
Types:
feature/ — New functionalityfix/ — Bug fixesrefactor/ — Code restructuring without behavior changedocs/ — Documentation onlytest/ — Test additions or fixeschore/ — Tooling, dependencies, configExamples:
feature/auth-flowfix/login-timeoutrefactor/extract-merger-moduleKeep branch names under 50 characters. Use hyphens, not underscores.
Follow conventional commits format:
type(scope): short description
Longer explanation if needed. Focus on WHY, not WHAT.
The diff already shows what changed.
Closes #123Types: feat, fix, refactor, test, docs, chore, perf, ci
Scope is optional but helpful: feat(auth): add OAuth2 token refresh
Rules:
Commit after each logical unit of work:
Don't batch unrelated changes into one commit. Don't commit broken code.
feature-branch ──PR──▶ develop ──PR──▶ main (release)develop — active development. Contributors fork, branch from develop, and PR back to develop.main — production releases. Maintainer-only, merged from develop.gh-pages — auto-deployed docs. Maintainer-only.All feature/bugfix branches are created from and merged back into develop. Never PR directly to main.
gh pr create --base develop (feature/bugfix branches target develop)develop, PR targets main: gh pr create --base main (release merges only)type(scope): descriptionDefault preference: squash merge for feature branches, regular merge for release branches.
When using git worktree for parallel work:
{repo}-{branch-name} for the worktree directorygit worktree remove {path}Agents that use worktree isolation (code-simplifier, test-writer, bug-fixer, etc.) create and clean up their own worktrees automatically.
These files are modified ONLY on the develop branch (via /sync), never on feature branches:
docs/spec/PROGRESS.md — project progress trackerdocs/spec/SPEC.md — feature specificationREADME.md — project documentationpackage.json version field — release versioningThis prevents merge conflicts when running parallel feature branches.
Follow semver when the project publishes releases:
| What changed | Bump | Example |
|---|---|---|
| Bug fix, patch to existing behavior | patch | Fixed edge case in date parser |
| New feature, command, or API surface | minor | Added CSV export option |
| Breaking change to public API or CLI | major | Renamed config key, removed flag |
| Only docs, CI, tests, internal refactor | no bump | Updated README, added test |
Publish from the primary branch (usually `main`), not from feature or development branches. What is published must always match what is on the release branch.
When to bump: Include the version change in the same PR as the work — no separate "bump version" commits after the fact.
How to publish:
maingit checkout main && git pullnpm publish, cargo publish, twine upload, etc.)git checkout develop && git merge main && git push origin developRule of thumb: If the change affects what users see, install, or depend on, it needs a version bump. If it only affects the project's internal development workflow, it does not.
Every PR targeting develop declares its intended version bump in the PR description:
Version bump: {major|minor|patch|none}major — breaking change to public API, CLI, or scaffold contractminor — new feature, command, agent, or flagpatch — bug fix or user-visible behavior change with no new surfacenone — docs, CI, tests, internal refactor (nothing consumers notice)/sync aggregates declarations from all PRs merged since the last version tag and picks the highest: major > minor > patch > none. If all merged PRs are none, no release is cut — /sync updates shared-state files but does not bump the version or open a PR to main.
This is how release batching works: internal-only work accumulates on develop without triggering publishes, and multiple user-facing PRs group into a single well-documented release.
/sync excludes these from scanning.They ARE the release, not an input to one. Known limitation: any develop→main PR is excluded regardless of content. Safe in practice because that direction is only used for releases.
Reverting a patch is itself a patch. A patch + matching revert in the same release group produces a net-zero user-visible change but still bumps the version — something shipped internally and was un-shipped, which is part of the release's history. Do not cancel them out.
none with a warning thatpropagates to the release PR body and CHANGELOG entry. Do not manually backfill old PR bodies — let them flow through as none so under-documentation is visible rather than silent.
/sync prompts to create a startingtag (default v0.1.0, customizable, cancelable). The tool does NOT silently invent a tag.
/sync entirely. Requiresmanual version management. Known limitation; out of scope.
Optional: GitHub labels (release:major, release:minor, etc.) can replace body-text declarations for maintainers who prefer them. Deferred to a future phase; not scaffolded by default.
own the branch and have communicated with collaborators.
git reflog is your friend. The old state is still there.A stash in one worktree is visible in another.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.