verification-before-merge — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited verification-before-merge (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Final verification before merging. All gates must pass.
Core principle: Never merge without complete verification.
This is a HARD GATE. Do not merge with any failure.
All must be GREEN to merge:
┌──────────────────────────────────────────────────────┐
│ MERGE GATES │
├──────────────────────────────────────────────────────┤
│ [ ] CI Pipeline Green │
│ [ ] Local Integration Tests Pass (if services) │
│ [ ] All Tests Pass │
│ [ ] Code Review Approved │
│ [ ] Acceptance Criteria Verified │
│ [ ] No Unresolved Conversations │
│ [ ] Branch Up to Date │
│ [ ] No Merge Conflicts │
├──────────────────────────────────────────────────────┤
│ ALL GREEN → MERGE ALLOWED │
│ ANY RED → MERGE BLOCKED │
└──────────────────────────────────────────────────────┘# Check all CI checks
gh pr checks [PR_NUMBER]
# Expected: All passing
✓ build passed
✓ lint passed
✓ test passed
✓ typecheck passed
✓ security passedIf not green: Use ci-monitoring to resolve.
CRITICAL: CI should validate, not discover. If CI found bugs, local testing was insufficient.
# Verify services are running (if project has docker-compose)
docker-compose ps
# Run integration tests against real services
pnpm test:integration
# Verify migrations work
pnpm migrateIf project has docker-compose services:
Local testing evidence must be posted to issue before PR creation.
Skill: local-service-testing
# Verify locally (CI should have done this, but verify)
pnpm test
# Check coverage
pnpm test --coverageIf failing: Fix tests before merge.
# Check review status
gh pr view [PR_NUMBER] --json reviews
# Expected: At least one approval, no changes requestedIf not approved:
Check the issue:
gh issue view [ISSUE_NUMBER] --json bodyAll acceptance criteria should be checked:
## Acceptance Criteria
- [x] User can log in
- [x] Invalid credentials show error
- [x] Session persists
- [x] Logout clears sessionIf not verified: Complete verification before merge.
# Check for unresolved threads
gh pr view [PR_NUMBER] --json reviewThreadsAll review comments should be:
If unresolved: Address the feedback.
# Check if branch is behind target
gh pr view [PR_NUMBER] --json mergeable,mergeStateStatus
# If behind, update
git fetch origin
git rebase origin/main
git push --force-with-leaseIf not up to date: Rebase or merge target branch.
# Check for conflicts
gh pr view [PR_NUMBER] --json mergeableIf conflicts exist: Resolve before merge.
git fetch origin
git rebase origin/main
# Resolve conflicts
git add .
git rebase --continue
git push --force-with-leaseRun through this checklist before every merge:
## Pre-Merge Verification
### CI/Tests
- [ ] All CI checks passing
- [ ] Tests pass locally
- [ ] Coverage acceptable
### Review
- [ ] PR approved
- [ ] All conversations resolved
- [ ] Feedback addressed
### Verification
- [ ] All acceptance criteria verified
- [ ] Verification report posted to issue
- [ ] Issue ready to close
### Branch
- [ ] Up to date with target
- [ ] No merge conflicts
- [ ] Commits clean
### Documentation
- [ ] PR description complete
- [ ] Issue updated
- [ ] Relevant docs updatedOnce all gates are green:
# Merge with squash (recommended for clean history)
gh pr merge [PR_NUMBER] --squash --delete-branch
# Or merge commit
gh pr merge [PR_NUMBER] --merge --delete-branch
# Or rebase
gh pr merge [PR_NUMBER] --rebase --delete-branch| Strategy | When to Use |
|---|---|
| Squash | Most PRs - creates single clean commit |
| Merge | When commit history is important |
| Rebase | When you want linear history without merge commit |
Follow project conventions for merge strategy.
After successful merge:
# Check issue status
gh issue view [ISSUE_NUMBER] --json state
# Should be: "CLOSED"
# If not closed automatically, close it
gh issue close [ISSUE_NUMBER] --comment "Closed by #[PR_NUMBER]"# Update GitHub Project fields
# Status → Done
# (Using project-status-sync)# Switch to main
git checkout main
# Pull merged changes
git pull origin main
# Delete local branch
git branch -d feature/issue-123-description
# Prune remote tracking branches
git remote prune originIf auto-deploy is configured:
Cannot merge: Review required
→ Request review
→ Address feedback
→ Get approvalCannot merge: CI checks failing
→ Use ci-monitoring skill
→ Fix failures
→ Wait for greenCannot merge: Branch out of date
→ git fetch origin
→ git rebase origin/main
→ Resolve conflicts
→ git push --force-with-leaseCannot merge: Unresolved review threads
→ Address each comment
→ Mark as resolved
→ Re-request review if needed| Situation | Action |
|---|---|
| Tests failing | Fix tests first |
| CI red | Fix CI first |
| Review pending | Wait for review |
| Conflicts exist | Resolve conflicts |
| Acceptance criteria not met | Complete verification |
| Critical feedback unaddressed | Address feedback |
Final verification before clicking merge:
This skill is called by:
issue-driven-development - Step 13This skill follows:
ci-monitoring - CI is greenpr-creation - PR existsThis skill completes:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.