@olegkoval/agent-skills 1.25.0 → 1.26.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude-plugin/plugin.json +8 -2
- package/.cursor-plugin/index.json +30 -0
- package/.grok-plugin/index.json +30 -0
- package/.kiro/steering/codexloop.md +254 -0
- package/.kiro/steering/geminiloop.md +230 -0
- package/.kiro/steering/pr-finalize-complete.md +187 -0
- package/.windsurf/rules/codexloop.md +253 -0
- package/.windsurf/rules/geminiloop.md +229 -0
- package/.windsurf/rules/pr-finalize-complete.md +186 -0
- package/README.md +9 -3
- package/catalog/skills.json +146 -0
- package/package.json +1 -1
- package/packages/software-development/codexloop/SKILL.md +261 -0
- package/packages/software-development/codexloop/adapters/claude/plugin.json +5 -0
- package/packages/software-development/codexloop/adapters/claude/skills/codexloop/SKILL.md +262 -0
- package/packages/software-development/codexloop/adapters/codex/README.md +26 -0
- package/packages/software-development/codexloop/adapters/cursor/plugin.json +6 -0
- package/packages/software-development/codexloop/adapters/cursor/skills/codexloop/SKILL.md +263 -0
- package/packages/software-development/codexloop/adapters/grok/plugin.json +6 -0
- package/packages/software-development/codexloop/adapters/grok/skills/codexloop/SKILL.md +262 -0
- package/packages/software-development/codexloop/adapters/kiro/steering/codexloop.md +254 -0
- package/packages/software-development/codexloop/adapters/windsurf/rules/codexloop.md +253 -0
- package/packages/software-development/dependabot-triage/SKILL.md +150 -0
- package/packages/software-development/dependabot-triage/adapters/claude/plugin.json +5 -0
- package/packages/software-development/dependabot-triage/adapters/claude/skills/dependabot-triage/SKILL.md +151 -0
- package/packages/software-development/dependabot-triage/adapters/codex/README.md +19 -0
- package/packages/software-development/dependabot-triage/adapters/cursor/plugin.json +6 -0
- package/packages/software-development/dependabot-triage/adapters/cursor/skills/dependabot-triage/SKILL.md +151 -0
- package/packages/software-development/dependabot-triage/adapters/grok/plugin.json +6 -0
- package/packages/software-development/dependabot-triage/adapters/grok/skills/dependabot-triage/SKILL.md +151 -0
- package/packages/software-development/geminiloop/SKILL.md +237 -0
- package/packages/software-development/geminiloop/adapters/claude/plugin.json +5 -0
- package/packages/software-development/geminiloop/adapters/claude/skills/geminiloop/SKILL.md +238 -0
- package/packages/software-development/geminiloop/adapters/codex/README.md +25 -0
- package/packages/software-development/geminiloop/adapters/cursor/plugin.json +6 -0
- package/packages/software-development/geminiloop/adapters/cursor/skills/geminiloop/SKILL.md +239 -0
- package/packages/software-development/geminiloop/adapters/grok/plugin.json +6 -0
- package/packages/software-development/geminiloop/adapters/grok/skills/geminiloop/SKILL.md +238 -0
- package/packages/software-development/geminiloop/adapters/kiro/steering/geminiloop.md +230 -0
- package/packages/software-development/geminiloop/adapters/windsurf/rules/geminiloop.md +229 -0
- package/packages/software-development/pr-finalize-complete/SKILL.md +195 -0
- package/packages/software-development/pr-finalize-complete/adapters/claude/plugin.json +5 -0
- package/packages/software-development/pr-finalize-complete/adapters/claude/skills/pr-finalize-complete/SKILL.md +196 -0
- package/packages/software-development/pr-finalize-complete/adapters/codex/README.md +24 -0
- package/packages/software-development/pr-finalize-complete/adapters/cursor/plugin.json +6 -0
- package/packages/software-development/pr-finalize-complete/adapters/cursor/skills/pr-finalize-complete/SKILL.md +197 -0
- package/packages/software-development/pr-finalize-complete/adapters/grok/plugin.json +6 -0
- package/packages/software-development/pr-finalize-complete/adapters/grok/skills/pr-finalize-complete/SKILL.md +196 -0
- package/packages/software-development/pr-finalize-complete/adapters/kiro/steering/pr-finalize-complete.md +187 -0
- package/packages/software-development/pr-finalize-complete/adapters/windsurf/rules/pr-finalize-complete.md +186 -0
- package/packages/software-development/pr-to-green/SKILL.md +165 -0
- package/packages/software-development/pr-to-green/adapters/claude/plugin.json +5 -0
- package/packages/software-development/pr-to-green/adapters/claude/skills/pr-to-green/SKILL.md +166 -0
- package/packages/software-development/pr-to-green/adapters/codex/README.md +19 -0
- package/packages/software-development/pr-to-green/adapters/cursor/plugin.json +6 -0
- package/packages/software-development/pr-to-green/adapters/cursor/skills/pr-to-green/SKILL.md +166 -0
- package/packages/software-development/pr-to-green/adapters/grok/plugin.json +6 -0
- package/packages/software-development/pr-to-green/adapters/grok/skills/pr-to-green/SKILL.md +166 -0
- package/packages/software-development/store-listing-copy/SKILL.md +215 -0
- package/packages/software-development/store-listing-copy/adapters/claude/plugin.json +5 -0
- package/packages/software-development/store-listing-copy/adapters/claude/skills/store-listing-copy/SKILL.md +216 -0
- package/packages/software-development/store-listing-copy/adapters/codex/README.md +20 -0
- package/packages/software-development/store-listing-copy/adapters/cursor/plugin.json +6 -0
- package/packages/software-development/store-listing-copy/adapters/cursor/skills/store-listing-copy/SKILL.md +216 -0
- package/packages/software-development/store-listing-copy/adapters/grok/plugin.json +6 -0
- package/packages/software-development/store-listing-copy/adapters/grok/skills/store-listing-copy/SKILL.md +216 -0
|
@@ -0,0 +1,151 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: dependabot-triage
|
|
3
|
+
description: >
|
|
4
|
+
Triage all open Dependabot and Renovate PRs in bulk: classify each by risk tier (patch / minor /
|
|
5
|
+
major / security), auto-approve and merge safe patch-only bumps, flag breaking major upgrades with
|
|
6
|
+
a summary of what changed, and post a digest of what was done. Use when dependency PRs are piling
|
|
7
|
+
up, when the user says "deal with Dependabot", "triage dependency updates", or "merge the safe
|
|
8
|
+
ones", or at the start of a maintenance window.
|
|
9
|
+
license: MIT
|
|
10
|
+
allowed-tools: Bash, Read, Write
|
|
11
|
+
compatibility: Codex, Claude Code, Cursor, GitHub Copilot, Windsurf, Kiro, and other Agent Skills compatible tools. Requires git and gh (GitHub CLI) authenticated.
|
|
12
|
+
metadata:
|
|
13
|
+
targets: ["cursor"]
|
|
14
|
+
author: Oleg Koval
|
|
15
|
+
tags:
|
|
16
|
+
- dependabot
|
|
17
|
+
- renovate
|
|
18
|
+
- dependencies
|
|
19
|
+
- security
|
|
20
|
+
- automation
|
|
21
|
+
- triage
|
|
22
|
+
- github
|
|
23
|
+
source: weekly-pattern-learner
|
|
24
|
+
source_reason: "obsidian-pr-sync explicitly filters out dependabot/renovate PRs — the user handles them separately, but no skill existed to batch-triage them"
|
|
25
|
+
source_date: "2026-07-31"
|
|
26
|
+
---
|
|
27
|
+
<!-- Generated by scripts/build-adapters.sh. Do not edit directly. -->
|
|
28
|
+
|
|
29
|
+
> 🤖 *Auto-generated by **weekly-pattern-learner** · obsidian-pr-sync explicitly filters out dependabot/renovate PRs — the user handles them separately, but no skill existed to batch-triage them*
|
|
30
|
+
|
|
31
|
+
# Dependabot Triage
|
|
32
|
+
|
|
33
|
+
Bulk-process open Dependabot and Renovate PRs: approve and merge what is safe,
|
|
34
|
+
flag what needs a human decision, and report what was done.
|
|
35
|
+
|
|
36
|
+
## Inputs
|
|
37
|
+
|
|
38
|
+
- **Repository** (optional): default to the current repo.
|
|
39
|
+
- **Auto-merge policy** (optional, default: `patch-only`): `none`, `patch-only`, or `patch-and-minor`.
|
|
40
|
+
- **Require CI** (optional, default: on): only merge PRs whose checks are green.
|
|
41
|
+
|
|
42
|
+
## Step 1 — Fetch all open dependency PRs
|
|
43
|
+
|
|
44
|
+
```bash
|
|
45
|
+
# Dependabot PRs
|
|
46
|
+
gh pr list --state open --label "dependencies" \
|
|
47
|
+
--json number,title,author,labels,headRefName,url,isDraft \
|
|
48
|
+
--jq '.[] | select(.author.login | test("dependabot|renovate"; "i"))'
|
|
49
|
+
|
|
50
|
+
# Also catch Renovate PRs not labelled "dependencies"
|
|
51
|
+
gh pr list --state open \
|
|
52
|
+
--json number,title,author,labels,headRefName,url,isDraft \
|
|
53
|
+
--jq '.[] | select(.author.login == "renovate[bot]" or .author.login == "dependabot[bot]")'
|
|
54
|
+
```
|
|
55
|
+
|
|
56
|
+
Merge both result sets, deduplicate by number, skip drafts.
|
|
57
|
+
|
|
58
|
+
## Step 2 — Classify each PR
|
|
59
|
+
|
|
60
|
+
Parse the PR title to extract package name and version change.
|
|
61
|
+
|
|
62
|
+
Dependabot title format: `Bump <package> from <old> to <new>`
|
|
63
|
+
Renovate title format: `Update dependency <package> to v<new>` or `chore(deps): update <package>`
|
|
64
|
+
|
|
65
|
+
For each PR:
|
|
66
|
+
|
|
67
|
+
```bash
|
|
68
|
+
gh pr view <NUMBER> --json title,body,labels,reviews \
|
|
69
|
+
--jq '{title, body: (.body | .[0:500]), labels: [.labels[].name], reviews: [.reviews[].state]}'
|
|
70
|
+
```
|
|
71
|
+
|
|
72
|
+
Classify:
|
|
73
|
+
|
|
74
|
+
| Tier | Condition | Default action |
|
|
75
|
+
|------|-----------|----------------|
|
|
76
|
+
| **patch** | semver patch bump (`X.Y.Z → X.Y.Z+1`), no security label | auto-approve and merge (if CI green) |
|
|
77
|
+
| **minor** | semver minor bump (`X.Y.Z → X.Y+1.0`), no security label | approve and merge when `patch-and-minor` policy |
|
|
78
|
+
| **major** | semver major bump (`X.Y.Z → X+1.0.0`) | flag for human: summarize breaking changes |
|
|
79
|
+
| **security** | has `security` label, or title contains "CVE" or "vulnerability" | escalate: approve if CI green AND patch/minor; human if major |
|
|
80
|
+
|
|
81
|
+
When in doubt about the bump type (e.g. non-semver packages), treat as `minor`.
|
|
82
|
+
|
|
83
|
+
## Step 3 — Check CI for merge candidates
|
|
84
|
+
|
|
85
|
+
For each PR classified as auto-approvable:
|
|
86
|
+
|
|
87
|
+
```bash
|
|
88
|
+
gh pr checks <NUMBER> --json name,state,conclusion \
|
|
89
|
+
--jq '[.[] | select(.conclusion != "success" and .conclusion != "skipped")] | length'
|
|
90
|
+
```
|
|
91
|
+
|
|
92
|
+
If CI is still running, wait up to 10 minutes (polling every 30s). If CI fails, demote
|
|
93
|
+
to `blocked` — do not merge a PR with failing checks regardless of policy.
|
|
94
|
+
|
|
95
|
+
If CI is disabled for dependency PRs in this repo (no checks at all), note it and proceed
|
|
96
|
+
only when the user has passed `--skip-ci-check` explicitly.
|
|
97
|
+
|
|
98
|
+
## Step 4 — Approve and merge safe PRs
|
|
99
|
+
|
|
100
|
+
For each auto-approvable PR with green CI:
|
|
101
|
+
|
|
102
|
+
```bash
|
|
103
|
+
# Approve
|
|
104
|
+
gh pr review <NUMBER> --approve --body "Auto-approved by dependabot-triage: patch bump, CI green."
|
|
105
|
+
|
|
106
|
+
# Merge (squash is the default; use the repo's configured merge strategy if known)
|
|
107
|
+
gh pr merge <NUMBER> --squash --delete-branch \
|
|
108
|
+
--subject "$(gh pr view <NUMBER> --json title --jq .title)"
|
|
109
|
+
```
|
|
110
|
+
|
|
111
|
+
If the merge fails (conflict, branch protection, etc.), fall back to `blocked` and note it.
|
|
112
|
+
|
|
113
|
+
## Step 5 — Comment on flagged PRs
|
|
114
|
+
|
|
115
|
+
For each `major` or `blocked` PR, post one comment summarizing why it needs a human:
|
|
116
|
+
|
|
117
|
+
```bash
|
|
118
|
+
gh pr comment <NUMBER> --body "**dependabot-triage:** This is a major version bump. \
|
|
119
|
+
Review the changelog before merging: $(gh pr view <NUMBER> --json body --jq '.body | split("\n") | map(select(test("changelog|release|BREAKING"; "i"))) | .[0]').
|
|
120
|
+
|
|
121
|
+
No action was taken."
|
|
122
|
+
```
|
|
123
|
+
|
|
124
|
+
## Step 6 — Report
|
|
125
|
+
|
|
126
|
+
Print a digest, then stop. Do not merge anything not listed as approved in this report.
|
|
127
|
+
|
|
128
|
+
```
|
|
129
|
+
Dependabot triage complete.
|
|
130
|
+
Merged (patch, CI green): 7 PRs → lodash 4.17.20→4.17.21, eslint 8.56.0→8.57.0, ...
|
|
131
|
+
Merged (security, CI green): 1 PR → axios 1.6.2→1.7.9 (CVE-2024-39338)
|
|
132
|
+
Flagged for human review: 2 PRs → next.js 14→15 (major), @types/node 20→22 (major)
|
|
133
|
+
Blocked (CI failing): 1 PR → typescript 5.4→5.5 (lint errors)
|
|
134
|
+
Skipped (draft): 1 PR
|
|
135
|
+
|
|
136
|
+
Open a flagged PR and run /pr-to-green after reviewing the changelog.
|
|
137
|
+
```
|
|
138
|
+
|
|
139
|
+
## Safety guardrails
|
|
140
|
+
|
|
141
|
+
- Never merge a PR whose author is not `dependabot[bot]` or `renovate[bot]`, even if found by the label query.
|
|
142
|
+
- Never merge a major bump automatically, even if `patch-and-minor` policy is set.
|
|
143
|
+
- Never approve a PR if `gh pr checks` shows any failure — a quiet pass is not the same as no checks.
|
|
144
|
+
- Always post a comment on flagged PRs so the record is visible in the thread.
|
|
145
|
+
|
|
146
|
+
## Chaining
|
|
147
|
+
|
|
148
|
+
| Before this skill | After this skill |
|
|
149
|
+
|---|---|
|
|
150
|
+
| morning routine / maintenance window | `olko:pr-to-green` on flagged PRs after human review |
|
|
151
|
+
| `olko:obsidian-pr-sync` (which filters these out) | back to obsidian-pr-sync for remaining human PRs |
|
|
@@ -0,0 +1,6 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "olko:dependabot-triage",
|
|
3
|
+
"version": "0.1.0",
|
|
4
|
+
"description": "Triage open Dependabot and Renovate PRs in bulk: classify by risk tier, auto-approve and merge safe patch bumps, flag breaking major upgrades for human review, and post a digest.",
|
|
5
|
+
"skills": "skills/"
|
|
6
|
+
}
|
|
@@ -0,0 +1,151 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: dependabot-triage
|
|
3
|
+
description: >
|
|
4
|
+
Triage all open Dependabot and Renovate PRs in bulk: classify each by risk tier (patch / minor /
|
|
5
|
+
major / security), auto-approve and merge safe patch-only bumps, flag breaking major upgrades with
|
|
6
|
+
a summary of what changed, and post a digest of what was done. Use when dependency PRs are piling
|
|
7
|
+
up, when the user says "deal with Dependabot", "triage dependency updates", or "merge the safe
|
|
8
|
+
ones", or at the start of a maintenance window.
|
|
9
|
+
license: MIT
|
|
10
|
+
allowed-tools: Bash, Read, Write
|
|
11
|
+
compatibility: Codex, Claude Code, Cursor, GitHub Copilot, Windsurf, Kiro, and other Agent Skills compatible tools. Requires git and gh (GitHub CLI) authenticated.
|
|
12
|
+
metadata:
|
|
13
|
+
targets: [_source-only]
|
|
14
|
+
author: Oleg Koval
|
|
15
|
+
tags:
|
|
16
|
+
- dependabot
|
|
17
|
+
- renovate
|
|
18
|
+
- dependencies
|
|
19
|
+
- security
|
|
20
|
+
- automation
|
|
21
|
+
- triage
|
|
22
|
+
- github
|
|
23
|
+
source: weekly-pattern-learner
|
|
24
|
+
source_reason: "obsidian-pr-sync explicitly filters out dependabot/renovate PRs — the user handles them separately, but no skill existed to batch-triage them"
|
|
25
|
+
source_date: "2026-07-31"
|
|
26
|
+
---
|
|
27
|
+
<!-- Generated by scripts/build-adapters.sh. Do not edit directly. -->
|
|
28
|
+
|
|
29
|
+
> 🤖 *Auto-generated by **weekly-pattern-learner** · obsidian-pr-sync explicitly filters out dependabot/renovate PRs — the user handles them separately, but no skill existed to batch-triage them*
|
|
30
|
+
|
|
31
|
+
# Dependabot Triage
|
|
32
|
+
|
|
33
|
+
Bulk-process open Dependabot and Renovate PRs: approve and merge what is safe,
|
|
34
|
+
flag what needs a human decision, and report what was done.
|
|
35
|
+
|
|
36
|
+
## Inputs
|
|
37
|
+
|
|
38
|
+
- **Repository** (optional): default to the current repo.
|
|
39
|
+
- **Auto-merge policy** (optional, default: `patch-only`): `none`, `patch-only`, or `patch-and-minor`.
|
|
40
|
+
- **Require CI** (optional, default: on): only merge PRs whose checks are green.
|
|
41
|
+
|
|
42
|
+
## Step 1 — Fetch all open dependency PRs
|
|
43
|
+
|
|
44
|
+
```bash
|
|
45
|
+
# Dependabot PRs
|
|
46
|
+
gh pr list --state open --label "dependencies" \
|
|
47
|
+
--json number,title,author,labels,headRefName,url,isDraft \
|
|
48
|
+
--jq '.[] | select(.author.login | test("dependabot|renovate"; "i"))'
|
|
49
|
+
|
|
50
|
+
# Also catch Renovate PRs not labelled "dependencies"
|
|
51
|
+
gh pr list --state open \
|
|
52
|
+
--json number,title,author,labels,headRefName,url,isDraft \
|
|
53
|
+
--jq '.[] | select(.author.login == "renovate[bot]" or .author.login == "dependabot[bot]")'
|
|
54
|
+
```
|
|
55
|
+
|
|
56
|
+
Merge both result sets, deduplicate by number, skip drafts.
|
|
57
|
+
|
|
58
|
+
## Step 2 — Classify each PR
|
|
59
|
+
|
|
60
|
+
Parse the PR title to extract package name and version change.
|
|
61
|
+
|
|
62
|
+
Dependabot title format: `Bump <package> from <old> to <new>`
|
|
63
|
+
Renovate title format: `Update dependency <package> to v<new>` or `chore(deps): update <package>`
|
|
64
|
+
|
|
65
|
+
For each PR:
|
|
66
|
+
|
|
67
|
+
```bash
|
|
68
|
+
gh pr view <NUMBER> --json title,body,labels,reviews \
|
|
69
|
+
--jq '{title, body: (.body | .[0:500]), labels: [.labels[].name], reviews: [.reviews[].state]}'
|
|
70
|
+
```
|
|
71
|
+
|
|
72
|
+
Classify:
|
|
73
|
+
|
|
74
|
+
| Tier | Condition | Default action |
|
|
75
|
+
|------|-----------|----------------|
|
|
76
|
+
| **patch** | semver patch bump (`X.Y.Z → X.Y.Z+1`), no security label | auto-approve and merge (if CI green) |
|
|
77
|
+
| **minor** | semver minor bump (`X.Y.Z → X.Y+1.0`), no security label | approve and merge when `patch-and-minor` policy |
|
|
78
|
+
| **major** | semver major bump (`X.Y.Z → X+1.0.0`) | flag for human: summarize breaking changes |
|
|
79
|
+
| **security** | has `security` label, or title contains "CVE" or "vulnerability" | escalate: approve if CI green AND patch/minor; human if major |
|
|
80
|
+
|
|
81
|
+
When in doubt about the bump type (e.g. non-semver packages), treat as `minor`.
|
|
82
|
+
|
|
83
|
+
## Step 3 — Check CI for merge candidates
|
|
84
|
+
|
|
85
|
+
For each PR classified as auto-approvable:
|
|
86
|
+
|
|
87
|
+
```bash
|
|
88
|
+
gh pr checks <NUMBER> --json name,state,conclusion \
|
|
89
|
+
--jq '[.[] | select(.conclusion != "success" and .conclusion != "skipped")] | length'
|
|
90
|
+
```
|
|
91
|
+
|
|
92
|
+
If CI is still running, wait up to 10 minutes (polling every 30s). If CI fails, demote
|
|
93
|
+
to `blocked` — do not merge a PR with failing checks regardless of policy.
|
|
94
|
+
|
|
95
|
+
If CI is disabled for dependency PRs in this repo (no checks at all), note it and proceed
|
|
96
|
+
only when the user has passed `--skip-ci-check` explicitly.
|
|
97
|
+
|
|
98
|
+
## Step 4 — Approve and merge safe PRs
|
|
99
|
+
|
|
100
|
+
For each auto-approvable PR with green CI:
|
|
101
|
+
|
|
102
|
+
```bash
|
|
103
|
+
# Approve
|
|
104
|
+
gh pr review <NUMBER> --approve --body "Auto-approved by dependabot-triage: patch bump, CI green."
|
|
105
|
+
|
|
106
|
+
# Merge (squash is the default; use the repo's configured merge strategy if known)
|
|
107
|
+
gh pr merge <NUMBER> --squash --delete-branch \
|
|
108
|
+
--subject "$(gh pr view <NUMBER> --json title --jq .title)"
|
|
109
|
+
```
|
|
110
|
+
|
|
111
|
+
If the merge fails (conflict, branch protection, etc.), fall back to `blocked` and note it.
|
|
112
|
+
|
|
113
|
+
## Step 5 — Comment on flagged PRs
|
|
114
|
+
|
|
115
|
+
For each `major` or `blocked` PR, post one comment summarizing why it needs a human:
|
|
116
|
+
|
|
117
|
+
```bash
|
|
118
|
+
gh pr comment <NUMBER> --body "**dependabot-triage:** This is a major version bump. \
|
|
119
|
+
Review the changelog before merging: $(gh pr view <NUMBER> --json body --jq '.body | split("\n") | map(select(test("changelog|release|BREAKING"; "i"))) | .[0]').
|
|
120
|
+
|
|
121
|
+
No action was taken."
|
|
122
|
+
```
|
|
123
|
+
|
|
124
|
+
## Step 6 — Report
|
|
125
|
+
|
|
126
|
+
Print a digest, then stop. Do not merge anything not listed as approved in this report.
|
|
127
|
+
|
|
128
|
+
```
|
|
129
|
+
Dependabot triage complete.
|
|
130
|
+
Merged (patch, CI green): 7 PRs → lodash 4.17.20→4.17.21, eslint 8.56.0→8.57.0, ...
|
|
131
|
+
Merged (security, CI green): 1 PR → axios 1.6.2→1.7.9 (CVE-2024-39338)
|
|
132
|
+
Flagged for human review: 2 PRs → next.js 14→15 (major), @types/node 20→22 (major)
|
|
133
|
+
Blocked (CI failing): 1 PR → typescript 5.4→5.5 (lint errors)
|
|
134
|
+
Skipped (draft): 1 PR
|
|
135
|
+
|
|
136
|
+
Open a flagged PR and run /pr-to-green after reviewing the changelog.
|
|
137
|
+
```
|
|
138
|
+
|
|
139
|
+
## Safety guardrails
|
|
140
|
+
|
|
141
|
+
- Never merge a PR whose author is not `dependabot[bot]` or `renovate[bot]`, even if found by the label query.
|
|
142
|
+
- Never merge a major bump automatically, even if `patch-and-minor` policy is set.
|
|
143
|
+
- Never approve a PR if `gh pr checks` shows any failure — a quiet pass is not the same as no checks.
|
|
144
|
+
- Always post a comment on flagged PRs so the record is visible in the thread.
|
|
145
|
+
|
|
146
|
+
## Chaining
|
|
147
|
+
|
|
148
|
+
| Before this skill | After this skill |
|
|
149
|
+
|---|---|
|
|
150
|
+
| morning routine / maintenance window | `olko:pr-to-green` on flagged PRs after human review |
|
|
151
|
+
| `olko:obsidian-pr-sync` (which filters these out) | back to obsidian-pr-sync for remaining human PRs |
|
|
@@ -0,0 +1,237 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: geminiloop
|
|
3
|
+
description: >
|
|
4
|
+
Iteratively satisfy Gemini Code Assist's review on a GitHub PR, but treat every Gemini comment
|
|
5
|
+
SKEPTICALLY (Gemini Code Assist is materially more error-prone than Greptile): verify each finding
|
|
6
|
+
against the real code first, fix ONLY the genuinely-correct ones, and rebut + resolve false
|
|
7
|
+
positives WITHOUT changing correct code. Repeat until no unresolved Gemini comments remain. Use
|
|
8
|
+
when the user wants to clear a PR's Gemini Code Assist review.
|
|
9
|
+
compatibility: GitHub only (Gemini Code Assist is a GitHub app). Requires git + gh (GitHub CLI) authenticated, and the Gemini Code Assist app installed on the repo.
|
|
10
|
+
metadata:
|
|
11
|
+
version: "1.0"
|
|
12
|
+
allowed-tools: Bash(gh:*) Bash(git:*)
|
|
13
|
+
---
|
|
14
|
+
|
|
15
|
+
# Geminiloop
|
|
16
|
+
|
|
17
|
+
Drive a GitHub PR until Gemini Code Assist has no unresolved comments — **but do not cargo-cult
|
|
18
|
+
its suggestions.** Gemini is often confidently wrong. Every comment is a *claim to verify*, not an
|
|
19
|
+
instruction to obey. A wrong suggestion applied is worse than the comment itself.
|
|
20
|
+
|
|
21
|
+
## How Gemini differs from other review bots
|
|
22
|
+
|
|
23
|
+
- **No check-run, no score.** Gemini does not publish a `X/5` confidence or a `greptile` check. It
|
|
24
|
+
posts a **PR review** (state `COMMENTED`) authored by `gemini-code-assist[bot]` with a
|
|
25
|
+
`## Code Review` summary body plus inline review comments. Detection is by polling the *reviews*
|
|
26
|
+
endpoint, not a check-run. "Satisfied" = zero unresolved comments (each either fixed or rebutted),
|
|
27
|
+
since there is no numeric target.
|
|
28
|
+
- **Auto-reviews on push/open.** It reviews automatically when a PR opens or gets new commits;
|
|
29
|
+
`/gemini review` forces a fresh pass.
|
|
30
|
+
- **Severity, not confidence.** Inline comments carry a priority badge (a `![critical]` /
|
|
31
|
+
`![high]` / `![medium]` / `![low]` shields image) at the top of the body. Weight `critical`/`high`
|
|
32
|
+
seriously; treat `medium`/`low` as usually-skippable nits unless clearly correct.
|
|
33
|
+
- **Higher false-positive rate.** This is the whole point of the skill: bias toward *rebut* over
|
|
34
|
+
*change*.
|
|
35
|
+
|
|
36
|
+
## Not for
|
|
37
|
+
|
|
38
|
+
- GitLab / Perforce (Gemini Code Assist is GitHub-only). For other review bots this catalog ships
|
|
39
|
+
`codexloop`, `coderabbitloop`, and `qodoloop`; for CI failures rather than review comments, use
|
|
40
|
+
`ci-fix-loop`.
|
|
41
|
+
|
|
42
|
+
## 1. Identify the PR
|
|
43
|
+
|
|
44
|
+
```bash
|
|
45
|
+
gh pr view --json number,headRefName,headRefOid -q '{number,branch:.headRefName,head:.headRefOid}'
|
|
46
|
+
```
|
|
47
|
+
|
|
48
|
+
Switch to the PR branch if not already on it. Capture `OWNER`/`REPO` (`gh repo view --json owner,name`).
|
|
49
|
+
|
|
50
|
+
## 2. The loop (max 5 iterations)
|
|
51
|
+
|
|
52
|
+
Keep an explicit iteration counter and stop at 5 — the cap is a real bound to enforce, not a
|
|
53
|
+
figure of speech. Each pass through A–G is one iteration; on hitting the cap, go straight to the
|
|
54
|
+
report and list what is still unresolved rather than starting a sixth.
|
|
55
|
+
|
|
56
|
+
### A. Ensure a fresh Gemini review on the current head
|
|
57
|
+
|
|
58
|
+
Gemini auto-reviews new commits, but force a deterministic pass and record the head SHA:
|
|
59
|
+
|
|
60
|
+
```bash
|
|
61
|
+
HEAD_SHA=$(gh pr view <PR> --json headRefOid -q .headRefOid)
|
|
62
|
+
# Only trigger if no gemini review already exists for this exact SHA:
|
|
63
|
+
HAVE=$(gh api repos/{owner}/{repo}/pulls/<PR>/reviews --paginate \
|
|
64
|
+
--jq "[.[] | select(.user.login==\"gemini-code-assist[bot]\" and .commit_id==\"$HEAD_SHA\")] | length")
|
|
65
|
+
if [ "$HAVE" = "0" ]; then gh pr comment <PR> --body "/gemini review"; fi
|
|
66
|
+
```
|
|
67
|
+
|
|
68
|
+
Poll for the review of THIS head to land. No check-run exists, so poll the reviews endpoint — and
|
|
69
|
+
poll it on a **deadline**, never `while true`: a review that never arrives must end the skill with
|
|
70
|
+
an honest timeout, not hang it.
|
|
71
|
+
|
|
72
|
+
```bash
|
|
73
|
+
# 10-minute deadline, one retry, then give up.
|
|
74
|
+
wait_for_review() { # $1 = attempt label
|
|
75
|
+
local deadline=$(( SECONDS + 600 ))
|
|
76
|
+
while [ "$SECONDS" -lt "$deadline" ]; do
|
|
77
|
+
R=$(gh api repos/{owner}/{repo}/pulls/<PR>/reviews --paginate \
|
|
78
|
+
--jq "[.[] | select(.user.login==\"gemini-code-assist[bot]\" and .commit_id==\"$HEAD_SHA\")] | last")
|
|
79
|
+
if [ -n "$R" ] && [ "$R" != "null" ]; then return 0; fi
|
|
80
|
+
echo "waiting for Gemini review of $HEAD_SHA ($1)..."; sleep 15
|
|
81
|
+
done
|
|
82
|
+
return 1
|
|
83
|
+
}
|
|
84
|
+
|
|
85
|
+
if ! wait_for_review "first wait"; then
|
|
86
|
+
echo "no Gemini review after 10m — retrying once" # say the retry out loud
|
|
87
|
+
gh pr comment <PR> --body "/gemini review"
|
|
88
|
+
if ! wait_for_review "after retry"; then
|
|
89
|
+
echo "Gemini did not review $HEAD_SHA after a retry; stopping and reporting."
|
|
90
|
+
exit 1 # honest timeout, never a success claim
|
|
91
|
+
fi
|
|
92
|
+
fi
|
|
93
|
+
```
|
|
94
|
+
|
|
95
|
+
Report the retry in the final summary; two silent timeouts are the failure mode this guard exists
|
|
96
|
+
to prevent.
|
|
97
|
+
|
|
98
|
+
### B. Fetch the findings
|
|
99
|
+
|
|
100
|
+
- **Summary** (the `## Code Review` body): the review `.body` from the object above — read the
|
|
101
|
+
overall take and the severity spread.
|
|
102
|
+
- **Unresolved inline comments** on the current head:
|
|
103
|
+
|
|
104
|
+
```bash
|
|
105
|
+
gh api repos/{owner}/{repo}/pulls/<PR>/comments --paginate \
|
|
106
|
+
--jq '.[] | select(.user.login=="gemini-code-assist[bot]") | {id, path, line, body}'
|
|
107
|
+
```
|
|
108
|
+
|
|
109
|
+
Also pull the review threads + their resolved state via GraphQL (see step F) so you only act on
|
|
110
|
+
unresolved ones.
|
|
111
|
+
|
|
112
|
+
### C. Critically evaluate EACH comment (the core of this skill)
|
|
113
|
+
|
|
114
|
+
For every comment, **verify the claim against the actual code and repo conventions before touching
|
|
115
|
+
anything.** Read the file, the surrounding code, the types, and any call sites. Then classify:
|
|
116
|
+
|
|
117
|
+
1. **CORRECT + actionable** — the finding is real and the fix improves the code. → fix it (step D).
|
|
118
|
+
2. **FALSE POSITIVE / technically wrong** — the claim doesn't hold. → do **NOT** change code; write a
|
|
119
|
+
specific, evidence-based reply (cite the exact code/line/behavior that disproves it), then resolve.
|
|
120
|
+
3. **Valid but out-of-scope / stylistic nit** that conflicts with repo convention or the PR's intent
|
|
121
|
+
→ briefly decline with a reason, then resolve. Do not expand the PR's scope to satisfy a nit.
|
|
122
|
+
|
|
123
|
+
**Hard rules:**
|
|
124
|
+
- **Never modify correct code just to silence Gemini.** Prefer a reasoned rebuttal.
|
|
125
|
+
- When uncertain whether a claim holds, **investigate** (read more code, run the type-checker / tests)
|
|
126
|
+
rather than assume Gemini is right. Default to skepticism.
|
|
127
|
+
- If a suggested change would break other call sites, alter public behavior, or contradict a verified
|
|
128
|
+
repo convention, it is a category-2 rebuttal, not a fix.
|
|
129
|
+
- Never fabricate identifiers to satisfy a comment (e.g. a Linear/ticket prefix). If Gemini asks for a
|
|
130
|
+
ticket reference and none exists, say so; do not invent one.
|
|
131
|
+
|
|
132
|
+
**Gemini's common failure modes to watch for (default these to category 2):**
|
|
133
|
+
- Hallucinated APIs, options, or framework behavior stated as fact.
|
|
134
|
+
- "Add a null/undefined check" where the type already guarantees presence.
|
|
135
|
+
- Suggestions that compile-break or break other callers.
|
|
136
|
+
- Security/perf warnings with no actual exploit path or measurable cost.
|
|
137
|
+
- Restating library/framework semantics incorrectly.
|
|
138
|
+
- Style demands that contradict the repo's existing, consistent pattern.
|
|
139
|
+
|
|
140
|
+
### D. Apply fixes — category 1 only
|
|
141
|
+
|
|
142
|
+
Make the minimal correct change. Re-run the local gate if the repo has one (typecheck/tests) before
|
|
143
|
+
moving on.
|
|
144
|
+
|
|
145
|
+
### E. Commit and push FIRST, before resolving anything
|
|
146
|
+
|
|
147
|
+
Order matters. A resolved thread is a claim that the fix is on the branch, so the push has to
|
|
148
|
+
succeed before the claim is made — otherwise a failed commit or push leaves the PR unfixed with the
|
|
149
|
+
finding marked resolved, and nobody looks at it again.
|
|
150
|
+
|
|
151
|
+
If step D changed code:
|
|
152
|
+
|
|
153
|
+
```bash
|
|
154
|
+
# Stage ONLY the files your fixes touched — never `git add -A`, which sweeps up
|
|
155
|
+
# unrelated work and untracked secrets sitting in the worktree.
|
|
156
|
+
git status --short # look before you stage
|
|
157
|
+
git add <path> [<path>...] # the files named in the findings you fixed
|
|
158
|
+
git commit -m "address gemini review feedback (geminiloop iteration N)"
|
|
159
|
+
git push
|
|
160
|
+
```
|
|
161
|
+
|
|
162
|
+
Author the commit per the repo's norms (e.g. the user's identity; no AI attribution if that is the
|
|
163
|
+
convention). Confirm the push actually landed before continuing:
|
|
164
|
+
|
|
165
|
+
```bash
|
|
166
|
+
git rev-parse HEAD
|
|
167
|
+
gh pr view <PR> --json headRefOid -q .headRefOid # must match
|
|
168
|
+
```
|
|
169
|
+
|
|
170
|
+
If they differ, stop: the fix is not on the PR, so nothing may be resolved yet.
|
|
171
|
+
|
|
172
|
+
### F. Reply to and resolve every addressed thread
|
|
173
|
+
|
|
174
|
+
Only now, with the fixes pushed, reply and resolve. Fetch unresolved threads, **following
|
|
175
|
+
pagination** — a PR with more than 100 threads will otherwise look clean while unresolved findings
|
|
176
|
+
sit on page two:
|
|
177
|
+
|
|
178
|
+
```bash
|
|
179
|
+
# Loop until hasNextPage is false, passing endCursor back in as $cursor.
|
|
180
|
+
CURSOR=null
|
|
181
|
+
while : ; do
|
|
182
|
+
PAGE=$(gh api graphql -F cursor="$CURSOR" -f query='
|
|
183
|
+
query($cursor: String) {
|
|
184
|
+
repository(owner: "OWNER", name: "REPO") {
|
|
185
|
+
pullRequest(number: PR_NUMBER) {
|
|
186
|
+
reviewThreads(first: 100, after: $cursor) {
|
|
187
|
+
pageInfo { hasNextPage endCursor }
|
|
188
|
+
nodes { id isResolved comments(first: 1) { nodes { databaseId author { login } path body } } }
|
|
189
|
+
}
|
|
190
|
+
}
|
|
191
|
+
}
|
|
192
|
+
}')
|
|
193
|
+
echo "$PAGE" # collect nodes from every page before deciding the PR is clean
|
|
194
|
+
PI='.data.repository.pullRequest.reviewThreads.pageInfo'
|
|
195
|
+
[ "$(echo "$PAGE" | jq -r "$PI.hasNextPage")" = "true" ] || break
|
|
196
|
+
CURSOR=$(echo "$PAGE" | jq -r "$PI.endCursor")
|
|
197
|
+
done
|
|
198
|
+
```
|
|
199
|
+
|
|
200
|
+
Reply on a thread's comment via `gh api repos/{owner}/{repo}/pulls/<PR>/comments -f body="..." -F in_reply_to=<comment_id>`,
|
|
201
|
+
then resolve:
|
|
202
|
+
|
|
203
|
+
```bash
|
|
204
|
+
gh api graphql -f query='mutation { resolveReviewThread(input: {threadId: "THREAD_ID"}) { thread { isResolved } } }'
|
|
205
|
+
```
|
|
206
|
+
|
|
207
|
+
Resolve a thread only for comments authored by `gemini-code-assist[bot]` that you have fixed or
|
|
208
|
+
rebutted — never blanket-resolve, and never resolve a human reviewer's thread.
|
|
209
|
+
|
|
210
|
+
Threads you are **rebutting** need no push, so they may be replied to and resolved regardless of
|
|
211
|
+
whether step D changed code.
|
|
212
|
+
|
|
213
|
+
### G. Re-review
|
|
214
|
+
|
|
215
|
+
Pushing re-triggers Gemini automatically; go back to **A** with the new head SHA. If step D changed
|
|
216
|
+
nothing (all comments were rebutted), skip the push, ensure all threads are resolved, and exit.
|
|
217
|
+
|
|
218
|
+
## 3. Exit conditions
|
|
219
|
+
|
|
220
|
+
Stop when **any** is true:
|
|
221
|
+
- Zero unresolved `gemini-code-assist[bot]` comments remain, and every comment this round was fixed
|
|
222
|
+
or rebutted+resolved. (There is no score to hit — this is "done".)
|
|
223
|
+
- Max iterations (5) reached — report what remains.
|
|
224
|
+
|
|
225
|
+
## 4. Report
|
|
226
|
+
|
|
227
|
+
```text
|
|
228
|
+
Geminiloop complete.
|
|
229
|
+
PR: #<n>
|
|
230
|
+
Iterations: N
|
|
231
|
+
Comments fixed: N (genuinely-correct findings)
|
|
232
|
+
Comments rebutted: N (false positives / nits, resolved with rationale)
|
|
233
|
+
Remaining: 0
|
|
234
|
+
```
|
|
235
|
+
|
|
236
|
+
If it stopped at max iterations, list the remaining threads with your current assessment
|
|
237
|
+
(fix-pending vs disputed) so a human can arbitrate.
|
|
@@ -0,0 +1,5 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "olko-geminiloop",
|
|
3
|
+
"description": "Iteratively drives a GitHub PR to zero unresolved Gemini Code Assist comments — treats each one as a claim to verify, fixes only the genuinely-correct findings, and rebuts the rest with evidence instead of editing correct code.",
|
|
4
|
+
"skills": "./skills"
|
|
5
|
+
}
|