opencode-skills-collection 4.0.1 → 4.0.3

package/bundled-skills/git-pr-workflows-git-workflow/SKILL.md

@@ -1,148 +1,124 @@
 ---
 name: git-pr-workflows-git-workflow
-description: "Orchestrate a comprehensive git workflow from code review through PR creation, leveraging specialized agents for quality assurance, testing, and deployment readiness. This workflow implements modern g"
+description: "Orchestrate review, tests, commits, branch pushes, and pull-request creation with parallel agents. Use when completed changes must move through validation into a PR or guarded merge."
 risk: critical
 source: community
 date_added: "2026-02-27"
 ---
 
-# Complete Git Workflow with Multi-Agent Orchestration
+# Guarded Git Pull Request Workflow
 
-Orchestrate a comprehensive git workflow from code review through PR creation, leveraging specialized agents for quality assurance, testing, and deployment readiness. This workflow implements modern git best practices including Conventional Commits, automated testing, and structured PR creation.
+Move completed changes from local review to a verified pull request without bypassing repository policy or branch protection.
 
-[Extended thinking: This workflow coordinates multiple specialized agents to ensure code quality before commits are made. The code-reviewer agent performs initial quality checks, test-automator ensures all tests pass, and deployment-engineer verifies production readiness. By orchestrating these agents sequentially with context passing, we prevent broken code from entering the repository while maintaining high velocity. The workflow supports both trunk-based and feature-branch strategies with configurable options for different team needs.]
+## When to Use
 
-## Use this skill when
+Use for completed implementation work that must be reviewed, tested, committed, pushed to a topic branch, and opened as a pull request. Use the repository's dedicated maintainer or release workflow instead when one is mandatory.
 
-- Working on complete git workflow with multi-agent orchestration tasks or workflows
-- Needing guidance, best practices, or checklists for complete git workflow with multi-agent orchestration
+## Policy Gate
 
-## Do not use this skill when
+Before mutation:
 
-- The task is unrelated to complete git workflow with multi-agent orchestration
-- You need a different domain or tool outside this scope
+1. Read `AGENTS.md`, contribution guidance, maintainer docs, and relevant nested instructions.
+2. Inspect the current branch, worktree, remotes, upstream, and effective target-branch protection.
+3. Discover repository-native validation, commit, PR, merge, and release commands.
+4. Preserve unrelated dirty and staged files.
 
-## Instructions
+Repository policy wins over flags and user shorthand. Trunk-based development does not imply a direct push: when the target is protected, use a short-lived branch and pull request. If a repository defines a mandatory maintainer skill or guarded merge command, hand off merge and release actions to it. In `agentic-awesome-skills`, use `antigravity-maintainer-batch-release` and `npm run merge:batch`.
 
-- Clarify goals, constraints, and required inputs.
-- Apply relevant best practices and validate outcomes.
-- Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
+## Inputs
 
-## Configuration
+Resolve these from the request and repository:
 
-**Target branch**: $ARGUMENTS (defaults to 'main' if not specified)
+- target branch, defaulting to the repository default branch;
+- intended changed files and excluded user work;
+- required test, lint, security, build, and documentation checks;
+- branch naming and commit-message conventions;
+- draft or ready-for-review PR state;
+- required reviewers, labels, issue links, and merge method.
 
-**Supported flags**:
-- `--skip-tests`: Skip automated test execution (use with caution)
-- `--draft-pr`: Create PR as draft for work-in-progress
-- `--no-push`: Perform all checks but don't push to remote
-- `--squash`: Squash commits before pushing
-- `--conventional`: Enforce Conventional Commits format strictly
-- `--trunk-based`: Use trunk-based development workflow
-- `--feature-branch`: Use feature branch workflow (default)
+Ask only when a missing choice changes the result materially.
 
-## Phase 1: Pre-Commit Review and Analysis
+## Workflow
 
-### 1. Code Quality Assessment
-- Use Task tool with subagent_type="code-reviewer"
-- Prompt: "Review all uncommitted changes for code quality issues. Check for: 1) Code style violations, 2) Security vulnerabilities, 3) Performance concerns, 4) Missing error handling, 5) Incomplete implementations. Generate a detailed report with severity levels (critical/high/medium/low) and provide specific line-by-line feedback. Output format: JSON with {issues: [], summary: {critical: 0, high: 0, medium: 0, low: 0}, recommendations: []}"
-- Expected output: Structured code review report for next phase
+### 1. Capture the exact change
 
-### 2. Dependency and Breaking Change Analysis
-- Use Task tool with subagent_type="code-reviewer"
-- Prompt: "Analyze the changes for: 1) New dependencies or version changes, 2) Breaking API changes, 3) Database schema modifications, 4) Configuration changes, 5) Backward compatibility issues. Context from previous review: [insert issues summary]. Identify any changes that require migration scripts or documentation updates."
-- Context from previous: Code quality issues that might indicate breaking changes
-- Expected output: Breaking change assessment and migration requirements
+```bash
+git status --short --branch
+git diff --stat
+git diff --cached --stat
+git branch --show-current
+git remote -v
+```
 
-## Phase 2: Testing and Validation
+Confirm every file in scope. Stop if staged or dirty files cannot be separated safely.
 
-### 1. Test Execution and Coverage
-- Use Task tool with subagent_type="unit-testing::test-automator"
-- Prompt: "Execute all test suites for the modified code. Run: 1) Unit tests, 2) Integration tests, 3) End-to-end tests if applicable. Generate coverage report and identify any untested code paths. Based on review issues: [insert critical/high issues], ensure tests cover the problem areas. Provide test results in format: {passed: [], failed: [], skipped: [], coverage: {statements: %, branches: %, functions: %, lines: %}, untested_critical_paths: []}"
-- Context from previous: Critical code review issues that need test coverage
-- Expected output: Complete test results and coverage metrics
+### 2. Review in parallel
 
-### 2. Test Recommendations and Gap Analysis
-- Use Task tool with subagent_type="unit-testing::test-automator"
-- Prompt: "Based on test results [insert summary] and code changes, identify: 1) Missing test scenarios, 2) Edge cases not covered, 3) Integration points needing verification, 4) Performance benchmarks needed. Generate test implementation recommendations prioritized by risk. Consider the breaking changes identified: [insert breaking changes]."
-- Context from previous: Test results, breaking changes, untested paths
-- Expected output: Prioritized list of additional tests needed
+When subagents are available and authorized, assign independent bounded passes for:
 
-## Phase 3: Commit Message Generation
+- correctness and regression risk;
+- security, secrets, permissions, and dependency risk;
+- test coverage and repository-policy compliance.
 
-### 1. Change Analysis and Categorization
-- Use Task tool with subagent_type="code-reviewer"
-- Prompt: "Analyze all changes and categorize them according to Conventional Commits specification. Identify the primary change type (feat/fix/docs/style/refactor/perf/test/build/ci/chore/revert) and scope. For changes: [insert file list and summary], determine if this should be a single commit or multiple atomic commits. Consider test results: [insert test summary]."
-- Context from previous: Test results, code review summary
-- Expected output: Commit structure recommendation
+Give each reviewer the raw diff and repository instructions. Keep the main agent responsible for deduplication, severity, edits, and final verification.
 
-### 2. Conventional Commit Message Creation
-- Use Task tool with subagent_type="llm-application-dev::prompt-engineer"
-- Prompt: "Create Conventional Commits format message(s) based on categorization: [insert categorization]. Format: <type>(<scope>): <subject> with blank line then <body> explaining what and why (not how), then <footer> with BREAKING CHANGE: if applicable. Include: 1) Clear subject line (50 chars max), 2) Detailed body explaining rationale, 3) References to issues/tickets, 4) Co-authors if applicable. Consider the impact: [insert breaking changes if any]."
-- Context from previous: Change categorization, breaking changes
-- Expected output: Properly formatted commit message(s)
+### 3. Validate and repair
 
-## Phase 4: Branch Strategy and Push Preparation
+Run the repository's targeted checks, then its required pre-PR suite. If a check fails:
 
-### 1. Branch Management
-- Use Task tool with subagent_type="cicd-automation::deployment-engineer"
-- Prompt: "Based on workflow type [--trunk-based or --feature-branch], prepare branch strategy. For feature branch: ensure branch name follows pattern (feature|bugfix|hotfix)/<ticket>-<description>. For trunk-based: prepare for direct main push with feature flag strategy if needed. Current branch: [insert branch], target: [insert target branch]. Verify no conflicts with target branch."
-- Expected output: Branch preparation commands and conflict status
+1. identify whether the cause is source, policy, environment, or infrastructure;
+2. fix only source or policy defects in scope;
+3. rerun the targeted failure;
+4. rerun the complete required suite.
 
-### 2. Pre-Push Validation
-- Use Task tool with subagent_type="cicd-automation::deployment-engineer"
-- Prompt: "Perform final pre-push checks: 1) Verify all CI checks will pass, 2) Confirm no sensitive data in commits, 3) Validate commit signatures if required, 4) Check branch protection rules, 5) Ensure all review comments addressed. Test summary: [insert test results]. Review status: [insert review summary]."
-- Context from previous: All previous validation results
-- Expected output: Push readiness confirmation or blocking issues
+Do not weaken gates, hide skipped tests, or treat deterministic failures as flaky.
 
-## Phase 5: Pull Request Creation
+### 4. Prepare the branch and commit
 
-### 1. PR Description Generation
-- Use Task tool with subagent_type="documentation-generation::docs-architect"
-- Prompt: "Create comprehensive PR description including: 1) Summary of changes (what and why), 2) Type of change checklist, 3) Testing performed summary from [insert test results], 4) Screenshots/recordings if UI changes, 5) Deployment notes from [insert deployment considerations], 6) Related issues/tickets, 7) Breaking changes section if applicable: [insert breaking changes], 8) Reviewer checklist. Format as GitHub-flavored Markdown."
-- Context from previous: All validation results, test outcomes, breaking changes
-- Expected output: Complete PR description in Markdown
+Fetch the target before committing. If currently on a protected/default branch, create a topic branch before mutation.
 
-### 2. PR Metadata and Automation Setup
-- Use Task tool with subagent_type="cicd-automation::deployment-engineer"
-- Prompt: "Configure PR metadata: 1) Assign appropriate reviewers based on CODEOWNERS, 2) Add labels (type, priority, component), 3) Link related issues, 4) Set milestone if applicable, 5) Configure merge strategy (squash/merge/rebase), 6) Set up auto-merge if all checks pass. Consider draft status: [--draft-pr flag]. Include test status: [insert test summary]."
-- Context from previous: PR description, test results, review status
-- Expected output: PR configuration commands and automation rules
+```bash
+git fetch origin <target-branch>
+git switch -c <topic-branch> origin/<target-branch>
+git status --short --branch
+```
 
-## Success Criteria
+Stage only intended paths and create focused conventional commits according to repository policy. Rebase or update the topic branch when strict required checks demand the latest target; never force a shared branch without explicit authorization.
 
-- ✅ All critical and high-severity code issues resolved
-- ✅ Test coverage maintained or improved (target: >80%)
-- ✅ All tests passing (unit, integration, e2e)
-- ✅ Commit messages follow Conventional Commits format
-- ✅ No merge conflicts with target branch
-- ✅ PR description complete with all required sections
-- ✅ Branch protection rules satisfied
-- ✅ Security scanning completed with no critical vulnerabilities
-- ✅ Performance benchmarks within acceptable thresholds
-- ✅ Documentation updated for any API changes
-
-## Rollback Procedures
-
-In case of issues after merge:
-
-1. **Immediate Revert**: Create revert PR with `git revert <commit-hash>`
-2. **Feature Flag Disable**: If using feature flags, disable immediately
-3. **Hotfix Branch**: For critical issues, create hotfix branch from main
-4. **Communication**: Notify team via designated channels
-5. **Root Cause Analysis**: Document issue in postmortem template
-
-## Best Practices Reference
-
-- **Commit Frequency**: Commit early and often, but ensure each commit is atomic
-- **Branch Naming**: `(feature|bugfix|hotfix|docs|chore)/<ticket-id>-<brief-description>`
-- **PR Size**: Keep PRs under 400 lines for effective review
-- **Review Response**: Address review comments within 24 hours
-- **Merge Strategy**: Squash for feature branches, merge for release branches
-- **Sign-Off**: Require at least 2 approvals for main branch changes
+### 5. Push and create the pull request
+
+```bash
+git push -u origin <topic-branch>
+gh pr create --base <target-branch> --head <topic-branch> \
+  --title "<conventional title>" --body-file <body-file>
+```
+
+The PR body must truthfully include:
+
+- what changed and why;
+- tests and validation actually run;
+- risk, deployment, rollback, and breaking-change notes when applicable;
+- issue links, screenshots, and repository checklists when applicable.
+
+Never mark a pending automated review or test as completed.
+
+### 6. Verify the remote result
+
+```bash
+gh pr view <pr-number> --json headRefOid,baseRefOid,mergeable,mergeStateStatus,url
+gh pr checks <pr-number>
+```
+
+Bind review evidence to the current full head SHA. If the head or base changes, discard stale conclusions and rerun affected checks.
+
+Use the repository's guarded merge path. Do not replace required checks, merge queues, exact-SHA attestations, or maintainer commands with a raw merge API. After merge, fetch the target and verify the requested remote, CI, deployment, or release state.
+
+## Stop Condition
+
+Finish when the PR exists at the intended head, required checks are green or have one exact blocker, review evidence is current, unrelated user work is preserved, and any requested guarded merge or deployment is verified.
 
 ## Limitations
-- Use this skill only when the task clearly matches the scope described above.
-- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
-- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
+
+- This workflow cannot bypass branch protection, required reviews, repository permissions, or missing credentials.
+- It does not authorize destructive cleanup, force pushes, merges, deployments, or releases beyond the user's request and repository policy.
+- Keep unresolved environment or infrastructure failures explicit; do not convert them into source changes without evidence.

package/bundled-skills/git-pushing/SKILL.md

@@ -22,11 +22,13 @@ Automatically activate when the user:
 
 Before staging, inspect `git status --short --branch`, confirm the intended files, and fetch the upstream branch when a concurrent push is plausible. Do not absorb unrelated dirty files.
 
+Read repository policy before choosing the destination branch. If `main` or `master` is protected, or the repository defines a maintainer command such as `merge:batch`, create or use a topic branch and finish through the required pull-request checks. A user request to “push to main” describes the desired final state; it does not authorize bypassing server-side protection. Never keep retrying a direct push after a protected-branch rejection.
+
 The helper requires an empty live index and a conventional commit message before it stages anything. It locks the live index, builds and validates the commit in an isolated temporary index, rejects `--` without paths, and atomically updates the branch only if its parent is unchanged.
 
 The helper honors `branch.<name>.pushRemote`, `remote.pushDefault`, and the branch's configured upstream, in that order. For a new branch without those settings, it requires `origin` and establishes `origin/<branch>`. It rejects detached HEAD and invalid remote configurations before staging.
 
-Do not use this skill for a versioned repository release, tag publication, or a repository with an explicit `release:prepare` / `release:publish` workflow. Use that repository's release flow instead; it owns version changes, generated files, tags, and publish verification.
+Do not use this skill for a maintainer merge batch, canonical synchronization, versioned repository release, tag publication, or a repository with an explicit `merge:batch`, `release:prepare`, or `release:publish` workflow. Use that repository's maintainer/release flow instead; it owns pull-request evidence, protected-branch checks, generated files, tags, and publication verification.
 
 ## Workflow
 

package/bundled-skills/github-automation/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: github-automation
-description: "Automate GitHub repositories, issues, pull requests, branches, CI/CD, and permissions via Rube MCP (Composio). Manage code workflows, review PRs, search code, and handle deployments programmatically."
+description: "Operate GitHub issues, pull requests, branches, checks, workflows, and permissions through Rube MCP. Use when GitHub work must be queried or changed programmatically with repository-policy safeguards."
 risk: critical
 source: community
 date_added: "2026-02-27"
@@ -8,228 +8,86 @@ date_added: "2026-02-27"
 
 # GitHub Automation via Rube MCP
 
-Automate GitHub repository management, issue tracking, pull request workflows, branch operations, and CI/CD through Composio's GitHub toolkit.
+Use Composio's GitHub toolkit through Rube MCP while preserving repository policy, exact revision identity, and branch protection.
 
-## Prerequisites
+## When to Use
 
-- Rube MCP must be connected (RUBE_SEARCH_TOOLS available)
-- Active GitHub connection via `RUBE_MANAGE_CONNECTIONS` with toolkit `github`
-- Always call `RUBE_SEARCH_TOOLS` first to get current tool schemas
+Use for programmatic GitHub issue, pull-request, branch, Actions, deployment, collaborator, or protection tasks when Rube MCP is available. Prefer the native `gh` workflow or a repository-specific maintainer command when local repository policy requires it.
 
 ## Setup
 
-**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API keys needed — just add the endpoint and it works.
-
-1. Verify Rube MCP is available by confirming `RUBE_SEARCH_TOOLS` responds
-2. Call `RUBE_MANAGE_CONNECTIONS` with toolkit `github`
-3. If connection is not ACTIVE, follow the returned auth link to complete GitHub OAuth
-4. Confirm connection status shows ACTIVE before running any workflows
-
-## Core Workflows
-
-### 1. Create and Manage Issues
-
-**When to use**: User wants to create, list, or manage GitHub issues
-
-**Tool sequence**:
-1. `GITHUB_LIST_REPOSITORIES_FOR_THE_AUTHENTICATED_USER` - Find target repo if unknown [Prerequisite]
-2. `GITHUB_LIST_REPOSITORY_ISSUES` - List existing issues (includes PRs) [Required]
-3. `GITHUB_CREATE_AN_ISSUE` - Create a new issue [Required]
-4. `GITHUB_CREATE_AN_ISSUE_COMMENT` - Add comments to an issue [Optional]
-5. `GITHUB_SEARCH_ISSUES_AND_PULL_REQUESTS` - Search across repos by keyword [Optional]
-
-**Key parameters**:
-- `owner`: Repository owner (username or org), case-insensitive
-- `repo`: Repository name without .git extension
-- `title`: Issue title (required for creation)
-- `body`: Issue description (supports Markdown)
-- `labels`: Array of label names
-- `assignees`: Array of GitHub usernames
-- `state`: 'open', 'closed', or 'all' for filtering
-
-**Pitfalls**:
-- `GITHUB_LIST_REPOSITORY_ISSUES` returns both issues AND pull requests; check `pull_request` field to distinguish
-- Only users with push access can set assignees, labels, and milestones; they are silently dropped otherwise
-- Pagination: `per_page` max 100; iterate pages until empty
-
-### 2. Manage Pull Requests
-
-**When to use**: User wants to create, review, or merge pull requests
-
-**Tool sequence**:
-1. `GITHUB_FIND_PULL_REQUESTS` - Search and filter PRs [Required]
-2. `GITHUB_GET_A_PULL_REQUEST` - Get detailed PR info including mergeable status [Required]
-3. `GITHUB_LIST_PULL_REQUESTS_FILES` - Review changed files [Optional]
-4. `GITHUB_CREATE_A_PULL_REQUEST` - Create a new PR [Required]
-5. `GITHUB_CREATE_AN_ISSUE_COMMENT` - Post review comments [Optional]
-6. `GITHUB_LIST_CHECK_RUNS_FOR_A_REF` - Verify CI status before merge [Optional]
-7. `GITHUB_MERGE_A_PULL_REQUEST` - Merge after explicit user approval [Required]
-
-**Key parameters**:
-- `head`: Source branch with changes (must exist; for cross-repo: 'username:branch')
-- `base`: Target branch to merge into (e.g., 'main')
-- `title`: PR title (required unless `issue` number provided)
-- `merge_method`: 'merge', 'squash', or 'rebase'
-- `state`: 'open', 'closed', or 'all'
-
-**Pitfalls**:
-- `GITHUB_CREATE_A_PULL_REQUEST` fails with 422 if base/head are invalid, identical, or already merged
-- `GITHUB_MERGE_A_PULL_REQUEST` can be rejected if PR is draft, closed, or branch protection applies
-- Always verify mergeable status with `GITHUB_GET_A_PULL_REQUEST` immediately before merging
-- Require explicit user confirmation before calling MERGE
-
-### 3. Manage Repositories and Branches
-
-**When to use**: User wants to create repos, manage branches, or update repo settings
-
-**Tool sequence**:
-1. `GITHUB_LIST_REPOSITORIES_FOR_THE_AUTHENTICATED_USER` - List user's repos [Required]
-2. `GITHUB_GET_A_REPOSITORY` - Get detailed repo info [Optional]
-3. `GITHUB_CREATE_A_REPOSITORY_FOR_THE_AUTHENTICATED_USER` - Create personal repo [Required]
-4. `GITHUB_CREATE_AN_ORGANIZATION_REPOSITORY` - Create org repo [Alternative]
-5. `GITHUB_LIST_BRANCHES` - List branches [Required]
-6. `GITHUB_CREATE_A_REFERENCE` - Create new branch from SHA [Required]
-7. `GITHUB_UPDATE_A_REPOSITORY` - Update repo settings [Optional]
-
-**Key parameters**:
-- `name`: Repository name
-- `private`: Boolean for visibility
-- `ref`: Full reference path (e.g., 'refs/heads/new-branch')
-- `sha`: Commit SHA to point the new reference to
-- `default_branch`: Default branch name
-
-**Pitfalls**:
-- `GITHUB_CREATE_A_REFERENCE` only creates NEW references; use `GITHUB_UPDATE_A_REFERENCE` for existing ones
-- `ref` must start with 'refs/' and contain at least two slashes
-- `GITHUB_LIST_BRANCHES` paginates via `page`/`per_page`; iterate until empty page
-- `GITHUB_DELETE_A_REPOSITORY` is permanent and irreversible; requires admin privileges
-
-### 4. Search Code and Commits
-
-**When to use**: User wants to find code, files, or commits across repositories
-
-**Tool sequence**:
-1. `GITHUB_SEARCH_CODE` - Search file contents and paths [Required]
-2. `GITHUB_SEARCH_CODE_ALL_PAGES` - Multi-page code search [Alternative]
-3. `GITHUB_SEARCH_COMMITS_BY_AUTHOR` - Search commits by author/date/org [Required]
-4. `GITHUB_LIST_COMMITS` - List commits for a specific repo [Alternative]
-5. `GITHUB_GET_A_COMMIT` - Get detailed commit info [Optional]
-6. `GITHUB_GET_REPOSITORY_CONTENT` - Get file content [Optional]
-
-**Key parameters**:
-- `q`: Search query with qualifiers (`language:python`, `repo:owner/repo`, `extension:js`)
-- `owner`/`repo`: For repo-specific commit listing
-- `author`: Filter by commit author
-- `since`/`until`: ISO 8601 date range for commits
-
-**Pitfalls**:
-- Code search only indexes files under 384KB on default branch
-- Maximum 1000 results returned from code search
-- `GITHUB_SEARCH_COMMITS_BY_AUTHOR` requires keywords in addition to qualifiers; qualifier-only queries are not allowed
-- `GITHUB_LIST_COMMITS` returns 409 on empty repos
-
-### 5. Manage CI/CD and Deployments
-
-**When to use**: User wants to view workflows, check CI status, or manage deployments
-
-**Tool sequence**:
-1. `GITHUB_LIST_REPOSITORY_WORKFLOWS` - List GitHub Actions workflows [Required]
-2. `GITHUB_GET_A_WORKFLOW` - Get workflow details by ID or filename [Optional]
-3. `GITHUB_CREATE_A_WORKFLOW_DISPATCH_EVENT` - Manually trigger a workflow [Required]
-4. `GITHUB_LIST_CHECK_RUNS_FOR_A_REF` - Check CI status for a commit/branch [Required]
-5. `GITHUB_LIST_DEPLOYMENTS` - List deployments [Optional]
-6. `GITHUB_GET_A_DEPLOYMENT_STATUS` - Get deployment status [Optional]
-
-**Key parameters**:
-- `workflow_id`: Numeric ID or filename (e.g., 'ci.yml')
-- `ref`: Git reference (branch/tag) for workflow dispatch
-- `inputs`: JSON string of workflow inputs matching `on.workflow_dispatch.inputs`
-- `environment`: Filter deployments by environment name
-
-**Pitfalls**:
-- `GITHUB_CREATE_A_WORKFLOW_DISPATCH_EVENT` requires the workflow to have `workflow_dispatch` trigger configured
-- Full path `.github/workflows/main.yml` is auto-stripped to just `main.yml`
-- Inputs max 10 key-value pairs; must match workflow's `on.workflow_dispatch.inputs` definitions
-
-### 6. Manage Users and Permissions
-
-**When to use**: User wants to check collaborators, permissions, or branch protection
-
-**Tool sequence**:
-1. `GITHUB_LIST_REPOSITORY_COLLABORATORS` - List repo collaborators [Required]
-2. `GITHUB_GET_REPOSITORY_PERMISSIONS_FOR_A_USER` - Check specific user's access [Optional]
-3. `GITHUB_GET_BRANCH_PROTECTION` - Inspect branch protection rules [Required]
-4. `GITHUB_UPDATE_BRANCH_PROTECTION` - Update protection settings [Optional]
-5. `GITHUB_ADD_A_REPOSITORY_COLLABORATOR` - Add/update collaborator [Optional]
-
-**Key parameters**:
-- `affiliation`: 'outside', 'direct', or 'all' for collaborator filtering
-- `permission`: Filter by 'pull', 'triage', 'push', 'maintain', 'admin'
-- `branch`: Branch name for protection rules
-- `enforce_admins`: Whether protection applies to admins
-
-**Pitfalls**:
-- `GITHUB_GET_BRANCH_PROTECTION` returns 404 for unprotected branches; treat as no protection rules
-- Determine push ability from `permissions.push` or `role_name`, not display labels
-- `GITHUB_LIST_REPOSITORY_COLLABORATORS` paginates; iterate all pages
-- `GITHUB_GET_REPOSITORY_PERMISSIONS_FOR_A_USER` may be inconclusive for non-collaborators
-
-## Common Patterns
-
-### ID Resolution
-- **Repo name -> owner/repo**: `GITHUB_LIST_REPOSITORIES_FOR_THE_AUTHENTICATED_USER`
-- **PR number -> PR details**: `GITHUB_FIND_PULL_REQUESTS` then `GITHUB_GET_A_PULL_REQUEST`
-- **Branch name -> SHA**: `GITHUB_GET_A_BRANCH`
-- **Workflow name -> ID**: `GITHUB_LIST_REPOSITORY_WORKFLOWS`
-
-### Pagination
-All list endpoints use page-based pagination:
-- `page`: Page number (starts at 1)
-- `per_page`: Results per page (max 100)
-- Iterate until response returns fewer results than `per_page`
-
-### Safety
-- Always verify PR mergeable status before merge
-- Require explicit user confirmation for destructive operations (merge, delete)
-- Check CI status with `GITHUB_LIST_CHECK_RUNS_FOR_A_REF` before merging
-
-## Known Pitfalls
-
-- **Issues vs PRs**: `GITHUB_LIST_REPOSITORY_ISSUES` returns both; check `pull_request` field
-- **Pagination limits**: `per_page` max 100; always iterate pages until empty
-- **Branch creation**: `GITHUB_CREATE_A_REFERENCE` fails with 422 if reference already exists
-- **Merge guards**: Merge can fail due to branch protection, failing checks, or draft status
-- **Code search limits**: Only files <384KB on default branch; max 1000 results
-- **Commit search**: Requires search text keywords alongside qualifiers
-- **Destructive actions**: Repo deletion is irreversible; merge cannot be undone
-- **Silent permission drops**: Labels, assignees, milestones silently dropped without push access
-
-## Quick Reference
-
-| Task | Tool Slug | Key Params |
-|------|-----------|------------|
-| List repos | `GITHUB_LIST_REPOSITORIES_FOR_THE_AUTHENTICATED_USER` | `type`, `sort`, `per_page` |
-| Get repo | `GITHUB_GET_A_REPOSITORY` | `owner`, `repo` |
-| Create issue | `GITHUB_CREATE_AN_ISSUE` | `owner`, `repo`, `title`, `body` |
-| List issues | `GITHUB_LIST_REPOSITORY_ISSUES` | `owner`, `repo`, `state` |
-| Find PRs | `GITHUB_FIND_PULL_REQUESTS` | `repo`, `state`, `author` |
-| Create PR | `GITHUB_CREATE_A_PULL_REQUEST` | `owner`, `repo`, `head`, `base`, `title` |
-| Merge PR | `GITHUB_MERGE_A_PULL_REQUEST` | `owner`, `repo`, `pull_number`, `merge_method` |
-| List branches | `GITHUB_LIST_BRANCHES` | `owner`, `repo` |
-| Create branch | `GITHUB_CREATE_A_REFERENCE` | `owner`, `repo`, `ref`, `sha` |
-| Search code | `GITHUB_SEARCH_CODE` | `q` |
-| List commits | `GITHUB_LIST_COMMITS` | `owner`, `repo`, `author`, `since` |
-| Search commits | `GITHUB_SEARCH_COMMITS_BY_AUTHOR` | `q` |
-| List workflows | `GITHUB_LIST_REPOSITORY_WORKFLOWS` | `owner`, `repo` |
-| Trigger workflow | `GITHUB_CREATE_A_WORKFLOW_DISPATCH_EVENT` | `owner`, `repo`, `workflow_id`, `ref` |
-| Check CI | `GITHUB_LIST_CHECK_RUNS_FOR_A_REF` | `owner`, `repo`, ref |
-| List collaborators | `GITHUB_LIST_REPOSITORY_COLLABORATORS` | `owner`, `repo` |
-| Branch protection | `GITHUB_GET_BRANCH_PROTECTION` | `owner`, `repo`, `branch` |
+1. Confirm `RUBE_SEARCH_TOOLS` is available.
+2. Search for the current GitHub tool schemas before composing calls.
+3. Use `RUBE_MANAGE_CONNECTIONS` with toolkit `github` and complete OAuth only if the connection is not active.
+4. Resolve the exact `owner/repo`; do not rely on a similarly named repository.
 
-## When to Use
-This skill is applicable to execute the workflow or actions described in the overview.
+Never request, print, or persist GitHub credentials in prompts or artifacts.
+
+## Repository Policy Gate
+
+Before mutation, read `AGENTS.md`, contribution and maintainer docs, then inspect the default branch and effective protection. Repository-native commands and required checks take precedence over generic Rube operations.
+
+If a repository provides a guarded merge or release command, use it instead of the generic merge tool. In `agentic-awesome-skills`, use `antigravity-maintainer-batch-release` and `npm run merge:batch` so exact-SHA review, fresh check-suite binding, and protected `main` are enforced.
+
+## Workflows
+
+### Issues
+
+1. List or search existing issues before creating a duplicate.
+2. Distinguish issues from pull requests in mixed results.
+3. Read the current item, comments, labels, and linked PRs before changing state.
+4. Create, comment, label, assign, or close only within the user's requested scope.
+5. Re-read the item and verify the resulting state.
+
+Paginate until the requested result set is complete. Treat silent omission of labels or assignees as a permissions failure, not success.
+
+### Pull requests
+
+1. Resolve the PR and capture its number, base, full head SHA, draft state, author, fork identity, and mergeability.
+2. Inspect changed files, reviews, conversations, and required check runs.
+3. Bind every review or approval decision to the current full head SHA.
+4. Create or update the PR body truthfully; never mark pending tests or reviews as completed.
+5. Immediately before merge, re-read base/head identity, branch protection, mergeability, required checks, and repository policy.
+6. Use the repository's guarded merge path. Call a generic merge tool only when policy permits it and the user authorized the merge.
+7. Verify the PR reports `MERGED` and confirm the target branch contains the intended commit.
+
+Do not treat a successful API call that enables auto-merge or queues work as an immediate merge.
+
+### Branches and references
+
+1. Resolve the source commit SHA and target ref explicitly.
+2. Create topic branches rather than updating protected/default branches directly.
+3. Reject non-fast-forward or force updates unless the user explicitly authorizes them and repository policy permits them.
+4. Confirm the remote ref after mutation.
+
+Deletion, force-push, default-branch changes, and protection changes are destructive or high-impact actions requiring explicit authorization.
+
+### Actions and deployments
+
+1. Resolve the workflow by trusted ID or path and confirm `workflow_dispatch` support before dispatch.
+2. Bind run inspection to the intended event, ref, and head SHA.
+3. Distinguish `queued`, `in_progress`, `action_required`, `completed`, and `skipped` states.
+4. Read failed job logs before proposing source changes.
+5. Wait for terminal success and verify the deployed or published surface separately.
+
+Do not approve fork workflow runs by raw run ID when the repository provides a guarded approval command.
+
+### Permissions and protection
+
+1. Read collaborators, role, branch protection, and applicable rulesets before proposing changes.
+2. Treat a 404 protection response as “not configured” only after confirming repository and branch identity.
+3. Show the exact before/after policy and impact before any protection or permission mutation.
+4. Re-read effective state after the change.
+
+## Failure Rules
+
+- Re-resolve tool schemas when Rube reports missing or changed parameters.
+- Stop on repository ambiguity, stale head/base SHA, missing permissions, incomplete pagination, or inconclusive protection state.
+- Never bypass required checks, reviews, merge queues, maintainer commands, or server-side branch protection.
+- Do not claim a merge, workflow, deployment, or permission change succeeded without reading the resulting remote state.
 
 ## Limitations
-- Use this skill only when the task clearly matches the scope described above.
-- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
-- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
+
+- Available Rube tool names and schemas can change; discover them at runtime.
+- GitHub permissions, organization policy, and external checks can block otherwise valid operations.
+- This skill does not authorize repository deletion, force pushes, protection changes, merges, deployments, or releases beyond explicit user intent.