القائمة
Validates Issue-First workflow compliance before execution
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Guided checklist for safely adding a new platform service to AIXCL, preserving all invariants
Audit all versioned platform components and manage the update process following issue-first workflow
Comprehensive repository health check covering hygiene, security, and code quality
Guided workflow for cutting an AIXCL release, fronting the aixcl release command
| name | workflow-guard |
| description | Validates Issue-First workflow compliance before execution |
| compatibility | OpenCode, Claude Code |
| metadata | {"category":"workflow","security_level":"critical","version":"1.1"} |
Validates that all actions comply with the Issue-First development workflow before execution.
Before starting any code change, fix, or feature -- and again before creating a PR.
[TYPE] Description (no colons)gh issue create, always use --body-file with a file, or a quoted HEREDOC (cat << 'EOF'). Never use inline --body with multiline strings containing backticks.issue-<number>/<short-description>dev (not main)main or dev branches<type>: <description>Fixes #<number>./scripts/checks/check-ai-elisions.sh --staged (or --range <base> <head> for pushed commits)<description> (#<number>) (no colons)Fixes #<number> in bodycomponent:* labelecho "$PR_BODY" | bash scripts/checks/check-agent-id-block.sh
+---------+ +----------+ +---------+ +---------+ +---------+
| Issue |--->| Branch |--->| Commit |--->| PR |--->| Merge |
| Created | | Created | | Pushed | | Opened | | to dev |
+---------+ +----------+ +---------+ +---------+ +---------+
| | | | |
v v v v v
+---------+ +----------+ +---------+ +---------+ +---------+
|validate | |validate | |validate | |validate | |validate |
|issue | |branch | |commit | |PR | |merge |
+---------+ +----------+ +---------+ +---------+ +---------+
The following workflow transitions ALWAYS require human approval:
git push --force operation.security/ or .github/workflows/gh issue view <number> --json number,title,state,assignees,labels
# Check for garbled body: shell output, error messages, container IDs, timestamps
gbody=$(gh issue view <number> --json body -q '.body')
# Reject if body contains shell artifacts
if echo "$gbody" | grep -Eq '(Error:|Usage:|podman stop|^[a-f0-9]{64}$|20[0-9]{2}-[0-9]{2}-[0-9]{2}T)'; then
echo "REJECT: Issue body appears garbled (backtick command substitution or shell output injected)"
echo "Remediation: Recreate with --body-file or quoted HEREDOC"
exit 1
fi
git log --oneline dev..HEAD | tail -1 # Should be empty (branched from dev)
git merge-base --is-ancestor dev HEAD || echo "NOT from dev"
git log --oneline -1 | grep -E '^(fix|feat|docs|refactor|test|chore|ci):'
git log --oneline -1 | grep -E 'Fixes #[0-9]+'
gh pr view <number> --json assignees,labels,title,body
If any validation step fails:
@orchestrator Please validate the workflow for issue #917
Agent loads this skill and runs validation:
1. Check issue #917 exists [x]
2. Check issue is assigned [x]
3. Check branch issue-917/security-first-agentic-foundation format [x]
4. Check branch from dev [x]
5. Check commits reference #917 [x]
6. Check security-gate approval [x]
Result: All validations passed. Workflow approved.
This skill is automatically invoked by:
| Rule | Source | Enforcement |
|---|---|---|
| Issue-first | AGENTS.md | Block execution without valid issue |
| No colons in titles | DEVELOPMENT.md | Reject malformed titles |
| Clean issue body | workflow-guard skill | Reject garbled body (backtick injection) |
| Branch from dev | AGENTS.md | Reject branches from main |
| Component labels required | DEVELOPMENT.md | Reject unlabeled PRs |
| Assignee required | DEVELOPMENT.md | Reject unassigned PRs |
Before claiming compliance, verify: