Menu
Expert GitHub workflow automation. Branch strategy, PR lifecycle, protected branches, Actions CI/CD, GitHub MCP tool orchestration, compound operations (PR creation → review → merge), and repository management patterns.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Continue iterative work from the last ACCEPTED result plus only the new requested change, instead of replaying the conversation. Use during long multi-turn editing of a document, config, or code file; when the user says "keep going from what we had", asks for a follow-up change to something already approved, or is near plan/token limits in an iterative session. Saves one integrity-checked accepted result, builds a minimal continuation prompt, and never carries rejected drafts or transcript history forward.
Use this when: my tests keep failing randomly, write tests for this code, tests pass locally but fail in CI, how do I mock an HTTP call, my test suite is too slow, debug a failing test, increase test coverage, how do I test a database query, write e2e tests for a user journey, run load tests against my API, set up a test framework, add TDD to my workflow, pytest, Vitest, evaluate my agent, LLM eval, agent flaky, RAG eval, prompt regression, hallucination test, Pass@N, LLM-as-Judge, trace agent execution, test my LangGraph agent, agent guardrails, eval dataset, mock agent tools, agent cost ceiling
Use this when: my API keeps returning 401 or 403, getting 429 rate limit errors, integrate a third-party API, my requests keep timing out, add retry logic with backoff, design a REST API, handle OAuth2 authentication, paginate API responses, CORS errors blocking my requests, secure API keys properly, build consistent error responses, my webhook isn't receiving events, OpenAPI, JWT, circuit breaker, idempotency key, API versioning, rate limiting, token refresh
Use this when: my pipeline is failing, set up CI, speed up my build, why is CI slow, cache miss every build, automate releases, set up GitHub Actions, self-hosted runner not connecting, fix my build, run jobs in parallel, deploy on every merge, build and push Docker image, my workflow is flaky, release automation, test pipeline locally before pushing, OIDC auth in CI, semantic versioning
Use this when: review my code, what's wrong with this function, find bugs before they hit production, is this code secure, check for SQL injection, my error handling is wrong, find edge cases I missed, improve this messy code, this PR needs a review, catch performance problems, my code might have a security vulnerability, refactor this for readability, is this logic doing the right thing, N+1 query, race condition, resource leak, mutable default args, unhandled promise
Use this when: build a data pipeline, my pipeline is not idempotent, clean messy data, convert CSV to Parquet, my data has duplicates, validate schema at ingestion, pipeline fails on re-run, process files larger than memory, schedule a recurring job, upstream schema changed and broke my pipeline, migrate data between systems, query Parquet without loading it, deduplicate records, batch vs stream processing, DuckDB for analytics, choose an orchestrator, slow pandas pipeline
| name | github-workflow |
| description | Expert GitHub workflow automation. Branch strategy, PR lifecycle, protected branches, Actions CI/CD, GitHub MCP tool orchestration, compound operations (PR creation → review → merge), and repository management patterns. |
| triggers | ["create PR and request review","set up branch protection","automate GitHub workflow","PR lifecycle management","manage issues and milestones","compound GitHub operations","GitHub Actions pipeline","fork and PR workflow"] |
| tags | ["github","git","pr","actions","ci-cd","branch-strategy","mcp"] |
| author | merged |
Execute complete GitHub workflows — branch, commit, PR, review, merge — without stopping to ask for clarification. Default to trunk-based development. Never leave a PR open without review requested. Always set base branch explicitly.
| Operation | Default | Notes |
|---|---|---|
| Branch model | Trunk-based | Feature branches ≤ 3 days |
| PR size | ≤ 400 lines changed | Split larger PRs |
| Merge strategy | Squash merge | Clean linear history |
| Branch protection | Require 1 review + CI | On main always |
| Commit style | Conventional commits | feat:, fix:, chore: |
| Issue tracking | Labels + milestones | bug, feature, tech-debt |
IF starting new feature:
→ create_branch from main: feature/short-description
→ commits follow conventional commit format
→ PR when: tests pass, description has Why + What
ELIF reviewing PR:
→ check: tests added?, breaking change?, security impact?
→ request changes on: missing tests, hardcoded secrets, N+1 queries
→ approve on: correct logic, tested, matches ticket
ELIF merging:
→ squash merge preferred (clean history)
→ delete branch after merge
→ close linked issues with "Closes #NNN"
IF hotfix needed:
→ branch from main: hotfix/description
→ PR with [HOTFIX] prefix
→ merge → tag immediately
IF compound operation (create PR + review + merge):
→ create_branch → push_files → create_pull_request
→ add_issue_comment (review notes) → merge_pull_request
| Anti-Pattern | Use Instead |
|---|---|
| Long-lived feature branches (>3 days) | Trunk-based with feature flags |
| Force-push to main | Branch protection + squash merge |
| PR with no description | Template: Why / What / Testing / Breaking |
| Merging without CI passing | Require status checks in branch protection |
| Secrets in commit history | GitHub Secrets + git filter-repo to purge |
| 1000-line PRs | Split into logical atomic PRs |
main: require reviews + status checks.github/pull_request_template.md)bug, feature, tech-debt, blockedCODEOWNERS defined for critical paths→ See cicd-pipeline for GitHub Actions workflow patterns
→ See security-engineer for supply chain hardening (branch protection, signed commits)
When the GitHub MCP is connected, these tools are available for compound operations:
| Tool | Purpose |
|---|---|
create_branch | Create new branch from base |
push_files | Push one or more files in single commit |
create_pull_request | Open PR with title, body, base, head |
get_pull_request | Fetch PR details, status, reviews |
merge_pull_request | Merge with squash/merge/rebase strategy |
create_pull_request_review | Submit review (APPROVE/REQUEST_CHANGES/COMMENT) |
get_pull_request_files | List changed files in PR |
create_issue | Open issue with labels, assignees |
update_issue | Edit issue state, labels, assignees |
add_issue_comment | Comment on issue or PR |
list_commits | List recent commits on branch |
get_file_contents | Read file at ref/branch |
search_code | Full-text search across repos |
fork_repository | Fork for external contribution |
# Step 1: Create branch
create_branch(repo="owner/repo", branch="feature/add-auth", from_branch="main")
# Step 2: Push changes
push_files(
repo="owner/repo",
branch="feature/add-auth",
files=[{"path": "src/auth.py", "content": "..."}],
message="feat: add JWT authentication middleware"
)
# Step 3: Open PR
pr = create_pull_request(
repo="owner/repo",
title="feat: add JWT authentication middleware",
body="""## Why
Unauthenticated endpoints are accessible. Closes #42.
## What
- JWT middleware validates tokens on protected routes
- 401 on missing/invalid tokens
- Tests cover valid, expired, and malformed tokens
## Breaking Changes
None — all existing unprotected routes unchanged.""",
head="feature/add-auth",
base="main",
draft=False
)
# Step 4: Request review
add_issue_comment(
repo="owner/repo",
issue_number=pr["number"],
body="@teammate please review auth middleware logic in `src/auth.py`"
)
# Via GitHub API or UI: Settings → Branches → Add rule
branch: main
rules:
require_pull_request_reviews:
required_approving_review_count: 1
dismiss_stale_reviews: true
require_status_checks:
strict: true # Branch must be up to date
contexts:
- "ci/test"
- "ci/lint"
require_conversation_resolution: true
restrict_force_pushes: true
restrict_deletions: true
.github/pull_request_template.md)## Why
<!-- What problem does this solve? Link to issue: Closes #NNN -->
## What changed
<!-- Summary of changes -->
## Testing
- [ ] Unit tests added/updated
- [ ] Integration tests pass
- [ ] Manual testing steps:
## Breaking changes
<!-- List any breaking changes, or "None" -->
## Checklist
- [ ] No secrets or credentials committed
- [ ] Documentation updated (if applicable)
- [ ] `CHANGELOG.md` updated (for library releases)
# .github/workflows/pr-checks.yml
name: PR Checks
on:
pull_request:
branches: [main]
types: [opened, synchronize, reopened]
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
with:
python-version: '3.12'
cache: pip
- run: pip install -r requirements.txt
- run: pytest --tb=short -q
lint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
with:
python-version: '3.12'
- run: pip install ruff
- run: ruff check .
feat: New feature (minor version bump)
fix: Bug fix (patch version bump)
chore: Maintenance (no version bump)
docs: Documentation only
refactor: Code change without feature/fix
test: Test additions/changes
perf: Performance improvement
ci: CI/CD changes
build: Build system changes
BREAKING CHANGE: footer note → major version bump
Examples:
feat: add OAuth2 PKCE flow for mobile clients
fix: resolve race condition in worker pool shutdown
chore(deps): bump httpx from 0.27.0 to 0.28.1
| Symptom | Cause | Fix |
|---|---|---|
| PR blocked by stale review | Review dismissed by new commit | Re-request review; enable "dismiss stale reviews" |
| CI passes locally, fails on PR | Environment diff (secrets, OS) | Use act locally to simulate GH Actions runner |
| Merge conflict on PR | Long-lived branch diverged | git fetch && git rebase origin/main |
| Branch protection bypass needed | Emergency hotfix | Temporarily disable rule as admin; re-enable immediately |
| Secrets found in commit | Hardcoded credentials | git filter-repo --path-regex; rotate credentials immediately |
| PR auto-merge not triggering | Required checks not reporting | Verify workflow name matches branch protection context string |