Menu
Migrate GitHub Actions from PAT to GitHub App auth.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
日本語の技術文書・書籍原稿の文章規範。整形（一文一行、引用ブロック、脚注、コラム記法）、段落と論証の構成（パラグラフライティング）、論証の厳密さ（ツッコミどころの除去）、読み手の負荷の管理、視点と語り、演出の抑制、LLM っぽい空句の禁止、冗長の排除を定める。日本語で技術書の章、草稿、記事、解説文を書くとき、または推敲・リライトするときに使用する。
One disciplined pass of /code-review -> triage -> fix on the current branch; pair with /goal to repeat until clean or a turn cap. Use when the user says 'review loop', 'レビューループ', 'code-review を回して直して', 'lint until clean'. Optional arg: code-review effort (low|medium|high|max, default high).
Analyze GitHub Actions CI logs to identify failure causes. Use when user wants to debug CI failures, investigate workflow errors, or understand why a build failed. Triggers on phrases like 'debug CI', 'why did CI fail', 'analyze workflow failure', 'check CI logs', 'CIが失敗しています', 'CIが落ちた', 'ワークフローのエラーを調査', 'ビルドが失敗した'. Accepts run ID or PR number as argument.
Create a GitHub pull request for the current branch. Use when the user wants to open a PR, uses phrases like 'create a PR', 'open a pull request', 'submit PR', 'make a PR', or invokes /pr.
Use this skill when the user requests to commit changes, uses phrases like 'commit these changes', 'create a commit', 'commit with message', or when the user wants to stage and commit files with an appropriate gitmoji-prefixed commit message.
Recover pre-compaction context from backup transcripts. Use when the user wants to restore conversation context after compaction, uses phrases like 'recover context', 'restore backup', or invokes /recover.
| name | migrate-to-github-app |
| description | Migrate GitHub Actions from PAT to GitHub App auth. |
| user-invocable | true |
| disable-model-invocation | true |
| allowed-tools | Read, Edit, Write, TaskCreate, AskUserQuestion, Bash(ls:*), Bash(sleep:*), Bash(gh secret list:*), Bash(gh run list:*), Bash(gh run watch:*), Bash(gh workflow run:*) |
| model | sonnet |
Migrate a repo's GitHub Actions from PAT (GH_TOKEN) to GitHub App (gawakawa-bot) authentication.
Read references/workflow-templates.md before starting — it contains the exact YAML for each file.
Use TaskCreate to track each step. Commit after each file change with /commit.
ls .github/workflows/
gh secret list --repo <owner>/<repo>
Note which of the 4 target files exist and whether GH_TOKEN is present as a secret.
For each file that exists, apply the change from references/workflow-templates.md and run /commit:
ci.yml — patch only: replace secrets.GH_TOKEN → secrets.GITHUB_TOKEN in github_access_token. Skip if file doesn't use GH_TOKEN.dependabot-auto-merge.yml — full rewrite to reusable workflow callerupdate-pr-branches.yml — full rewrite to reusable workflow callerupdate-flake-lock.yml — full rewrite; adjust branch and pr-title to match repo convention; keep <branch> consistent in the label jobAsk the user to complete both of the following, then confirm before proceeding:
<owner>/<repo>pass, requires GPG passphrase):
! set-bot-secrets <owner>/<repo>
gh secret list --repo <owner>/<repo>
# Must show BOT_APP_ID and BOT_PRIVATE_KEY before proceeding
git push
If secrets are missing, ask the user to run ! set-bot-secrets <owner>/<repo> first.
gh run list --repo <owner>/<repo> --workflow ci.yml --limit 1 --json databaseId,status
gh run watch <run-id> --repo <owner>/<repo> --exit-status
gh workflow run "Update Flake Lock" --repo <owner>/<repo>
sleep 5
gh run list --repo <owner>/<repo> --workflow update-flake-lock.yml --limit 1 --json databaseId,status
gh run watch <run-id> --repo <owner>/<repo> --exit-status
If this fails with "Not Found" on the App token step, the gawakawa-bot App is not installed on the repo — ask the user to install it (Step 3) and retry.
Only after Step 6 succeeds:
gh secret delete GH_TOKEN --repo <owner>/<repo>
gh secret list --repo <owner>/<repo> # confirm GH_TOKEN is gone