Add or verify W3 Total Cache release changelog bullets in readme.txt and changelog.txt. Use when preparing a release branch, adding changelog lines for a new version, syncing readme.txt with changelog.txt, or when the user mentions readme changelog, changelog.txt, or upgrade notice text.
Maps the W3TCQA AWS test matrix (orchestrator ~/ci, EC2 boxes, /share paths, report artifacts, box naming, log formats). Use when analyzing AWS QA failures, uploaded w3tcqa-ci.zip bundles, summary.html, per-box logs, restore-final state, or planning fixes to qa/plugins probe scripts.
Move an in-progress public GitHub PR for a security fix into a GitHub Security Advisory's temporary private fork (TPF) so the remaining work continues privately. Use when a security-fix PR was opened on a public repo and the team decides further review and additional commits should happen in a draft GHSA's TPF, with the original public PR closed and its branch deleted. Requires repo-admin (or `repository_advisories:write` + `repo`) GitHub auth. Encodes the create-advisory → start-private-fork → push-branch → open-private-PR → back-link-to-Jira → close-public-PR sequence plus the gotchas (async fork creation, no CI on TPFs, all-or-nothing merge in the advisory UI, public PR history is already public, contributor-fork branches can't be deleted by the maintainer, Jira-side bidirectional cross-link must be posted explicitly). Standing rule: always run `pr-content-to-jira` first as the paired content-relocation step — never as a per-run "should we?" question.
Move sensitive descriptive content (vuln scope, finding IDs, exploit-shaped review commentary) off a public GitHub PR and into an internal Jira ticket as the audit-trail record of truth. Use when a public-repo PR has accumulated content that should not stay in the default public view — enumerated audit-finding IDs, kill-chain summaries, partial/known-unfixed vuln descriptions, reviewer-flagged blockers that double as exploit primitives against the in-flight fix — and an internal Jira ticket exists (or can be created) to receive it. Requires repo-admin GitHub auth and authenticated Atlassian Jira MCP. Do not use as a substitute for a real GHSA / private-fork workflow when the disclosure is severe; this skill redacts the current default view, not the public history.
Repost GitHub review content (Copilot bot reviews, human-reviewer threads, etc.) from a closed public PR onto its GHSA temporary-private-fork (TPF) PR, anchored to the source's `original_commit_id` at `original_line` so each comment renders as a historical outdated comment matching the original review UX exactly. Use after `move-pr-to-private-ghsa` to restore reviewer-thread continuity on the TPF, since reviews/inline comments do not migrate with the commits. Encodes the pull-via-`gh api` → group-by-review → anchor-to-original-commit → attribute-via-preface → post-as-COMMENT-event sequence plus the gotchas (commit must still be in the TPF chain, line must be in that commit's diff, your account is the apparent author so attribution lives in the body preface, never re-use APPROVE / REQUEST_CHANGES events from the source review). Requires repo-admin (or `repo` scope) on the TPF and `repo` scope on the public source repo.