credfeto-ai-skills

Triage deprecation warnings seen in test output — fix ones caused by your change immediately, track pre-existing ones with a GitHub issue. Use whenever a deprecation warning (framework or runtime warning about a deprecated API) appears while running tests.

Write .NET unit tests using FunFair.Test.Common/FunFair.Test.Infrastructure base classes, mocking helpers, date sources, and xunit assertion patterns instead of hand-rolled equivalents. Use whenever writing or reviewing a .NET unit test (a *.Tests project).

Create, name, and maintain git branches — branching rules, Conventional Commits-style branch naming, rebasing against main, resuming interrupted work, and resolving version conflicts in dependency manifests during merges/rebases. Use when starting new work, creating a branch, resuming work on an existing branch, rebasing, or resolving merge conflicts.

Commit and push changes safely — branch checks, build/test gates, Conventional Commits format, and push cadence. Use whenever about to commit, stage, or push changes in any repository, or when acting as the Committer agent.

Create and manage GitHub issues correctly — duplicate search, planned descriptions, priority/status labels, assignment, and the Blocked label rules for AI-initiated issues, including the mandatory tracking issue required before starting any ad-hoc task. Use when asked to create a GitHub issue, when raising an issue autonomously, when a human asks you to do something and no existing issue or PR is already specified, when a PR or issue comment asks you to raise an issue, when selecting the next issue to work on, or when asking a blocking question and needing to mark an item Blocked.

Design and optimise performance-critical code, and back optimisations with committed benchmarks and measured allocation thresholds. Use when writing or optimising performance-critical code, or when asked to add or update a benchmark.

Keep pull request titles, bodies, and labels in sync with their linked issues, and manage PR lifecycle including bot-created PR ownership and draft state. Use on every agent run that interacts with a PR, when creating or updating a PR, when checking for existing PRs before starting work, when replying to PR comments, when checking CI status on a PR, or when blocking a PR pending human input.

Run before starting any work on an issue or PR in a repository. Verifies language/runtime prerequisites, runs the pre-commit baseline against all tracked files, and runs dotnet buildcheck in .NET repositories. Use at the start of every task, before writing any code, to ensure CI results are unambiguous.

Create a .http test file for every HTTP API endpoint that is exposed or consumed. Use whenever an HTTP API is being created, consumed, or modified.

Author and run Dockerfiles and Compose files safely — runner detection (Docker vs Podman), multi-stage builds, version pinning, non-root users, and image security basics. Use whenever a Dockerfile, Containerfile, docker-compose*.yml/yaml, compose.yml/yaml, or .dockerignore is present, or container work is needed.

Manage firewalld rules safely using standard shell helpers for IPv4/IPv6 and private-network scoping. Use whenever adding, changing, or reviewing firewall-cmd rules in a shell script.

Handle secrets, validate untrusted input, sanitise output, model threats, and scan dependencies for vulnerabilities. Use whenever writing code that handles credentials, accepts external input (user input, API requests, file contents, env vars, message queues), produces output containing external data, exposes an endpoint, or introduces a new trust boundary.

Write standalone shell scripts that pass shellcheck/checkbashisms, use consistent die/success/info output helpers, and detect AI-agent invocation correctly. Use whenever creating or modifying a .sh file, or any standalone shell script work.

Choose secure, actively-maintained, managed dependencies over native or hand-rolled code, and resolve conflicting package versions safely during merges or rebases. Use whenever adding a new package dependency, encountering hand-rolled code that duplicates a library or standard-library feature, or resolving a version conflict in a dependency manifest.

Identify org-owned Credfeto.* and FunFair.* NuGet packages and read their source from GitHub instead of decompiling. Use whenever a Credfeto.* or FunFair.* package is encountered in a .NET repository — while debugging, researching behaviour, or adding a new dependency.

Handle and propagate errors explicitly — catch only what can be meaningfully handled, preserve root causes when wrapping, and sanitise errors surfaced to external callers. Use whenever writing or reviewing error handling, exception handling, or error propagation code in any language.

Maintain .gitignore files correctly — never commit IDE-specific files, treat the root .gitignore as owned by credfeto/cs-template, and add repo-specific entries at the right directory level. Use whenever creating or modifying any .gitignore file.

Write structured log statements at the right level, with enough context to diagnose a problem and no PII or secrets. Use whenever adding or reviewing logging calls, choosing a log level, or deciding what to include in a log message.

Author and review GitHub Actions workflow files and composite actions — third-party action policy, converting steps to actions/github-script, version pinning, step field ordering, permissions, checkout configuration, and composite-action extraction rules. Use whenever creating or modifying any .github/workflows/*.yml file or a .github/actions/*/action.yml composite action.

Pin npm/JavaScript/TypeScript package versions exactly and resolve version conflicts safely. Use whenever adding, updating, or reviewing entries in package.json, or resolving package-lock.json conflicts during a merge or rebase.

Write and maintain README.md with the required section order, reference-style badge links, and the all-contributors section. Use whenever creating or updating README.md, adding a config option that needs documenting, or adding/removing a badge.

Make SQL Server schema changes in projects that combine a DACPAC (MSBuild.Sdk.SqlProj) with a runtime migration tool (DbUp-SqlServer, EvolveDb, or similar) — keeping both in sync, and optimise stored procedures/views before committing. Use whenever adding or modifying a table, view, stored procedure, function, or index in such a project, or when writing/optimising a SQL Server stored procedure or view.

Add or remove CHANGELOG.md entries using the dotnet changelog tool (Credfeto.Changelog.Cmd). Use whenever a change needs a changelog entry, before committing feature/fix work, or when acting as the Changelog agent. Never edit CHANGELOG.md by hand.

Collect .NET code coverage with Microsoft.Testing.Platform and generate per-assembly HTML reports with reportgenerator. Use when measuring test coverage, running coverage tasks, or producing coverage reports in a .NET repository. Covers test project identification, correct dotnet test invocation, and report generation rules.

Enable trimming and AOT publishing on .NET executable projects in the correct staged order. Use when working on a .NET project that produces a publishable executable (OutputType=Exe or WinExe), or when asked to enable PublishTrimmed, PublishAot, or fix IL2xxx/IL3xxx warnings.