Menu
Validates Issue-First workflow compliance before execution
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Basé sur la classification professionnelle SOC
| name | workflow-guard |
| description | Validates Issue-First workflow compliance before execution |
| compatibility | OpenCode, Claude Code |
| metadata | {"category":"workflow","security_level":"critical","version":"1.1"} |
Validates that all actions comply with the Issue-First development workflow before execution.
Before starting any code change, fix, or feature -- and again before creating a PR.
[TYPE] Description (no colons)gh issue create, always use --body-file with a file, or a quoted HEREDOC (cat << 'EOF'). Never use inline --body with multiline strings containing backticks.issue-<number>/<short-description>dev (not main)main or dev branches<type>: <description>Fixes #<number>./scripts/checks/check-ai-elisions.sh --staged (or --range <base> <head> for pushed commits)<description> (#<number>) (no colons)Fixes #<number> in bodycomponent:* labelecho "$PR_BODY" | bash scripts/checks/check-agent-id-block.sh
+---------+ +----------+ +---------+ +---------+ +---------+
| Issue |--->| Branch |--->| Commit |--->| PR |--->| Merge |
| Created | | Created | | Pushed | | Opened | | to dev |
+---------+ +----------+ +---------+ +---------+ +---------+
| | | | |
v v v v v
+---------+ +----------+ +---------+ +---------+ +---------+
|validate | |validate | |validate | |validate | |validate |
|issue | |branch | |commit | |PR | |merge |
+---------+ +----------+ +---------+ +---------+ +---------+
The following workflow transitions ALWAYS require human approval:
git push --force operation.security/ or .github/workflows/gh issue view <number> --json number,title,state,assignees,labels
# Check for garbled body: shell output, error messages, container IDs, timestamps
gbody=$(gh issue view <number> --json body -q '.body')
# Reject if body contains shell artifacts
if echo "$gbody" | grep -Eq '(Error:|Usage:|podman stop|^[a-f0-9]{64}$|20[0-9]{2}-[0-9]{2}-[0-9]{2}T)'; then
echo "REJECT: Issue body appears garbled (backtick command substitution or shell output injected)"
echo "Remediation: Recreate with --body-file or quoted HEREDOC"
exit 1
fi
git log --oneline dev..HEAD | tail -1 # Should be empty (branched from dev)
git merge-base --is-ancestor dev HEAD || echo "NOT from dev"
git log --oneline -1 | grep -E '^(fix|feat|docs|refactor|test|chore|ci):'
git log --oneline -1 | grep -E 'Fixes #[0-9]+'
gh pr view <number> --json assignees,labels,title,body
If any validation step fails:
@orchestrator Please validate the workflow for issue #917
Agent loads this skill and runs validation:
1. Check issue #917 exists [x]
2. Check issue is assigned [x]
3. Check branch issue-917/security-first-agentic-foundation format [x]
4. Check branch from dev [x]
5. Check commits reference #917 [x]
6. Check security-gate approval [x]
Result: All validations passed. Workflow approved.
This skill is automatically invoked by:
| Rule | Source | Enforcement |
|---|---|---|
| Issue-first | AGENTS.md | Block execution without valid issue |
| No colons in titles | DEVELOPMENT.md | Reject malformed titles |
| Clean issue body | workflow-guard skill | Reject garbled body (backtick injection) |
| Branch from dev | AGENTS.md | Reject branches from main |
| Component labels required | DEVELOPMENT.md | Reject unlabeled PRs |
| Assignee required | DEVELOPMENT.md | Reject unassigned PRs |
Before claiming compliance, verify:
Guided checklist for safely adding a new platform service to AIXCL, preserving all invariants
Audit all versioned platform components and manage the update process following issue-first workflow
Comprehensive repository health check covering hygiene, security, and code quality
Guided workflow for cutting an AIXCL release, fronting the aixcl release command