メニュー
Enlist a repository into Squad by installing the supported GitHub Agentic Workflows (gh-aw) bootstrap — with strict compilation, an explicit safe-update allowlist, and a human-reviewed bootstrap PR. Never auto-merges.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/bradygaster/squad --skill gh-aw-enlistmentコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SOC 職業分類に基づく
SKILL.md を表示中
| name | gh-aw-enlistment |
| description | Enlist a repository into Squad by installing the supported GitHub Agentic Workflows (gh-aw) bootstrap — with strict compilation, an explicit safe-update allowlist, and a human-reviewed bootstrap PR. Never auto-merges. |
| domain | github-integration, agentic-workflows, ci-bootstrap, safety-gated-automation |
| confidence | high |
| source | Operationalized from the authoritative Squad gh-aw guide (docs/src/content/docs/guide/gh-aw.md) covering the supported install → compile → validate → bootstrap-PR path. |
| triggers | ["set up Squad agentic workflows","enlist this repo in Squad","enlist my repository in Squad","install Squad gh-aw workflows","install Squad agentic workflows","add Squad gh aw workflows","bootstrap Squad in this repo","onboard this repo to Squad","set up /squad slash commands","gh aw add squad"] |
| tools | [{"name":"gh","description":"GitHub CLI — repo identity, Actions permissions, PR creation, review request, and check watching.","when":"Every step: preflight identity/auth, enabling Actions-created PRs, opening and watching the bootstrap PR."},{"name":"gh aw","description":"GitHub Agentic Workflows extension (github/gh-aw) — installs and strictly compiles the Squad workflow set.","when":"Installing the four @dev workflows and compiling them into deterministic .lock.yml files."}] |
Use this skill when a user wants to enlist a repository into Squad through
GitHub Agentic Workflows (gh aw) — e.g. "set up Squad agentic workflows",
"enlist this repo in Squad", or "install Squad gh-aw workflows". The end state is
the /squad slash command being live on the repo, delivered as a human-reviewed
bootstrap pull request — never an auto-merge.
This skill operationalizes the supported bootstrap path. It does not summarize
it: each step below is a gate with explicit success evidence and STOP conditions.
The authoritative source is docs/src/content/docs/guide/gh-aw.md (mirrored at
https://bradygaster.github.io/squad/docs/guide/gh-aw/). If that guide and this
skill ever disagree, the guide wins — re-read it before proceeding.
Portability contract: resolve every repository identifier (owner, repo, default
branch) at runtime. Never hardcode a placeholder like {owner}/{repo}. The only
fixed identifier is the Squad source itself — bradygaster/squad/workflows/...@dev —
because that is where the workflows are published.
Idempotency contract: the bootstrap is re-runnable. Never clobber existing workflows, prefer detecting prior state over duplicating it, and stop clearly on any unsafe or ambiguous condition rather than guessing.
Run these steps in order. Treat every "STOP" as a hard halt: report the exact condition and wait for a human decision — do not work around it.
# gh is authenticated
gh auth status
# Capture repository identity and default branch AT RUNTIME
owner_repo="$(gh repo view --json nameWithOwner --jq '.nameWithOwner')"
default_branch="$(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name')"
echo "Repo: ${owner_repo} Default branch: ${default_branch}"
# The gh-aw extension must be installed (install once if missing)
gh extension list | grep -q 'github/gh-aw' || gh extension install github/gh-aw
# Git state must be understood and clean enough to isolate the install
git status --short
Portability — extension check: the
grep -qabove is bash/Git Bash. On Windows PowerShell use:if (-not (gh extension list | Select-String -Quiet 'github/gh-aw')) { gh extension install github/gh-aw }
gh auth status is not logged in, or is logged in as the wrong
identity for this repo (see the gh-auth-isolation skill to operate as a
specific account without switching the global default).owner_repo or default_branch cannot be resolved.@copilot review both depend on it.Squad opens PRs through GitHub Actions. Enable that without widening the default workflow token:
gh api --method PUT "repos/${owner_repo}/actions/permissions/workflow" \
-f default_workflow_permissions=read \
-F can_approve_pull_request_reviews=true
Without this, Squad still pushes the generated branch but falls back to an issue
with a manual PR link — and a self-authored PR cannot be self-approved. Keep
default_workflow_permissions=read; do not set it to write.
git switch -c chore/squad-gh-aw-bootstrap
.github/workflows/*.md or *.lock.yml that is
not part of the Squad set. gh aw add is additive; if you see it about to
replace an unrelated workflow, STOP.gh aw add \
bradygaster/squad/workflows/squad.md@dev \
bradygaster/squad/workflows/squad-implement-worker.md@dev \
bradygaster/squad/workflows/squad-deps-worker.md@dev \
bradygaster/squad/workflows/squad-review.md@dev
Keep squad.md first: gh aw add discovers its worker/reviewer dependencies
while compiling it, and the explicit entries confirm the full surface without
creating duplicates. The installed top-level set is exactly:
squad.md + squad.lock.ymlsquad-implement-worker.md + squad-implement-worker.lock.ymlsquad-deps-worker.md + squad-deps-worker.lock.ymlsquad-review.md + squad-review.lock.yml@dev is intentional — it tracks the branch where new modes and fixes land first.
On a clean repo, gh aw add reports these expected safe updates and nothing else:
SQUAD_GITHUB_APP_PRIVATE_KEY and SQUAD_GITHUB_TOKENbradygaster/squad/.github/actions/squad-initThese are referenced names, not prerequisites.
gh aw addlists the secrets the workflows reference so you can approve that surface — it is not asking you to supply them. Both secrets are optional, they need not exist, and neither is required to enlist a repository. Single-repo activation runs on the built-ingithub.token. Configure them only for cross-repo access or elevated permissions. Auth precedence: GitHub App token, then the PAT, thengithub.token. Never block an enlistment waiting for a credential.
If — and only if — the report contains exactly those documented entries, complete the one-time approval:
gh aw compile --strict --approve # first install only, when the safe-update warning appears
--approve step is only the first-install unblock. It is not a
substitute for the final strict compile in the next step.--approvegh aw compile --strict
This must run after any first-install approval and before committing. Success criteria:
squad.md bot-trigger warning: it
configures both slash-command and github-actions[bot] triggers, and the bot
trigger is required for controlled worker-continuation dispatches.for workflow in squad squad-implement-worker squad-deps-worker squad-review; do
test -f ".github/workflows/${workflow}.md" || { echo "MISSING ${workflow}.md"; exit 1; }
test -f ".github/workflows/${workflow}.lock.yml" || { echo "MISSING ${workflow}.lock.yml"; exit 1; }
done
gh aw compile --strict if any .lock.yml is missing. Do not
open or merge the bootstrap PR until all eight files exist and strict
compilation passes.On Windows PowerShell, the
for/test -floop above is POSIX. Use an equivalent guard (e.g.Test-Path) or run it under Git Bash; the logic — all eight files must exist — is what matters.
Downloaded workflow audit data is local diagnostic output — do not commit it.
If .github/aw/logs/ lacks a .gitignore, add one there:
# Ignore all downloaded workflow logs
*
# But keep this file
!.gitignore
gh aw add may also create .vscode/settings.json (enables Copilot for Markdown
workflow files). This is an optional editor setting — the stage command below
intentionally leaves it untracked. Delete it if unwanted, or stage it explicitly
if your team wants to share it. Decide deliberately; do not stage it by accident.
Stage only the documented generated surfaces, then verify the staged set:
git add -- .gitattributes .github/aw/ .github/workflows/ .github/skills/
git diff --cached --stat
# No deletions should be staged:
test -z "$(git diff --cached --diff-filter=D --name-only)" || { echo "STOP: staged deletions"; exit 1; }
git add -- <path> — never git add ., git add -A, or git commit -a.git commit -m "ci: add Squad agentic workflow"
git push -u origin HEAD
gh pr create \
--base "${default_branch}" \
--title "ci: add Squad agentic workflow" \
--body "Installs and strictly compiles the supported Squad GH-AW workflows."
gh pr edit --add-reviewer @copilot
gh pr checks --watch
${default_branch}, not a hardcoded
main./squad cast runs only after the
bootstrap PR merges. Casting analyzes the codebase and opens a separate,
human-reviewed Cast PR containing the team, routing, charters, the Copilot
agent, and meet-the-squad.md. If a work command (/squad implement,
/squad review) is run before a team exists, it auto-opens that Cast PR first —
merge it and rerun the original command; do not start a second cast.owner_repo="$(gh repo view --json nameWithOwner --jq '.nameWithOwner')"
default_branch="$(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name')"
gh api --method PUT "repos/${owner_repo}/actions/permissions/workflow" \
-f default_workflow_permissions=read -F can_approve_pull_request_reviews=true
git switch -c chore/squad-gh-aw-bootstrap
gh aw add \
bradygaster/squad/workflows/squad.md@dev \
bradygaster/squad/workflows/squad-implement-worker.md@dev \
bradygaster/squad/workflows/squad-deps-worker.md@dev \
bradygaster/squad/workflows/squad-review.md@dev
# Safe-update report shows ONLY the two documented secrets + squad-init → approve once
gh aw compile --strict --approve
gh aw compile --strict # final, no --approve; only the bot-trigger warning remains
git add -- .gitattributes .github/aw/ .github/workflows/ .github/skills/
git commit -m "ci: add Squad agentic workflow"
git push -u origin HEAD
gh pr create --base "${default_branch}" \
--title "ci: add Squad agentic workflow" \
--body "Installs and strictly compiles the supported Squad GH-AW workflows."
gh pr edit --add-reviewer @copilot # then wait for review + checks; DO NOT merge
gh aw add reports a third secret: `ACME_DEPLOY_KEY`.
→ This is NOT in the allowlist (SQUAD_GITHUB_APP_PRIVATE_KEY, SQUAD_GITHUB_TOKEN)
and is NOT the squad-init action. Do NOT run `--approve`.
Halt, report "unexpected safe-update entry: ACME_DEPLOY_KEY", and wait.
# BAD: hardcoded owner/repo and default branch
gh api --method PUT "repos/acme/widgets/actions/permissions/workflow" ...
gh pr create --base main ... # wrong if the default branch isn't `main`
# BAD: stages logs, .vscode settings, and anything else that changed
git add -A
git commit -m "add squad"
gh aw compile --strict --approve # approved first install...
# ...then committed WITHOUT the final `gh aw compile --strict` (no --approve). WRONG.
gh pr merge --squash # auto-merge before human review. NEVER.
owner/repo and the
default branch at runtime with gh repo view.git add . / -A / git commit -a). Stage only
.gitattributes, .github/aw/, .github/workflows/, .github/skills/, by path.SQUAD_GITHUB_APP_PRIVATE_KEY,
SQUAD_GITHUB_TOKEN, and bradygaster/squad/.github/actions/squad-init. Anything
else is a STOP.--approve as the final compile. Always finish with a plain
gh aw compile --strict (no --approve).squad.md bot-trigger warning is
allowed; every other warning or error halts the run..github/aw/logs/ output; add the
log .gitignore if missing..github/workflows/ files.default_workflow_permissions=read./squad cast runs only after the bootstrap PR merges.