メニュー
Commit local changes and open a pull request against kube-coder from inside a workspace pod. Use when the user wants to push a branch or open/update a PR with the workspace GitHub App token.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/imran31415/kube-coder --skill kc-ship-prコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SOC 職業分類に基づく
SKILL.md を表示中
| name | kc-ship-pr |
| description | Commit local changes and open a pull request against kube-coder from inside a workspace pod. Use when the user wants to push a branch or open/update a PR with the workspace GitHub App token. |
| user-invocable | true |
| allowed-tools | Bash, Read |
| argument-hint | [PR title] (optional; inferred from the commit if omitted) |
The only GitHub credential here is the App installation token
(/home/dev/.credentials/.github-token, ghs_…). The token-refresh sidecar
installs a self-refreshing global credential.helper that reads that file
fresh on every call, so ordinary git push works — no Git Data API dance
needed. gh api also works (it reads GITHUB_TOKEN from ~/.github-env).
There is no user-level gh auth login and no SSH key here, so do not suggest
gh auth login or a fork — the App token pushes to origin directly.
If
git pushis wedged —remote: Invalid username or tokenorcould not read Username— something is shadowing that helper with a point-in-time token. The token file itself is almost never the problem (curl -H "Authorization: token $(cat /home/dev/.credentials/.github-token)" https://api.github.com/userproves it in one line). Diagnose in this order:git config --show-origin --get-all credential.helper git config --show-origin --get-all credential.https://github.com.helper printf 'protocol=https\nhost=github.com\n\n' | git credential fill # vs. the token file grep github.com ~/.git-credentialsThree known causes, all "a token frozen an hour ago":
- A stale baked
http.<host>.extraheaderin.git/config— git sends it verbatim and it shadows the helper:git config --unset-all http.https://github.com/.extraheader.- A host-scoped helper chain reset (issue #454) —
gh auth setup-gitwrites an emptyhelper =under[credential "https://github.com"], which clears the chain and drops the self-refreshing reader;gh auth git-credentialthen answers with the staleGH_TOKENyour long-lived shell captured before the last rotation. The workspace re-asserts that section every 50 min, so this self-heals — to fix it now, runpython3 /github-app/github-app-token.py --configure-git(or--once, which also asks thegithub-app-tokensidecar for a fresh token; the private key lives only in that sidecar since #558, so nothing in your shell can mint one).- A stale
github.comline in~/.git-credentials(persistent on the PVC, so a capturedghs_…outlives its 1-hour validity). The daemon purges these in app mode; delete by hand if you're ahead of it.One-shot escape hatch that bypasses all three:
git -c credential.helper= \ -c 'credential.helper=!f() { echo username=x-access-token; echo "password=$(cat /home/dev/.credentials/.github-token)"; }; f' \ push -u origin <branch>Only if push is still broken after that, fall back to the Git Data API (§3b). See your
github-authmemory for the full background.
Given the working tree already has the changes staged/committed on a feature
branch (create one first if the user is on main):
cd /home/dev/kube-coder # or your worktree
git add -A # or specific paths
git commit -m "<type>(<scope>): <summary>
<body>
Co-Authored-By: Claude <noreply@anthropic.com>"
git fetch origin main && git rebase origin/main
If the credential helper is somehow unavailable, the repo is public so an
unauthenticated fetch also works:
git -c credential.helper= -c http.https://github.com/.extraheader= fetch https://github.com/imran31415/kube-coder.git main
git push -u origin <branch>
git push stays wedged)Run this Python (token from env or the credential file). Set BRANCH and list
the changed files in FILES:
source /home/dev/.credentials/.github-env # exports GITHUB_TOKEN
python3 - <<'PY'
import os, json, base64, urllib.request, subprocess
TOKEN = os.environ["GITHUB_TOKEN"]; REPO = "imran31415/kube-coder"
API = f"https://api.github.com/repos/{REPO}"
BRANCH = "REPLACE-branch-name"
FILES = subprocess.check_output(
["git", "diff", "--name-only", "main", "HEAD"]).decode().split()
def api(method, url, body=None):
d = json.dumps(body).encode() if body is not None else None
r = urllib.request.Request(url, data=d, method=method)
r.add_header("Authorization", f"token {TOKEN}")
r.add_header("Accept", "application/vnd.github+json")
if d: r.add_header("Content-Type", "application/json")
with urllib.request.urlopen(r) as x: return json.load(x)
base = api("GET", f"{API}/git/refs/heads/main")["object"]["sha"]
tree = api("GET", f"{API}/git/commits/{base}")["tree"]["sha"]
entries = []
for f in FILES:
blob = api("POST", f"{API}/git/blobs",
{"content": base64.b64encode(open(f, "rb").read()).decode(),
"encoding": "base64"})
entries.append({"path": f, "mode": , : , : blob[]})
t = api(, f, {: tree, : entries})
msg = subprocess.check_output([, , , ]).decode().strip()
commit = api(, f,
{: msg, : t[], : [base]})
api(, f,
{: f, : commit[]})
(, commit[][:8], , BRANCH)
PY
Notes:
POST /git/refs. Add a commit to an existing PR branch
→ read the branch's current head first, base the tree on it, then
PATCH /git/refs/heads/{BRANCH} with the new commit sha.FILES change; everything else is inherited from base_tree.source /home/dev/.credentials/.github-env
BODY=$(cat <<'EOF'
## What & why
...
## Testing
...
🤖 Generated with [Claude Code](https://claude.com/claude-code)
EOF
)
gh api repos/imran31415/kube-coder/pulls \
-f title="$ARGUMENTS" -f head="REPLACE-branch-name" -f base="main" -f body="$BODY" \
--jq '.html_url'
If gh fails, the same works with curl -X POST -H "Authorization: token $GITHUB_TOKEN".
The PR body/title referencing (#N) cross-links but does not auto-close.
To close on merge, add Fixes #N to the PR body, or close the issue after merge:
gh api repos/imran31415/kube-coder/issues/N/comments -f body="Resolved by #<pr>."
gh api -X PATCH repos/imran31415/kube-coder/issues/N -f state=closed -f state_reason=completed
Run kc-preflight first so CI is green on the first push. Never push a branch
you haven't at least bash -n/typecheck/test-run locally — CI round-trips are slow.
github-auth memory has the full background on the App-token auth setup
and the stale-extraheader footgun.git push again; if you're using
the §3b fallback, repeat it in PATCH mode onto the branch head.