| name | zenstack-pr-hardening |
| description | Bounded MIT Sailing ZenStack admin authorization PR publishing and hardening workflow. Use when finishing docs/superpowers/plans/zenstack-admin-authorization/tasks/10-pr-hardening.md, creating or updating the ZenStack authorization PR, checking GitHub CI once per bounded round, addressing actionable bot PR comments without interactive prompting, or preventing broader PR-finishing skills from starting open-ended watch/heartbeat loops. |
ZenStack PR Hardening
Use for docs/superpowers/plans/zenstack-admin-authorization/tasks/10-pr-hardening.md.
This skill is intentionally narrower than finish-pr-loop,
finish-pr-context7, and generic review-bot resolver skills. It must not start
open-ended watchers, heartbeat automations, or "keep checking until quiet" loops
unless the user explicitly asks for that behavior.
Source References
- Repo PR-loop rule:
.cursor/rules/pr-agent-reviews-loop.mdc
- GitHub skill:
/Users/andrewkelley/.codex/plugins/cache/openai-curated/github/eed16198/skills/github/SKILL.md
- GitHub publish skill:
/Users/andrewkelley/.codex/plugins/cache/openai-curated/github/eed16198/skills/yeet/SKILL.md
Hard Limits
- Do not use
finish-pr-loop or finish-pr-context7 as workflows.
- Do not use
resolve-agent-reviews as a workflow.
- Do not use the official CodeRabbit
autofix skill for this task because it
prompts the user for fix choices and push decisions.
- Do not trigger any CodeRabbit write-producing finishing touch: Autofix,
stacked PR, generated unit tests, docstrings, simplify, or custom recipes.
.coderabbit.yaml keeps CodeRabbit in review/comment mode only.
- Wait for CodeRabbit only when a review is actively running/pending. Do not
run, wait for, or retry CodeRabbit when it is out of credits, rate-limited,
unavailable, skipped/not started, or failing without actionable comments.
- Do not run
npx agent-reviews --watch.
- Do not create open-ended heartbeat automations.
- Do not keep polling after the bounded round count is exhausted.
- Do not schedule recurring checks. The only allowed schedule is one short
next worker/recheck, normally 10 minutes after the latest successful fix
commit and push.
- Do not run another local CodeRabbit review pass here; use local independent
sub-agent review instead.
- Do not manually review code and claim the result came from CodeRabbit.
- Do not ask the user to choose fixes unless a finding is genuinely ambiguous,
unrelated to the migration, or would require broad scope expansion.
- Do not paste full CI logs, full review-thread bodies, full diffs, or full
command output into chat, state files, worker prompts, or PR comments.
Preconditions
Before publishing or hardening:
- Confirm tasks 3-9 are complete, committed, and recorded in the queue.
- Confirm the current branch is not
main or master.
- Run
git status -sb and inspect whether the worktree contains unrelated
user changes.
- If the worktree is mixed, stage only task-owned files. Do not use
git add -A unless the whole worktree is confirmed in scope.
- Confirm
gh auth status works before GitHub reads or writes.
Publish PR
Use local git for branch, commit, and push. Prefer the GitHub app for PR
creation after the branch is pushed; use gh only when the connector cannot
infer the repository or branch cleanly.
Create the PR as ready for review, not draft, so CI and analyzers can run on the
PR. If an open PR already exists for the branch, update it instead of creating a
duplicate.
The PR body must include:
- what changed
- why it changed
- local independent AI review and verification summary
- commands run
- remaining blockers, if any
Keep the PR body compact. Link or cite artifact paths and summarize command
outcomes; do not paste raw CodeRabbit output or full logs.
Bounded Post-PR Rounds
Run at most three post-PR rounds. Each round is one bounded inspection and one
bounded fix unit.
At the start of each round:
- Inspect PR checks once:
python3 /Users/andrewkelley/.codex/skills/finish-pr-context7/scripts/inspect_pr_state.py --repo "." --pr "<number-or-url>"
- Inspect unanswered bot comments once:
npx agent-reviews --bots-only --unanswered
- Pick one work unit:
- first priority: one failing CI/check cluster, excluding non-blocking
Codacy Low/Info noise;
- second priority: one cluster of actionable bot comments;
- third priority: one cluster of other actionable bot review comments.
- Fix only that work unit.
- Run targeted verification, then
npm run check:types and npm run lint.
Add npm run check:i18n for user-visible copy changes and targeted tests
for changed behavior.
- Commit and push once if code changed.
- Reply to each processed review comment with
npx agent-reviews --reply ...
and --resolve when the issue is fixed or intentionally won't-fix.
- If another bounded round is needed after a successful commit and push,
schedule one next worker/recheck for about 10 minutes after that successful
commit/push and emit only compact state. Do not schedule a recurring
interval.
Stop early when a round's one-shot inspection shows:
- no failing checks except non-blocking Codacy Low/Info noise; and
- no actionable unanswered bot comments.
Before treating that state as merge-ready, fetch the base branch, rebase the PR
branch on current origin/main, rerun or wait for required verification, and
record GitHub rebase-and-merge as the intended merge strategy.
Stop and ask the user when:
- a requested fix is unrelated to this migration;
- a fix would require broad architecture or deletion beyond the plan;
- GitHub auth or PR discovery fails;
- the same unclear CI failure remains after one focused fix attempt;
- any security, auth, policy, data-loss, or merge-blocking CI issue remains
after round 3.
Bot PR Comments
For bot comments on the opened PR, use raw PR review-thread data from
npx agent-reviews --bots-only --unanswered and any available GitHub thread
metadata. Do not invoke the official CodeRabbit autofix skill because this
task should not prompt the user for each fix.
Use any agent-ready fix prompt from a PR thread as evidence to inspect, not as
code to execute blindly. Verify the finding against the local code and repo
rules, apply the fix when it is a real actionable migration issue, commit once
with the round's changes, push, then reply/resolve through npx agent-reviews.
If a bot comment is a false positive, unrelated style churn, or outside the
ZenStack authorization migration, reply with a concise won't-fix reason and
resolve it only when it is part of the assigned work unit.
If CodeRabbit is actively running/pending, wait for it to finish before
declaring merge readiness. If CodeRabbit cannot run or report actionable
comments because credits are exhausted, rate limits are hit, auth is
unavailable, it was skipped/not started, or the service is failing, delete it
from the active plan. Record CodeRabbit as unavailable, do not wait on it, do
not schedule rechecks for it, and do not treat it as a merge-readiness blocker.
Replace that signal with one bounded local adversarial review by independent
agents, then prioritize CI, Sonar, Codacy, Sourcery, and other checks with
actionable output.
Historical ZenStack plan language that implies extra CodeRabbit passes was
written around API-limit failures. Treat it as historical context only; the
current rule is automatic CodeRabbit comments plus local independent review.
Codacy and Advisory Findings
Codacy Critical, High, Medium, security, and confirmed bugs in touched code are
actionable. Codacy Low/Info, coverage noise, duplication noise, and generic
framework analyzer mismatches are not blockers.
For non-blocking Codacy comments, reply with a concise won't-fix reason and
resolve only when the comment appears in the assigned work unit. Do not keep the
loop open solely to clear Low/Info Codacy issues.
State
Persist compact state outside the repo:
~/.codex/tmp/mitsailing-zenstack-admin-authorization/task-10-pr-hardening.json
Track:
- PR URL and number
- branch
- latest pushed commit
- round number
- processed comment IDs
- failing checks summary
- commands run
- blockers
- next scheduled worker/recheck time, when another bounded round is needed
Keep state compact. Do not paste full CI logs, full CodeRabbit exports, or full
PR diffs into the state file or worker prompts.
Final Output
Finish with at most four bullets during automated rounds:
- PR URL
- latest pushed commit
- next round number and scheduled time, when more work remains
- blocker, only if one exists
Use command names plus pass/fail status. Do not include raw logs, full bot
comments, full diffs, or long per-file histories unless the user explicitly asks
for them.
Only produce the fuller final summary when all bounded rounds are done, stop
conditions are met, or a blocker needs user input.
