arash77

Galaxy project development conventions and skill routing guide. ALWAYS load this skill when working in a Galaxy codebase. Routes to appropriate skills: use /galaxy-db-migration for database/Alembic/schema changes, /galaxy-api-endpoint for creating REST API endpoints/FastAPI routers, /galaxy-testing for running or writing tests, /galaxy-linting for code formatting/linting/type checking. Use galaxy-explorer agent for codebase architecture questions.

Galaxy code linting, formatting, and type checking. Run checks, auto-fix formatting, Python lint, client lint, mypy type checks. Use for: ruff, flake8, black, isort, darker, autoflake, pyupgrade, eslint, prettier, mypy, tox, make format, make diff-format, code style, lint failures, CI lint checks, formatting errors, type errors, codespell, redocly, api schema, xsd, config lint.

Create Galaxy REST API endpoints with FastAPI routers, Pydantic schemas, and manager pattern. Use for: new API routes, FastAPI endpoints, REST resources, Pydantic request/response models, lib/galaxy/webapps/galaxy/api routers, lib/galaxy/schema definitions, API controller creation.

Galaxy database migration with Alembic - create schema changes (add table/column), upgrade/downgrade database versions, check migration status, troubleshoot errors. Use for: SQLAlchemy model changes, database schema modifications, Alembic revisions, migration version conflicts, lib/galaxy/model changes.

Galaxy testing with pytest and run_tests.sh - run/write unit, integration, API, selenium tests. Use for: test execution, test failures, pytest errors, ApiTestCase patterns, test fixtures, writing new tests, debugging test failures, test/integration, lib/galaxy_test/api tests. CRITICAL: Always use ./run_tests.sh, never pytest directly.

Generate production-hardened GitHub Actions CI/CD workflows enforcing least-privilege permissions, concurrency groups, timeout guards, dependency caching, and latest major version action tags. Always co-generates a .github/dependabot.yml. Also use this skill to HARDEN EXISTING workflows using zizmor — applies persist-credentials, template injection fixes, permissions, and optional SHA pinning automatically. Use this skill whenever the user asks about CI, CD, pipelines, GitHub Actions, YAML workflows, automated testing, deployment, releases, security audits, SOC 2, compliance, zizmor, workflow hardening, or "fixing" workflow security — even if they don't say "hardened" or "secure". Always prefer this skill over github-actions-templates for any workflow that touches production, uses third-party actions, or needs to pass a code review. Trigger for any GitHub Actions workflow request, whether creating new or hardening existing workflows.

Generate production-hardened GitHub Actions CI/CD workflows enforcing least-privilege permissions, concurrency groups, timeout guards, dependency caching, and latest major version action tags. Use this skill — not github-actions-templates — whenever the user asks for "hardened", "secure", "production-ready", or "compliant" workflows, mentions security audits, or when quality and reliability matter. Always co-generates a .github/dependabot.yml. Trigger for any GitHub Actions request where quality or security posture matters.