菜单
Use for GitHub repo operations via the gh CLI — issue triage, PR and CI management, releases, Dependabot — plus CODEOWNERS, reusable workflows, and monorepo path filtering. For operational tasks beyond plain git.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Create one verified Linear issue from a Codex Agent Task v1 contract and optionally dispatch it under separate explicit authority. Use when a user asks Codex to create a Linear implementation issue for a repository handled by a mapped Symphony workflow.
Use when designing agent tool schemas, action spaces, or observation formatting, or when diagnosing looping and low completion rates in an agent harness.
Use when an agent is looping, retrying without progress, drifting from its goal, or failing repeatedly — structured capture, diagnosis, contained recovery, and introspection reports.
Use when orchestrating agent workflows — eval-first execution, task decomposition, and cost-aware model routing decisions.
Eval-first AI/ML engineering — RAG decisions, finetune-vs-RAG-vs-prompt framework, prompt-injection defense, structured output, model routing/cost, production drift. Use when working on evals, prompts, RAG, or model optimization.
Use when designing or reviewing an HTTP/RPC API surface — resource modeling, pagination, error envelopes, versioning, idempotency. Falsifiable contracts, not style preferences.
| name | github-ops |
| description | Use for GitHub repo operations via the gh CLI — issue triage, PR and CI management, releases, Dependabot — plus CODEOWNERS, reusable workflows, and monorepo path filtering. For operational tasks beyond plain git. |
Manage repositories for CI reliability, community health, and contributor experience. Everything here is a gh CLI command or a workflow-config pattern.
Types: bug, feature-request, question, documentation, enhancement, duplicate, invalid, good-first-issue Priority: critical (breaking/security), high (significant impact), medium (nice to have), low (cosmetic)
Read title + body + comments → search for a duplicate → label → act (answer questions, request a repro for under-specified bugs, link the original on duplicates).
gh issue list --search "keyword" --state all --limit 20 # dedup before triaging
gh issue edit <n> --add-label "bug,high-priority"
gh issue comment <n> --body "Thanks — could you share reproduction steps?"
Review order: CI status → mergeable → age / last activity → tests-and-conventions for community PRs. Flag any PR older than 5 days with no review.
gh pr checks <n> # CI state
gh pr view <n> --json mergeable,reviewDecision,updatedAt
stale, comment asking for an update.closed-stale).Compute cutoffs relative to now — never hardcode a date that rots:
# PRs untouched for 30+ days (jq derives the cutoff from now)
gh pr list --json number,title,updatedAt \
--jq '.[] | select(.updatedAt < (now - 86400*30 | strftime("%Y-%m-%dT%H:%M:%SZ")))'
On failure: read the failing step, decide flaky vs real, fix the root cause — don't blind-rerun.
gh run list --status failure --limit 10
gh run view <run-id> --log-failed # jump straight to the failing step
gh run rerun <run-id> --failed # only after you know it's flaky
Green main → review merged PRs → generate notes → tag.
# Merged since last month — BSD/macOS date; on GNU/Linux use --date='-1 month'
gh pr list --state merged --base main --search "merged:>$(date -v-1m +%Y-%m-%d)"
gh release create v1.2.0 --title "v1.2.0" --generate-notes
gh release create v1.3.0-rc1 --prerelease --title "v1.3.0 RC1"
gh api repos/{owner}/{repo}/dependabot/alerts --jq '.[].security_advisory.summary'
gh api repos/{owner}/{repo}/secret-scanning/alerts --jq '.[].state'
gh pr list --label "dependencies" --json number,title
Auto-merge safe bumps; escalate critical/high advisories immediately; sweep alerts weekly.
Lives in .github/CODEOWNERS. Each line is path-pattern @owner… using gitignore glob syntax.
* @org/maintainers line guarantees every path has an owner; tighter rules below override it.* @org/maintainers # fallthrough owner
/docs/ @org/writers # docs team owns docs
/infra/*.tf @org/platform # last match wins over the two above
| Reusable workflow | Composite action | |
|---|---|---|
| Reuse unit | Whole job(s) | A block of steps inside a job |
| Invoked at | Job level (uses: under a job) | Step level (uses: in steps:) |
| Secrets | secrets: inherit or pass explicitly | Inherits the caller job's env; no secrets block |
| Declared by | on: workflow_call | runs.using: "composite" |
Reach for a reusable workflow to share a whole pipeline (build + test + deploy) across repos; a composite action to share a step sequence (setup-lang → cache → install) inside one job. Version-pin shared workflows and actions to a full commit SHA (uses: org/repo/.github/workflows/ci.yml@<sha>) — a floating @main lets one upstream change break every consumer at once.
Skip a whole workflow when the touched paths don't matter:
on:
push:
paths: ["services/api/**", ".github/workflows/api.yml"]
For per-job gating inside one workflow, run dorny/paths-filter and branch on its boolean outputs.
The required-check trap: a path-filtered required check that gets skipped posts no status, so the PR blocks forever waiting on a check that will never report. Fixes: (a) keep the check required but add a no-op job of the same name that reports success on the filtered-out paths, or (b) drop it from required checks and lean on GitHub's merge-queue / expected-status config instead. Never mark a path-filtered job required without one of these.
Before calling a GitHub task done: