菜单
Apply core Ruby on Rails best practices for architecture, naming, safety, and maintainability. Use for most Rails coding, refactoring, and code review tasks so baseline standards stay consistent.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Review Ruby/Rails code like DHH would - direct, opinionated, allergic to over-engineering. Use when the user runs /dhh or asks for a DHH-style review of a diff, file, or recent changes.
Apply Hotwire, Turbo, Stimulus, and ActionCable best practices for real-time Rails interfaces. Use when building Turbo Streams/Frames, Stimulus interactions, or websocket-driven updates.
Apply best practices for Rails background jobs using simple orchestration, idempotency, and safe retries. Use when creating, refactoring, or debugging Active Job and queue-backed workflows.
Write and review Rails database migrations safely, including reversible changes, lock-aware operations, and rollout sequencing. Use when adding or changing schema, indexes, constraints, or backfills.
Apply Rails security and multi-tenant safety practices including scoped queries, SSRF defenses, rate limiting, and tenant-scoped realtime updates. Use when implementing auth, webhooks, tenant boundaries, or security-sensitive endpoints.
Apply Rails testing standards with Minitest, fixtures, and pragmatic coverage boundaries. Use when creating tests, reviewing test quality, or improving flaky and slow Rails test suites.
| name | rails-best-practices-core |
| description | Apply core Ruby on Rails best practices for architecture, naming, safety, and maintainability. Use for most Rails coding, refactoring, and code review tasks so baseline standards stay consistent. |
Use this as the default baseline for Rails work. Distilled from 37signals codebases (Campfire, Fizzy) and DHH's review patterns.
dependent: :delete_all when no callbacks needed).params.expect(...) for strong params in modern Rails.create!), handle exceptions at boundaries. Only use ! when a non-bang counterpart exists.enqueue_after_transaction_commit over retry logic for races).closed: boolean, create a Closure record with creator and timestamps. You get who/when for free, and scoping is trivial:has_one :closure, dependent: :destroy
scope :closed, -> { joins(:closure) }
scope :open, -> { where.missing(:closure) }
Closeable, Watchable, Assignable), each self-contained (associations + scopes + methods), ~50-150 lines, cohesive. Prefer nested modules under the model's namespace (Card::Closeable in app/models/card/closeable.rb) for domain slices; reserve app/models/concerns/ for genuinely cross-model behavior. Never extract concerns containing only private methods.app/models/, not app/services/: presentation objects (Event::Description), complex operations (SystemCommenter), view-context bundles (User::Filtering). They're model-adjacent, not controller-adjacent.belongs_to :creator, class_name: "User", default: -> { Current.user }; belongs_to :account, default: -> { board.account }.Current.user, Current.account), with cascading setters (assigning session resolves identity, which resolves user for the account).normalizes (data cleanup before validation), store_accessor (JSON columns), delegated_type (heterogeneous collections), generates_token_for (expiring signed tokens), string enums via enum :status, %w[drafted published].index_by(&:itself), after_save_commit, touch: true chains for cache invalidation, delegate.grant_to/revise on the has_many proxy; use insert_all for bulk creates and dependent: :delete_all on join tables with no callbacks.to_param with a per-tenant number rather than exposing raw IDs/UUIDs.Closure beats CardClose; Mention beats UserReference.active not not_deleted, visible not not_hidden.belongs_to :creator, class_name: "User" not belongs_to :user.quota.depleted? not quota.over_limit?.:active, :unassigned, :golden — not SQL-ish :without_pop.source/resource/container for one concept.resource :closure (POST closes, DELETE reopens); publish → resource :publication. No custom member actions.resource for one-per-parent state; scope module: to group nested controllers (Cards::ClosuresController); shallow nesting for deep hierarchies.CardScoped sets @card via Current.user.accessible_cards.find_by!(...)) shared across nested controllers, including shared Turbo render helpers.resolve "Comment" for polymorphic URL generation to the parent with an anchor.respond_to — no separate API namespace.card.editable_by?(user), user.can_administer_board?(board)).head :forbidden unless ...), models define what the permission means.allow_unauthenticated_access, ensure_can_administer.Before adding a gem ask: can vanilla Rails do this? Is 50-150 lines in-repo simpler than a dependency? Commonly skipped: Devise, Pundit, ViewComponent, RSpec, FactoryBot, Redis (Solid Queue/Cache/Cable use the DB), service objects, form objects, decorators, GraphQL, SPA frameworks, Tailwind.
Comment.find(params[:id]))..map(&:name) where .pluck(:name) works).fresh_when/etag) — stale CSRF tokens cause 422s.status == "x") when predicate-style APIs are available (StringInquirer / string enums).validates :x, uniqueness: true without a backing unique index.html_safe strings — escape first: "<b>#{h(input)}</b>".html_safe.Ship it or a short prioritized fix list.