Move component-docs skill entry to correct alphabetical position between
commit and create-branch to maintain consistent ordering with README.md.
Co-Authored-By: Claude <noreply@anthropic.com>
Co-authored-by: Jonas <JonasBa@users.noreply.github.com>
Add a prop triage table to Step 0 that guides the agent to ask the user
which props are worth documenting and classifies props into four tiers:
core (full demo section), modifier (brief mention), structural (compound
usage), and internal/pass-through (skip).
Also adds a note specifically for enum props to surface whether each
value has distinct semantic meaning beyond visual difference.
Co-Authored-By: Claude <noreply@anthropic.com>
Adds a new skill that guides an agent through creating or updating
component documentation in Sentry's .mdx stories format.
The skill covers the full authoring workflow:
- Step 0: Gather editorial content (when to use, alternatives, variant
semantics, common mistakes, required setup) before writing
- Step 1: Locate the component and determine the correct import paths
- Step 2: Frontmatter structure with category table and resource fields
- Step 3: Import order convention and type-loader usage
- Step 4: Content structure by feature/variant with demo patterns,
sub-component docs, accessibility section, and See Also format
- Step 5: Manual props table for product components without type-loader
Co-Authored-By: Claude <noreply@anthropic.com>
* docs: list all available skills
* docs(skills): Align registration guidance and skill allowlists
Require alphabetical ordering when updating the Available Skills table\nin contributor guidance and skill creation workflow docs.\n\nSynchronize skill allowlists with the actual sentry-skills directory so\nautomatic skill injection guidance reflects all available skills.\n\nCo-Authored-By: GPT-5 Codex <noreply@openai.com>
---------
Co-authored-by: shuofengzhang <sofuncheung16@gmail.com>
* ref(skills): Rename PR and skill authoring workflows
Promote pr-writer and skill-writer as canonical skill names while\nkeeping create-pr and skill-creator as compatibility aliases.\n\nUpdate skill registration, settings allowlists, and documentation\nreferences to prefer canonical names.\n\nExtend skill-writer guidance with capability-first naming practices\nand examples for clearer skill discovery.
Co-Authored-By: GPT-5 Codex <noreply@openai.com>
* fix(skills): Address review bot feedback on skill rename
Restrict skill-writer with an explicit allowed-tools frontmatter field,\nremove dead code in quick_validate, and delete orphaned duplicate\nreferences/scripts from the skill-creator alias directory to avoid drift.
Co-Authored-By: GPT-5 Codex <noreply@openai.com>
* fix(skills): Drop allowed-tools from skill-writer
Keep skill-writer frontmatter compatible across clients by avoiding\nthe optional allowed-tools field while retaining the other review\nfixes in this PR.
Co-Authored-By: GPT-5 Codex <noreply@openai.com>
* docs(skill-writer): Default to omitting allowed-tools
Clarify that skill authoring should avoid allowed-tools unless a user\nexplicitly requests strict tool scoping or repo policy requires it,\nsince allowlist syntax differs across clients.
Co-Authored-By: GPT-5 Codex <noreply@openai.com>
* docs(pr-writer): Include update flows in skill discovery text
Expand pr-writer trigger language to explicitly cover updating PR artifacts\nlike title and description, not only creating a new PR.\n\nAlso align the README skill table description so repository docs\nmatch the canonical skill wording.
Co-Authored-By: GPT-5 Codex <noreply@openai.com>
---------
Co-authored-by: GPT-5 Codex <noreply@openai.com>
Replace git config user.name lookup with gh api user --jq .login so the
branch prefix always matches the user's actual GitHub handle.
Co-Authored-By: Claude <noreply@anthropic.com>
Add a new skill for reviewing GitHub Actions workflows for security
vulnerabilities, covering expression injection, pwn requests, supply
chain attacks, credential escalation, and AI prompt injection via CI.
Includes reference documentation for all major GHA attack vectors.
Also updates AGENTS.md to the concise agent-instructions format and
registers the new skill in settings and the claude-settings-audit allowlist.
Co-Authored-By: Claude <noreply@anthropic.com>
Replace skill-discovery focus with project-analysis approach. Add line
budget guidance (target 60, max 100), file-scoped commands section,
and anti-patterns for linter duplication. Remove Local Skills required
section since agents discover skills automatically. Rewrite AGENTS.md
for this repo to follow the updated guidance.
Co-authored-by: Claude <noreply@anthropic.com>
Reduce SKILL.md from 446 to 186 lines (58%) by removing content that
was duplicated across sections or controlled by Warden. Modeled after
the sentry-security skill structure (Step 1-4 pattern).
Removed: Phase 1 (file discovery, Warden provides files), Phase 2
(duplicate of Reference Files table), Phase 4 (duplicate of Core
Principles), Phase 5 (duplicate of validation section), Quick Patterns
Reference (duplicates safe patterns table + reference files),
Attacker-Controlled Expressions table (moved to reference file),
standalone Severity Model (replaced with confidence model), and ~10
inline repetitions of the external attacker concept.
Added confidence model (HIGH/MEDIUM/LOW) matching sentry-security
pattern. Moved attacker-controlled expressions quick reference table
to references/expression-injection.md where it belongs.
Co-Authored-By: Claude <noreply@anthropic.com>
Agent transcript: https://claudescope.sentry.dev/share/spByNq2HxKsjIIoMtNrC7sncSkRu68d6dqVVv7xZ4k0
Refine the skill to reduce false positives:
- Add "external attacker threat model" principle: only report vulns
exploitable without write access. workflow_dispatch input injection,
push-to-protected-branch expression injection, and schedule-only
secrets are not findings.
- Add "validate before reporting" principle: require reading the actual
workflow YAML and tracing every link in the attack chain before
reporting. Pattern matching alone is not enough.
- Expand Phase 5 into a structured validation gauntlet (prove attack
path, check mitigations, confirm impact) with a table of checks
that must pass before a finding is reported.
- Move workflow_dispatch inputs and commit messages on push to the
"safe expressions" table with rationale.
- Add "Do NOT Flag" and "Not a finding" sections to quick patterns
and severity model.
- Update expression-injection.md to mark workflow_dispatch as not a
finding and add nuance to commit message injection.
Co-Authored-By: Claude <noreply@anthropic.com>
Agent transcript: https://claudescope.sentry.dev/share/lxT27jHfwxvYtwFoKykzZV-XILSBNXhdMCKRNCjKvFY
Replace the complex stash state machine with concise, principle-based
instructions that trust the agent's judgment. Fixes the bug where
git stash pop ran unconditionally on checkout failure even when no
changes were stashed.
Co-Authored-By: Claude <noreply@anthropic.com>
Detect the primary remote by preferring "origin" if it exists rather than
taking the first alphabetical remote. Also instruct the agent to restore
the stash if the user cancels at any point after stashing, preventing
changes from being silently left in the stash.
Co-Authored-By: Claude <noreply@anthropic.com>
Add instructions to restore stashed changes if `git checkout <default-branch>`
fails or if `git checkout -b <branch-name>` fails, so the user's work is
never silently left in the stash when an error occurs.
Co-Authored-By: Claude <noreply@anthropic.com>
Reword the collision block to make it unambiguous that the user is always
asked to choose a different name when a collision is detected, whether or
not changes were stashed, preventing the agent from skipping the collision
path and attempting to create an already-existing branch.
Co-Authored-By: Claude <noreply@anthropic.com>
When a collision is detected and changes were stashed, restore the stash
and clear the stashed flag before returning to Step 4, so the final
restore step does not attempt a second stash pop on a new name attempt.
Co-Authored-By: Claude <noreply@anthropic.com>
Detect the primary remote via `git remote | head -1` and use it for
default-branch detection and remote branch existence checks, so repos
with a non-origin primary remote (e.g. upstream forks) work correctly.
Co-Authored-By: Claude <noreply@anthropic.com>
- Strip trailing whitespace from default branch detection output
- Clarify abort path: stop skill if user aborts stash prompt
- Restore stash before informing user of branch name collision
- Add re-check in commit skill to verify branch changed before committing
Co-Authored-By: Claude <noreply@anthropic.com>
- Check refs/remotes/origin/ in addition to refs/heads/ to detect remote branch collisions
- Clarify in commit skill that create-branch still proposes a name for confirmation;
only the decision to create a branch at all is skipped
Co-Authored-By: Claude <noreply@anthropic.com>
After switching to the default branch and creating a new branch,
run git stash pop to restore any changes that were stashed earlier
in the workflow.
Co-Authored-By: Claude <noreply@anthropic.com>
Use git show-ref with refs/heads/ to only match local branches,
not remote branches or tags, before creating a new branch.
Co-Authored-By: Claude <noreply@anthropic.com>
- Use git diff without --stat so agent reads actual content, not just filenames
- Strip non-ASCII characters from username prefix to ensure valid branch names
- Ask user when both main and master exist instead of blindly defaulting to main
Co-Authored-By: Claude <noreply@anthropic.com>
When the user chooses to switch to the default branch first, the skill
was missing the git checkout step, causing the new branch to be created
from the wrong base.
Co-Authored-By: Claude <noreply@anthropic.com>
When git branch --show-current returns empty, detect the detached HEAD
and show the current commit, so the user understands their state before
choosing where to branch from.
Co-Authored-By: Claude <noreply@anthropic.com>
When neither main nor master exists, defaulting to main would cause
git checkout to fail. Ask the user instead.
Co-Authored-By: Claude <noreply@anthropic.com>
Replace the inline branch naming logic with a reference to the
create-branch skill to ensure consistent naming conventions across both skills.
Co-Authored-By: Claude <noreply@anthropic.com>
Reorder Step 5 so the default branch is detected before it's used
in the non-default branch check. Replace the vague fallback with a
concrete `git branch --list main master` command, explicit precedence
rules (main > master > fallback to main), and add `git branch
--show-current` to retrieve the current branch name for the comparison.
Co-Authored-By: Claude <noreply@anthropic.com>
Adds a new skill that creates git branches following Sentry naming
conventions. Detects the username from git config, inspects local
changes or prompts for context, classifies the work type, and
proposes a branch name before creating it.
Co-Authored-By: Claude <noreply@anthropic.com>
gh pr checks exits non-zero when any check is failing or pending, so
check=True raises CalledProcessError and discards all check data.
Remove it to allow parsing output regardless of exit code.
Co-Authored-By: Claude <noreply@anthropic.com>
Change PR review reply signature from bullet point (`- Claude Code`) to
italic format (`*— Claude Code*`) for better visual separation. Also
improves duplicate detection to match both hyphen and em-dash variants.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Without check=True, subprocess.run silently succeeds even when gh
returns non-zero, making the CalledProcessError handler dead code.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The get_checks() function was using an unsupported --json flag with
gh pr checks. Replace with direct subprocess call that parses the
tab-separated text output format (name, status, duration, URL).
Co-Authored-By: Claude <noreply@anthropic.com>
Thread GraphQL node IDs through to the feedback JSON so the agent can
reply to inline review comments acknowledging what action was taken.
Adds reply instructions to SKILL.md Step 3 with duplicate protection
and graceful failure handling.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(iterate-pr): Improve fix thoroughness and replace blocking CI wait
Strengthen the iterate-pr skill to produce more reliable fixes and use
CI wait time productively:
- Require root-cause analysis for both review feedback and CI failures
instead of surface-level fixes
- Add local verification step before pushing (re-run failed tests,
linters, type checkers)
- Replace blocking `gh pr checks --watch` with active polling loop
that addresses review feedback while CI runs
- Reduce retry limit from 3 to 2 to pressure thorough first attempts
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(iterate-pr): Clarify step 8 repeat logic per review feedback
Step 7's polling loop already handles CI failures internally (sub-step
3 routes back to step 5). Step 8 only needs to cover the case where
post-CI feedback required code changes and a fresh cycle is needed.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Add blog-writing-guide to the settings.json allowlist, README skills
table, and claude-settings-audit allowlist so the skill is discoverable
and usable after merge.
Co-Authored-By: Claude <noreply@anthropic.com>
The skill referenced `references/writing-guide.md` three times but the
file was never created. Remove the references since the checklists and
post type templates are already documented inline in SKILL.md.
Co-Authored-By: Claude <noreply@anthropic.com>
Cursor Agent