The original draft missed `.claude/skills/github-workflow-automation/SKILL.md`
(23KB, last touched 2026-04-06) in the dogfood-layer count. Fix the
inventory line in §Context so Phase 1 + Phase 3 work targets the correct
set of files.
Co-Authored-By: RuFlo <ruflo-bot@users.noreply.github.com>
Proposes a 4-phase modernization of the .github-related skills, commands,
agents, and init-template surface, grounded in patterns already shipped:
the static-contract smoke pattern from #2017 / #1922 / #2086, the
5-layer supply-chain audit in scripts/audit-supply-chain.mjs, and the
opt-in attribution refactor from #2079.
Top three gaps the research found:
1. swarm-pr.md and swarm-issue.md interpolate \${{ github.event.comment.body }}
into shell unquoted — the same class of silent-failure that #2017 fixed.
2. ruvnet/swarm-action@v1 (first-party) ships unpinned; the supply-chain
audit covers 5 npm layers but zero .yml \`uses:\` references.
3. 19 GitHub command files inject attribution footers unconditionally,
ignoring the opt-in toggle that #2079 added in settings-generator.
Tracking issue: #2089.
Co-Authored-By: RuFlo <ruflo-bot@users.noreply.github.com>
ruv