Ceratops gh repo lifecycle

Ceratops GH Repo Lifecycle

Goal

Route GitHub repository lifecycle work to the narrowest action reference, then follow that reference as the execution contract. Keep one live GitHub repo capability surface instead of separate skill identities for adjacent repo creation, health, dependency, security disposition, shipping, and merge actions.

Context

Action References

• Create or publish a repo: references/create-or-publish.md
• Review GitHub org, GitHub repo, PR readiness, repo-code, artifact, registry, and release contracts: references/contracts-review.md
• Validate or apply a CodeQL alert disposition: references/codeql-disposition.md
• Audit or repair repo health: references/health-audit.md
• Maintain dependency PRs or alerts: references/dependency-maintenance.md
• Push a prepared branch and ensure its PR: references/ensure-pr.md
• Ship local repo changes through GitHub: references/ship-change.md
• Finalize an already-ready PR: references/merge-pr.md

Inputs To Capture

• Target repo, local checkout, PR, branch, artifact, dependency queue, or creation request that identifies the action.
• Current CodeQL alert, exact commit, and sanitizer-path evidence when a suppression or dismissal is requested.
• Whether the work is first publication, existing repo health, dependency maintenance, prepared-branch PR publication, local change shipping, or PR finalization.
• Required live GitHub, local repo, CI, artifact, and credential context named by the selected action reference.

Infer missing inputs from local git state, gh, remotes, manifests, and live repo data before asking.

Constraints

Skill-Specific Rules

• Use the action references as the source of truth for scripts, readiness gates, cleanup rules, and output contracts.
• Keep repo creation, contract review, CodeQL disposition, repo health, dependency, PR publication, shipping, and merge behavior inside this multi-action skill and its references/ files; do not introduce alias skills or old-name shims.
• Use references/merge-pr.md for standalone PR finalization; broader shipping must reuse its readiness and merge operations through the ship helper instead of duplicating those gates.
• Run broad repo or artifact health checks only when the selected action requires them or a concrete uncertainty makes them relevant.

Boundaries

• Use this skill for GitHub repo creation or publication, CodeQL disposition, existing repo health, dependency maintenance, local repo change shipping, and PR merge or auto-merge decisions.
• If the task is skill creation, skill mutation, local skill release promotion, or staged skill remote shipping, use $ceratops-skill-lifecycle; accept its explicit ship-change handoff for GitHub publication, gates, merge, and synchronization.
• If the task is contract review rather than lifecycle execution, use references/contracts-review.md.
• If the task is general GitHub triage with no Ceratops lifecycle action, use the relevant generic GitHub capability.

Workflow

1. Classify the action

• Use create-or-publish when the repo does not yet exist publicly, needs first-time hardening, or needs first artifact publication.
• Use contracts-review when the task is explicit GitHub org, GitHub repo, PR readiness, repository-code, artifact, registry, or release contract upkeep.
• Use codeql-disposition when a current CodeQL alert may be suppressed or dismissed after exact sanitizer-path evidence.
• Use health-audit when the repo exists and the main goal is validation, stale-state cleanup, or safe health repair.
• Use dependency-maintenance when the main goal is dependency-bot PRs, dependency alerts, security updates, or dependency queue handling.
• Use ensure-pr when a clean prepared branch only needs push and PR create or update before returning to its calling lifecycle.
• Use ship-change when the repo already exists and local changes need to be completed, validated, PR'd, merged, and optionally released.
• Use merge-pr when the PR content is already ready and only PR-specific readiness, merge, and cleanup remain.

2. Close from action evidence

• Match final claims to the exact action checks and live state that were run.
• Report retained branches, worktrees, PRs, artifacts, credentials, or external side effects only when the selected action requires them.

Done When

Completion Gate

• GitHub, repo, artifact, and local-state claims are limited to the checks and live data actually verified.

Output Contract

Report only:

• selected action and final outcome
• unresolved blockers or non-blocking debt
• intentionally retained branches, PRs, artifacts, worktrees, or external side effects with reasons
• anything important not verified

Example Invocation

Use $ceratops-gh-repo-lifecycle to ship these local repo changes through GitHub, then finalize the PR once readiness gates pass.