Github contribution workflow

Skill wei18/apple-dev-skills/collaboration-skills/skills/github-contribution-workflow

Author GitHub contributions with the gh CLI — open/merge PRs, open issues, create/edit files on GitHub, set repo secrets, configure contribution-flow repo settings. Use when running `gh pr create` / `gh pr merge` / `gh pr checks` / `gh issue create` / `gh secret set` / `gh api`, checking CI before merge, or bumping a submodule pin. Covers Conventional branch/PR-title conventions, Co-Authored-By trailer + 🤖 footer, squash+delete merge, CLEAN-before-merge, `gh secret set` without --body, `git update-index` submodule bumps, the --no-verify rule. Does NOT cover pure local git, diff-vs-commit verification (→ pr-diff-verification), security repo settings (→ apple-public-repo-security), worktree conflicts (→ subagent-conflict-detection), plugin distribution (→ claude-skill-plugin-packaging).From its SKILL.md

Install

npx -y skills add wei18/apple-dev-skills --skill github-contribution-workflow

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

6.9 KB, ~1.6k tokens by cl100k_base, as published. Nobody here has run it

GitHub Contribution Workflow

The gh-CLI contribution loop for an agent acting on a GitHub repo: branch → commit → PR → CI → merge, plus issues, GitHub-side file ops, repo secrets, and contribution-flow repo settings. Encodes conventions that keep an agent's contributions reviewable and consistent. Tool-agnostic in spirit; concrete commands are gh + git.

When to invoke

Opening or merging a PR; opening or commenting on an issue.
Creating or editing a file through GitHub (API / web flow) rather than a local clone.
Setting a repo secret or configuring contribution-flow repo settings.
Checking CI status before a merge; bumping a submodule pin.
User says "open a PR / issue", "merge this", "set the secret", "configure the repo".

Scope — what this does NOT own (route to sibling)

Verifying the diff matches the commit's claims before push/PR → pr-diff-verification.
Security repo settings (Secret Scanning, push protection, gitleaks, .gitignore baseline) → apple-public-repo-security.
Parallel-session / submodule worktree conflicts → subagent-conflict-detection.
Distributing or installing skill plugins (marketplace, depth-1 rule) → claude-skill-plugin-packaging.
Pure local git with no GitHub surface → out of scope.

Intent → command

Intent	Command
Open a PR	`gh pr create --title "<conventional title>" --body "<body + 🤖 footer>"`
Check CI before merge	`gh pr checks <n> --repo <o/r>` ; `gh pr view <n> --json mergeStateStatus`
Merge a PR	`gh pr merge <n> --squash --delete-branch` (only when status is `CLEAN`)
Open an issue	`gh issue create --title "<title>" --body "<body>"`
Comment on an issue	`gh issue comment <n> --body "<text>"`
Create/edit a file via GitHub	`gh api -X PUT repos/<o/r>/contents/<path> -f message=… -f content=$(base64) …` (no local clone needed)
Set a repo secret	`gh secret set <NAME> --repo <o/r>` (interactive paste; see Conventions)
List secrets	`gh secret list --repo <o/r>` (names only; values are write-only)
Configure merge / branch protection	`gh api -X PATCH repos/<o/r> -F allow_squash_merge=true -F delete_branch_on_merge=true` ; `gh api -X PUT repos/<o/r>/branches/<b>/protection …`

Conventions

Branch names use Conventional prefixes: feat/ fix/ chore/ docs/ ci/ refactor/ test/.
PR titles follow Conventional Commits (some repos enforce this with a CI gate — e.g. a "Validate PR title" check; a non-conforming title fails the PR).
Commit trailer: end commit messages with the agreed Co-Authored-By: trailer. PR body: end with the 🤖 footer.
Merge: --squash --delete-branch. Never merge unless gh pr checks / mergeStateStatus is CLEAN. BLOCKED is usually just pending required checks, not a failure — poll until they finish, don't force-merge.
Secrets: gh secret set <NAME> without --body — the interactive prompt keeps the value out of shell history. Never gh secret set X --body "$TOKEN". Verify presence (not value) with gh secret list.
Submodule pin bump: set the gitlink surgically with git update-index --cacheinfo 160000,<commit-sha>,<submodule-path> — no submodule checkout needed (works in a fresh worktree). Confirm the target SHA is pushed/tag-reachable on the submodule's remote first (git ls-remote --tags <url> <tag>).
--no-verify: allowed ONLY for a commit with no code and no secrets (a submodule-pin bump, a .gitmodules/config-only change) when the repo's pre-commit gate is heavy and times out. Never for code or content commits — those must pass the hooks.
Shared repo / submodule: edit via an isolated worktree branched from origin/main + PR, never in place — see subagent-conflict-detection.

Repo settings (contribution-flow only)

This skill owns the contribution-flow repo config: merge-button policy (allow_squash_merge, delete_branch_on_merge), branch protection requiring CI, required status checks, and labels. Security settings (Secret Scanning, push protection) are owned by apple-public-repo-security — set them there, not here.

Common Mistakes

Merging on a non-CLEAN status — treating BLOCKED (pending checks) as a failure, or force-merging past a real red check. Poll; merge only on CLEAN.
gh secret set --body "$TOKEN" — leaks the token into shell history. Use the interactive prompt.
Non-Conventional PR title — fails a repo's title-lint gate; the PR can't merge.
Editing a shared repo / submodule in place — two writers clobber each other; use a worktree + PR.
--no-verify on a code/content commit — bypasses the gate that protects the repo. Reserve it for no-code/no-secret commits only.
Hand-editing a submodule's checked-out files from the parent repo — bump the pin instead (git update-index --cacheinfo), and land the submodule's own change via its own PR.
Duplicating a sibling's job — re-doing diff verification, security settings, or worktree conflict checks here instead of routing to the owning skill.

Review Checklist

Branch name uses a Conventional prefix; PR title is Conventional Commits.
Commit carries the Co-Authored-By: trailer; PR body ends with the 🤖 footer.
gh pr checks is CLEAN before merge; merged with --squash --delete-branch.
Any secret was set via interactive gh secret set (no --body); verified with gh secret list.
A submodule bump used git update-index --cacheinfo against a remote-reachable SHA.
--no-verify used only on a no-code/no-secret commit, with the reason stated.
Shared-repo/submodule edits went through a worktree + PR.
Nothing here duplicates a sibling skill's scope.

Related skills

pr-diff-verification — verify git show --stat HEAD matches the commit's claims before push/PR.
apple-public-repo-security — security repo settings + secret-leak prevention.
subagent-conflict-detection — worktree + PR flow for parallel sessions / submodules.
claude-skill-plugin-packaging — distributing/installing skill plugins.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.