fatby/merge-pr
skills/agent-merge-pr/SKILL.md
Script-first deterministic squash merge with strict required-check gating, head-SHA pinning, and reliable attribution/commenting.
$ install --global
skillsauthnpx skillsauth add fatby/duncrew merge-prInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 4, 2026, 10:31 PM4.2s2 files scanned
SKILL.md
- name:
- merge-pr
- description:
- Script-first deterministic squash merge with strict required-check gating, head-SHA pinning, and reliable attribution/commenting.
- version:
- 1.0.0
- author:
- DunCrew
- emoji:
- 🔧
- primaryEnv:
- shell
Merge PR
Overview
Merge a prepared PR only after deterministic validation.
Inputs
- Ask for PR number or URL.
- If missing, use
.local/prep.envfrom the PR worktree.
Safety
- Never use
gh pr merge --autoin this flow. - Never run
git pushdirectly. - Require
--match-head-commitduring merge. - Wrapper commands are cwd-agnostic; you can run them from repo root or inside the PR worktree.
Execution Contract
- Validate merge readiness:
scripts/pr-merge verify <PR>
Backward-compatible verify form also works:
scripts/pr-merge <PR>
- Run one-shot deterministic merge:
scripts/pr-merge run <PR>
- Ensure output reports:
merge_sha=<sha>merge_author_email=<email>comment_url=<url>
Steps
- Validate artifacts
require=(.local/review.md .local/review.json .local/prep.md .local/prep.env)
for f in "${require[@]}"; do
[ -s "$f" ] || { echo "Missing artifact: $f"; exit 1; }
done
- Validate checks and branch status
scripts/pr-merge verify <PR>
source .local/prep.env
scripts/pr-merge treats “no required checks configured” as acceptable ([]), but fails on any required fail or pending.
- Merge deterministically (wrapper-managed)
scripts/pr-merge run <PR>
scripts/pr-merge run performs:
- deterministic squash merge pinned to
PREP_HEAD_SHA - reviewer merge author email selection with fallback candidates
- one retry only when merge fails due to author-email validation
- co-author trailers for PR author and reviewer
- post-merge verification of both co-author trailers on commit message
- PR comment retry (3 attempts), then comment URL extraction
- cleanup after confirmed
MERGED
- Manual fallback (only if wrapper is unavailable)
scripts/pr merge-run <PR>
- Cleanup
Cleanup is handled by run after merge success.
Guardrails
- End in
MERGED, neverCLOSED. - Cleanup only after confirmed merge.
Related Skills
fatby/web-search
tools
VerifiedTrustedCommunity
Use the webSearch tool to find information online.
3SKILL.mdUpdated Apr 4, 2026
fatby/weather
development
VerifiedTrustedCommunity
Query weather information for any location.
3SKILL.mdUpdated Apr 4, 2026
fatby/wacli
tools
VerifiedTrustedCommunity
Send WhatsApp messages to other people or search/sync WhatsApp history via the wacli CLI (not for normal user chats).
3SKILL.mdUpdated Apr 4, 2026
fatby/voice-call
tools
VerifiedTrustedCommunity
Start voice calls via the OpenClaw voice-call plugin.
3SKILL.mdUpdated Apr 4, 2026