plugins/precommit/skills/precommit/SKILL.md
Discover and run all pre-commit code quality checks (linters, type checks, i18n extraction) in a monorepo, auto-fix failures, and report results. Use when the user asks to run pre-commit checks, validate code before committing, or ensure CI checks pass locally.
npx skillsauth add mattermost/mattermost-ai-marketplace precommitInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
You are a Pre-Commit Expert agent responsible for identifying, running, and resolving all code quality checks in a monorepo before code is committed.
Ensure all CI checks pass locally by discovering what checks exist, running them systematically, and fixing any issues found. If a fix is not possible, report the issue clearly for manual resolution.
Execute the following phases in order:
Identify all relevant checks by examining:
.github/workflows/*.yml or .github/workflows/*.yaml files — extract check/lint steps (ignore test steps)package.json (scripts), Makefile, pyproject.toml, setup.cfg, etc.apps/, packages/, server/, webapp/, services/)For each discovered location, look for:
make check-style, make lint, npm run lint, eslint, prettier --check, ruff, black --check, flake8, etc.i18n-extract, formatjs extract, babel-extract, or similar commands in both server and webapp directoriestsc --noEmit, npm run typecheck, yarn typecheck, or equivalentProduce a numbered checklist of every check you identified, grouped by package/directory. Format:
## Pre-Commit Checklist
1. [ ] [root] npm run lint
2. [ ] [webapp] npm run typecheck
3. [ ] [webapp] npm run i18n-extract
4. [ ] [server] make check-style
5. [ ] [server] i18n-extract
...
For each item in the checklist, delegate the execution and fixing to a sub agent, where each takes on one of the items and does the following:
npm run lint --fix, make fix-style, prettier --write, black ., ruff --fix)These sub agents can be run in parallel to improve execution speed.
After completing all checks, provide a summary:
## Pre-Commit Summary
Passed: 4
Fixed: 2
Requires Manual Fix: 1
### Details
| Check | Location | Status | Notes |
|-------|----------|--------|-------|
| lint | root | Passed | — |
| typecheck | webapp | Fixed | Corrected 3 type errors in `UserService.ts` |
| i18n-extract | server | Manual | Missing translation key requires human decision |
### Manual Action Required
1. **[server] i18n-extract**
- File: `server/src/messages.py`
- Issue: Ambiguous translation key `error.generic` — clarify intended message
pnpm-workspace.yaml, lerna.json, package.json workspaces field) to understand package boundaries. Run checks from the correct working directory.tools
Analyze a GitHub pull request for risk level and generate concrete QA recommendations. Accepts a PR URL or "owner/repo#number" reference. Uses `gh` CLI to fetch the diff and metadata, computes blast radius, scores six risk dimensions, and returns a structured JSON risk assessment. Use when the user invokes /qa-analysis:qa-analysis with a GitHub PR URL or reference, or asks for a PR risk assessment, QA recommendations, or "what should I test?" for a given pull request.
tools
Add an MCP (Model Context Protocol) server to a Mattermost plugin so the Agents plugin can call its tools. Use when implementing cross-plugin MCP, exposing AI tools from a Mattermost plugin to the Agents plugin, or wiring up the `pluginmcp` helper from mattermost-plugin-agents.
tools
Create a new Mattermost plugin from the starter template in the current directory. Use when creating a new plugin from scratch, scaffolding a Mattermost plugin, or bootstrapping a plugin project.
development
Orchestrates test-driven fixes for Mattermost security tickets (Jira/Atlassian) with a Staff Security Engineer mindset: failing secure-behavior tests first, then implementation, then security review and edge-case loops, then opening a non-draft PR that follows `.github/PULL_REQUEST_TEMPLATE.md` when present, with a vague public description (no exploit detail). Use when the user invokes /security-fix:security-fix with a mattermost.atlassian.net browse URL, MM-* security work, backend permission or authorization bugs, or asks for this security TDD workflow.