microsoft/pr-delivery
labs/zava-learning/sre-config/agent-config/skills/pr-delivery/SKILL.md
Use to deliver a durable Zava Learning fix as a GitHub pull request once an incident has been root-caused — for either an Infrastructure-as-Code change (Bicep under infra/) or an application code change (under src/). The single skill that creates pull requests; applies after live mitigation and root-cause confirmation. The resulting PR URL is what the ServiceNow Change Request references.
$ install --global
skillsauthnpx skillsauth add microsoft/sre-agent pr-deliveryInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 23, 2026, 7:53 AM87.2s1 file scanned
SKILL.md
- api_version:
- azuresre.ai/v2
- kind:
- Skill
- name:
- pr-delivery
- description:
- Use to deliver a durable Zava Learning fix as a GitHub pull request once an incident has been root-caused — for either an Infrastructure-as-Code change (Bicep under infra/) or an application code change (under src/). The single skill that creates pull requests; applies after live mitigation and root-cause confirmation. The resulting PR URL is what the ServiceNow Change Request references.
Zava Learning — Pull Request Delivery (IaC + Code)
Single owner of GitHub pull-request creation for durable fixes. Repo: @@REPO@@
(hosts the app src/ and the infrastructure infra/). This skill applies once an incident is
root-caused and the live mitigation is in place; the pull request it produces is later referenced
by the ServiceNow Change Request (servicenow-change-management).
There is no native GitHub pull-request tool — author the branch, commit, and open the PR with
ExecutePythonCode (GitHub REST API / gh) using FindConnectedGitHubRepo and
GetIaCForGitHub to locate the repo and IaC. Never commit secrets. Before opening the PR, retrieve
SearchMemory("zava-redaction") and run its redact() over the PR title, body, and commit message
(and never stage a credential or .env/*.pem/git-credentials file into the diff).
When to use
- An incident is root-caused to a durable defect and the live mitigation is already applied.
- The fix belongs in version control: IaC (
infra/, e.g. an NSG rule ininfra/modules/network.bicep, or a value ininfra/main.parameters.json) or application code (src/, e.g. a synchronous crypto regression insrc/assessment-api/server.js).
Decide the change class
- Infrastructure (IaC): the fix is a guardrail or config in Bicep / parameters. Make BOTH live Azure and the committed IaC reflect the corrected state so the next deploy keeps the fix.
- Application code: the fix is in
src/. The live mitigation was a revision rollback/restart; the PR carries the actual code correction.
Steps
- Resolve the repo and IaC type (
FindConnectedGitHubRepo,GetIaCForGitHub). - Branch from default:
fix/<symptom-slug>(e.g.fix/quiz-launch-nsg-priority). - Apply the minimal, surgical change. Match existing style. Touch only what the root cause requires.
- Commit with a conventional message:
fix(<area>): <symptom> — <root cause>and a body that summarizes the RCA and links the PagerDuty incident. - Open the PR against
@@REPO@@. PR body must include: symptom, root cause, the change, verification evidence (link the Before/After), and the PagerDuty incident number. - Capture the PR URL — the ServiceNow Change Request (
servicenow-change-management) references it. Post the PR link back in the PagerDuty incident notes.
Out of scope (human approval required)
- Merging the PR, force-pushes, history rewrites, changes outside the root-cause fix, VNet/subnet/IAM changes.
Verification
The PR is open against the correct repo/branch with a complete RCA-backed description and a linked Change Request; CI (if any) is green. Report the PR URL.
Related Skills
microsoft/zava-reporting
development
VerifiedTrustedCommunity
Use to package a completed Zava Learning incident analysis for the audience. First present a branded in-thread executive summary (markdown with the before/after visuals inline), then produce the downloadable deliverables — a PowerPoint deck, an HTML email, and a Teams notification — using the Zava corporate template. The calling agent may narrow this to a subset (e.g. only the HTML report). Produces content and artifacts; it does not send them. Assembles the output of rca-analysis, evidence-before-after, recommendations-next-steps, and pr-delivery.
123SKILL.mdUpdated Jun 23, 2026
microsoft/zava-audit-report
development
VerifiedTrustedCommunity
Use to package a completed Zava Learning weekly governance audit (NSG / network security, RBAC / least-privilege, or cloud cost) into a single branded, downloadable PowerPoint deck in the Zava house style. The calling audit agent passes its findings (a list of rows with severity) and a short posture summary; this skill renders the deck, applies redaction, and returns the attachment download link. Produces the artifact; it does not send it.
123SKILL.mdUpdated Jun 23, 2026
microsoft/servicenow-change-management
development
VerifiedTrustedCommunity
Use whenever a Zava Learning investigation produces a durable fix that needs change management — after a GitHub PR is opened for an Infrastructure-as-Code or application code root cause, raise a ServiceNow Change Request referencing the PR and attach the RCA report. The single owner of ServiceNow Change Request and attachment operations.
123SKILL.mdUpdated Jun 23, 2026
microsoft/redaction-guard
development
VerifiedTrustedCommunity
Use whenever you are about to emit operator-visible content — a chat/thread message, a PagerDuty or ServiceNow note, a commit message or pull-request body, or any report artifact (HTML, PowerPoint, Teams card). Deterministically masks secrets, credentials, tokens, private keys, URI-embedded passwords, and PII so they never appear in the thread or in any deliverable. This is a cross-cutting guardrail invoked by the output-producing skills, not a runbook step.
123SKILL.mdUpdated Jun 23, 2026