nixopus/github-workflow
skills/github-workflow/SKILL.md
Fix-via-PR workflow, file operations, connector resolution, and GitHub safety rules. Load when performing GitHub operations like creating branches, PRs, or file changes.
$ install --global
skillsauthnpx skillsauth add nixopus/agent github-workflowInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 22, 2026, 11:55 PM156.3s1 file scanned
SKILL.md
- name:
- github-workflow
- description:
- Fix-via-PR workflow, file operations, connector resolution, and GitHub safety rules. Load when performing GitHub operations like creating branches, PRs, or file changes.
- version:
- 1.0
GitHub Workflow
Connector Resolution
When a connectorId is provided in the delegation message, use that connector_id when calling get_github_repositories to list repos from the correct GitHub account. If no connectorId is provided and there are multiple connectors, use get_github_connectors to list them and pick the first one with valid credentials, then use its ID for get_github_repositories.
File Write Capabilities
- github_create_or_update_file: Create or update a single file. To update, first read the file with github_get_repo_file to get its current sha, then pass that sha. To create a new file, omit sha.
- github_create_branch: Create a new branch from a commit SHA. Use get_github_repository_branches to find the source branch HEAD SHA.
- github_create_pull_request: Open a PR from a head branch into a base branch.
Fix-via-PR Flow
When asked to fix a file in a repo:
- Call github_get_branch with the default branch name (e.g. "main") to get its HEAD commit SHA.
- Create a fix branch with github_create_branch using that SHA (e.g. branch name "nixopus/fix-dockerfile").
- Read the file to fix with github_get_repo_file on the default branch to get its content and blob sha.
- Write the fixed file with github_create_or_update_file targeting the fix branch, passing the blob sha from step 3.
- Create a PR with github_create_pull_request from the fix branch into the default branch.
- Ask the user to review and merge the PR. Once merged, the changes land on the default branch.
- After the PR is merged, call redeploy_application to pick up the changes from the default branch. Return the PR URL, PR number, and fix branch name to the parent agent in your final message. Never say work is "underway" or that you will send the link later.
Branch Limitation
The application's branch is set at creation time via create_application and CANNOT be changed via update_application. The app always deploys from its configured branch (usually main/master). This is why you MUST use the branch → PR → merge → redeploy flow: changes go to a feature branch, get merged into the default branch via PR, then redeploy picks them up.
GitHub Safety — NON-NEGOTIABLE
- NEVER commit or push directly to main/master. The tool will reject it. Always create a feature branch → commit there → open a PR.
- Never merge PRs unless user explicitly requests. Return PR URL.
- No destructive ops (force push, branch delete, PR close) without user approval.
Related Skills
nixopus/api-catalog
tools
VerifiedTrustedCommunity
Compressed catalog of all Nixopus API operations for the nixopus_api() tool
1SKILL.mdUpdated Apr 26, 2026
nixopus/static-deploy
development
VerifiedTrustedCommunity
Deploy static file sites — Caddy/nginx serving, Staticfile config, and Dockerfile patterns. Use when deploying a static HTML site with no server-side runtime, or when index.html or a Staticfile is detected at the project root.
1SKILL.mdUpdated Apr 22, 2026
nixopus/shell-deploy
devops
VerifiedTrustedCommunity
Deploy shell script applications — interpreter detection, setup scripts, and Dockerfile patterns. Use when deploying a shell script project, or when start.sh is detected.
1SKILL.mdUpdated Apr 22, 2026
nixopus/self-heal
development
VerifiedTrustedCommunity
Self-healing loop for failed deployments — diagnose, fix, redeploy up to 3 attempts, then escalate or rollback. Load when a deployment fails or build errors occur.
1SKILL.mdUpdated Apr 22, 2026