sjawhar/plugins/sjawhar/skills/safe-ship
plugins/sjawhar/skills/safe-ship/SKILL.md
Full shipping workflow: analyze, review, CI, merge, and track deferred issues
$ install --global
skillsauthnpx skillsauth add sjawhar/dotfiles plugins/sjawhar/skills/safe-shipInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 22, 2026, 1:06 PM155.3s1 file scanned
SKILL.md
- description:
- Full shipping workflow: analyze, review, CI, merge, and track deferred issues
Complete the full safe shipping workflow for the current changes.
jj workspace note: You may be in a non-default jj workspace with no
.gitdirectory. Ifghcommands fail, setGIT_DIRto point to the default workspace:GIT_DIR=/path/to/default/.git gh ...
Prerequisites: This workflow uses /analyze, /push-pr, /code-review-jj:code-review, and /watch-ci-merge. Ensure these are available.
Phase 1: Pre-Push Analysis
- Check for changes:
jj status— if no changes, report and stop - Run
/analyzeto check type safety, bugs, and code simplification - Address all critical and high severity issues found
- Re-run
/analyze(max 3 iterations) - If critical/high issues persist after 3 rounds, stop and ask for guidance
- Track any medium and low priority suggestions for later
Phase 2: Push and Create PR
- Run
/push-prto push changes and create a pull request - If PR already exists, just push the updated changes
Phase 3: Code Review
- Run
/code-review-jj:code-reviewon the PR - Also fetch Copilot/bot review comments:
gh api repos/{owner}/{repo}/pulls/{number}/comments - Address all critical and high severity issues from either source
- Re-run code review (max 3 iterations)
- If critical/high issues persist after 3 rounds, stop and ask for guidance
- Track any medium and low priority suggestions for later
Phase 4: CI and Merge
- Run
/watch-ci-mergeto monitor CI, fix failures, and merge - This handles: CI monitoring, failure fixing, rebasing, and merging
- If blocked,
/watch-ci-mergewill stop and report
Phase 5: Track Deferred Issues
Only if there are deferred items, create a GitHub issue after merging:
gh issue create --title "Follow-up: [brief description] cleanup" --body "..."
The issue body should include:
- Source of each suggestion (analyze, code-reviewer, Copilot)
- Link to the original PR comment if applicable (e.g.,
https://github.com/{owner}/{repo}/pull/{number}#discussion_r{id}) - File and line number where applicable
- The specific suggestion or improvement
- Priority level (medium/low)
Important:
- Do NOT skip the analyze loop — quality gates matter
- Do NOT merge with unaddressed critical/high issues
- DO track all deferred items — nothing should be forgotten
- If blocked at any phase, report progress and stop
Done when: PR is merged and any deferred issues are tracked.
Related Skills
sjawhar/skiplagged
development
VerifiedTrustedCommunity
Use when searching flights, hotels, or rental cars; comparing fares across flexible dates; discovering cheap destinations from a fixed origin; or hunting hidden-city ticketing deals. Trigger on multi-city itineraries, fare calendars, "where can I fly cheaply", price-sensitive trip planning, or any time the user wants a sanity-check against Google Flights pricing — Skiplagged surfaces hidden-city deals other engines deliberately hide.
3SKILL.mdUpdated May 4, 2026
sjawhar/ceramic
development
VerifiedTrustedCommunity
Search the web via Ceramic Search (lexical/keyword-based). Use when looking up current events, recent news, time-sensitive facts, specific people/products/companies, technical docs, or any topic requiring fresh web results. Triggers on "search the web", "look up", "find recent", "latest news", "current", or when built-in knowledge is likely stale.
3SKILL.mdUpdated Apr 29, 2026
sjawhar/whatsapp
tools
VerifiedTrustedCommunity
Use when reading WhatsApp messages, searching conversations, sending messages, listing chats, or interacting with WhatsApp workspaces
3SKILL.mdUpdated Apr 22, 2026
sjawhar/plugins/sjawhar/skills/watch-ci-merge
tools
VerifiedTrustedCommunity
Watch CI status, fix failures, and merge when green
3SKILL.mdUpdated Apr 22, 2026