Install
$ agentstack add skill-hcaiano-skills-ship-it ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
Ship It
Full PR lifecycle automation: commit, quality gate, push, PR, CI, and review loop. The leading word is clean: the PR is not done until the latest head is clean across local checks, CI, reviewer surfaces, branch sync, and mergeability.
Phase 1: Commit
- Run
git statusandgit diffto understand all changes. - Group changes into logical conventional commits (
feat:,fix:,chore:, etc.). - Stage and commit each group with a message focused on the why.
Done when every intended change is committed in a logical conventional commit and the working tree contains no unrelated staged changes.
Phase 2: Quality gate
Run the project's quality gate before push — local first catches what CI would catch 3–5 minutes later. Detect the gate, in this order:
- Repo instruction files (
CLAUDE.md,AGENTS.md, or a project-local equivalent). If one documents a quality-gate command, use it. - Lockfile + scripts for Node-shaped repos:
bun.lock→bun,pnpm-lock.yaml→pnpm,yarn.lock→yarn,package-lock.json→npm. Readpackage.jsonscriptsforcheck,check-types/typecheck,build,test(or the project's chosen names). - Other ecosystems:
Cargo.toml→cargo check && cargo clippy && cargo build.go.mod→go vet ./... && go build ./.... Python pyproject with ruff/mypy →ruff check && mypy . && pytest. Adjust to what's actually configured. - Fallback: ask the user what the gate is, then persist the answer in the PR summary so re-runs don't re-detect.
If any check fails, fix the root cause and commit fixes as separate conventional commits (fix(lint): ..., fix(types): ...). Re-run until clean.
Done when the detected project quality gate passes locally, or a precise blocker has been reported.
Phase 3: Push & PR
Push the branch (-u if needed). Create the PR with gh pr create: short title, summary bullets, test plan. If a PR already exists for the branch, update its description rather than opening a new one. Never force-push to a shared branch.
Done when the remote branch exists and one PR points at it with an accurate description.
Phase 4: CI & review loop
Run the shared loop in ../review-pr-comments/references/pr-comment-loop.md; load ../review-pr-comments/references/github-comment-fetching.md when fetching GitHub surfaces. Do not re-implement that policy here.
Ship-it adds only these deltas:
- Run the Phase 2 quality gate before every fix push.
- Commit loop fixes as logical conventional commits.
- Push every fix commit to the PR branch.
- Before claiming done, sync with the PR's target branch:
``bash BASE_BRANCH="$(gh pr view --json baseRefName -q .baseRefName)" git fetch origin "$BASE_BRANCH" git merge --no-edit "origin/$BASE_BRANCH" `` Resolve conflicts, re-run the quality gate, and push. If the sync creates a new head, restart the shared loop.
Done when the shared loop reaches its clean state on the latest head after the target-branch sync, or reports its precise blocker.
Done condition
Ship it is done when Phase 4 is clean and the PR remains mergeable. Do not merge; that is the user's call.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: hcaiano
- Source: hcaiano/skills
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.