# Gitflow > Manage a gitflow branching workflow — starting and finishing feature, - **Type:** Skill - **Install:** `agentstack add skill-mgiovani-cc-arsenal-gitflow` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [mgiovani](https://agentstack.voostack.com/s/mgiovani) - **Installs:** 0 - **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [mgiovani](https://github.com/mgiovani) - **Source:** https://github.com/mgiovani/cc-arsenal/tree/main/skills/gitflow ## Install ```sh agentstack add skill-mgiovani-cc-arsenal-gitflow ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # Gitflow This skill covers the full gitflow branching model with two long-lived branches and short-lived branches off them. - **`main`** is **production**. Merging to `main` triggers your deploy pipeline. Treat every merge to `main` as a production deploy that your users will see shortly after. - **`dev`** (sometimes called `develop`) is the integration branch. Day-to-day feature and fix work lands here first. - Short-lived branches: `feat/` and `fix/` off `dev`, `release/` off `dev`, `hotfix/` off `main`. ## Pick the flow Read the matching reference in full and follow it step by step. Each one is self-contained. | The user wants to... | Flow | Read | | ----------------------------------------------------------------- | ------- | ------------------------- | | Ship the accumulated `dev` work to production | Release | `references/release.md` | | Get an urgent fix into production now, can't wait for a release | Hotfix | `references/hotfix.md` | | Build a new feature or a fix that will ride the next release | Feature | `references/feature.md` | If the intent is ambiguous (e.g. "ship the settings fix"), ask one question: is this urgent enough to go straight to production (hotfix), or does it ride the next release (feature now, release later)? ## Universal rails These apply to every flow. They exist because `main` is live production and a mistake here is user-visible, so the cost of a shortcut is real. - **`main` is a deploy button.** Never merge to `main` while any CI check is not green. The full Definition-of-Done gate runs on a PR to `main`; wait for all of it. Poll CI every few minutes rather than tight-looping, to keep token cost sane. No CI pipeline configured on the repo? Skip the wait-for-green step and say so explicitly before merging. - **Always update `CHANGELOG.md`** during a release and a hotfix (never per-feature; the changelog is assembled at ship time). See `references/changelog.md` for the format. - **Conventional Commits.** Follow the [Conventional Commits](https://www.conventionalcommits.org/) spec. Keep commit messages, PR titles, PR bodies, the changelog, and release notes clean and professional. - **Never force-push.** Never bypass git hooks (`--no-verify` or equivalent). The pre-push hooks are part of the safety net. If a push fails due to a hook, investigate and root-fix the underlying issue; never bypass. - **Stage only the files you intend.** Prefer `git add ` over blanket staging commands. Verify what you are about to stage with `git diff --staged` before committing. - **Verify before every push.** Run `git log --oneline ..HEAD` and `git diff --stat ..HEAD` so you know exactly what is going to the remote, especially before anything that touches `main`. - **After any merge to `main` (release or hotfix), open a break-glass revert PR and leave it OPEN.** It is the one-click rollback. Never merge it yourself. See the shared procedure in `references/release.md` (the revert step is identical for hotfix). ## Versioning Semantic versioning. The current version lives in your project manifest (`package.json`, `pyproject.toml`, `Cargo.toml`, etc.) on both long-lived branches — kept in sync; both are at the last released version. No version manifest in the repo? Version via the latest `git tag` alone and skip the bump-file step. - **Release**: bump minor for new features (e.g. `1.1.0` to `1.2.0`), major for breaking changes. - **Hotfix**: bump patch (e.g. `1.1.0` to `1.1.1`). - The tag is `v`, annotated, placed on the merge commit on `main`. ## Merge methods (they differ by target, on purpose) - **Feature/fix PR into `dev`**: squash merge (one clean commit per PR with the `(#NNN)` suffix). This keeps `dev` history readable. - **`release/*` or `hotfix/*` into `main`**: merge commit (`--no-ff`). This preserves the release as a first-parent merge so the break-glass revert (`git revert -m 1`) is clean. - **Back-merge `release/*` or `hotfix/*` into `dev`**: merge commit. Delete short-lived branches yourself once they are merged everywhere they need to go. ## Stay in the loop These flows touch production. When CI is running or a deploy is in flight, report each milestone to the user as it lands (CI green, merged, deploy healthy, tagged) rather than going silent. If any gate is red, stop and root-fix; do not merge around it. ## Source & license This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [mgiovani](https://github.com/mgiovani) - **Source:** [mgiovani/cc-arsenal](https://github.com/mgiovani/cc-arsenal) - **License:** MIT Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/skill-mgiovani-cc-arsenal-gitflow - Seller: https://agentstack.voostack.com/s/mgiovani - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.