Install
$ agentstack add skill-vdustr-skills-vp-stacked-pr-rebase ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Stacked PR Rebase
Rebase a stacked PR after its parent PR has merged by identifying parent commits, preserving only the user's own commits, recreating the branch from the updated base, and force-pushing only with explicit confirmation.
Core Principles
- Analyze before acting - Understand the PR relationship, merge type, and
commit ownership before changing history.
- Preserve user work - Keep only the user's own commits and never discard
uncertain commits without confirmation.
- Use one predictable strategy - Cherry-pick owned commits onto the updated
base for regular, squash, and rebase merges.
- Create a backup - Make a timestamped backup branch before destructive
operations.
- Require confirmation - Ask before execution and again before
--force-with-lease.
- Report exact changes - Show excluded commits, preserved commits, conflicts,
verification, and next steps.
Phase 1: Situation Analysis
Gather:
- current branch and working tree status
- current PR number, title, head branch, and base branch
- merge base between current branch and target base
- commits currently in the PR branch
- recently merged PRs targeting the same base
- merged PR whose head branch matches the current PR base branch, when the PR is
stacked on a branch instead of the default branch
Useful commands:
gh pr view --json number,title,headRefName,baseRefName,commits
git merge-base HEAD origin/
git log --oneline "$(git merge-base HEAD origin/)"..HEAD
gh pr list --state merged --base --limit 20 \
--json number,title,headRefName,mergeCommit,commits
gh pr list --state merged --head --limit 5 \
--json number,title,headRefName,mergeCommit,commits
Read references/parent-detection.md for the detailed detection strategy, confidence rules, and user-facing option examples. When the user names the parent PR explicitly, skip detection but still verify it: confirm the PR is merged and its head branch relates to the current PR's base.
Phase 2: Merge Type Detection
Detect how the parent PR merged so the report is accurate. The execution strategy remains cherry-picking owned commits for all merge types.
| Merge type | Detection | Strategy | |------------|-----------|----------| | Regular merge | merge commit has 2 parents | cherry-pick own commits | | Squash merge | one parent, original commits not in base | cherry-pick own commits | | Rebase merge | one parent, original commits rewritten in base | cherry-pick own commits |
Read references/merge-strategies.md for GraphQL queries, diagrams, and merge type details.
Phase 3: Commit Classification
Classify commits in the current PR branch:
| Priority | Condition | Classification | |----------|-----------|----------------| | 1 | SHA appears in parent PR original commits | parent commit, exclude | | 2 | same non-generic message, same author, different SHA | likely parent commit, exclude | | 3 | message match is generic or author differs | uncertain, ask user | | 4 | everything else | user-owned, keep |
Always show the classification before execution, even when confidence is high. Read references/commit-classification.md for examples, manual selection, and uncertain-commit prompts.
Phase 3.5: Pre-Execution Confirmation
Before any destructive operation, show:
- current PR and branch
- parent PR and merge type
- commits to exclude
- commits to keep
- uncertain commits and selected treatment
- backup branch name
- exact high-level operation
Ask for explicit confirmation. If the user declines, offer to reclassify, switch to manual selection, or abort.
All interactive pause points are summarized in references/decision-points.md.
Phase 4: Rebase Execution
Use a fresh branch from the updated base, then cherry-pick only user-owned commits in oldest-first order.
High-level sequence:
- Fetch the latest base branch.
- Create
backup-pr-at the original branch HEAD. - Create a temporary branch from
origin/. - Cherry-pick user-owned commits, preserving commit messages and authorship.
- Resolve conflicts or ask for semantic conflicts.
- Replace the original branch with the temporary branch.
- Delete the temporary branch.
Read references/execution.md for the exact command sequence, verification steps, force-push confirmation, and summary report template. Read references/conflict-resolution.md for conflict classification.
Phase 5: Verify And Push
Before force-pushing:
git log --oneline -10
git status
git diff origin/..HEAD --stat
Then ask before:
git push --force-with-lease origin
Never use plain --force. Never delete the backup branch automatically. In the final report, include conflicts encountered, verification results, and the backup branch name.
Error Handling
| Error | Action | |-------|--------| | Cannot identify parent PR | Ask user to specify PR number | | Parent PR not merged | Abort and suggest waiting | | No user-owned commits found | Warn that the branch may already be rebased | | Cherry-pick conflict | Classify conflict and resolve or ask | | Own commit is a merge commit | Warn and ask before using cherry-pick -m 1; prefer squashing first | | Force push rejected | Check branch protection or remote drift | | Backup branch exists | Use timestamp suffix for uniqueness | | Current branch has no PR | Ask which PR to operate on | | Multiple parent PRs in chain | Collect commits from all parents, then keep only non-parent commits | | Parent PR has 250+ commits | Use pagination or manual commit selection |
Reference Files
references/parent-detection.md- parent PR detection and confidence rulesreferences/merge-strategies.md- merge type detection and diagramsreferences/commit-classification.md- commit ownership examples and promptsreferences/execution.md- command sequence and report templatereferences/conflict-resolution.md- conflict handling guidancereferences/decision-points.md- all required user confirmation points
Notes
- Requires
ghCLI authenticated with appropriate permissions. - Works with GitHub PRs. GitLab and Bitbucket are not supported.
- The PR branch must be checked out locally.
- Always test with a backup before critical operations.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: VdustR
- Source: VdustR/skills
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.