Repos
Command-driven GitHub repository management. Parse the first token as a command when it matches the table; otherwise map clear intent.
Default secrets path is
Pulumi ESC (OIDC +
) — not long-lived
in GitHub unless the user explicitly wants classic repo secrets.
Operating contract
Shared by every DecisionNerd/dev-skills skill. Canonical copy:
handbook/concepts/14-operating-contract.md
.
- Define done first. Before using tools, write the finish line in one or two lines: the acceptance criteria (existing issue AC, BDD scenarios, tests, or contract when they exist; otherwise propose them and say where they should live) and the evidence that will prove them. Re-check it before reporting done. Never report done on work you did not verify.
- Requested scope sets the finish line. A question ("is it ready?", "why is it broken?", "what next?") ends with the answer and a line naming the exact next invoke. An outcome request ("fix", "finish", "land", "#42") continues through the chain (diagnose → fix → test → check-readiness → merge-it) until the outcome or a real blocker. Do not end a turn with "Do you want me to…?" for in-scope, in-repo work.
- Stop only for real blockers. Stop and ask only when you cannot continue without the user, or before: deleting data or unmerged work, force-push or history rewrite, changing anything outside this repository (GitHub objects, deployments, live data, production or paid resources, external services), or leaving the requested scope, unless the user's request already named that exact action. Keep the harness's permission prompts for risky commands. Otherwise keep going and put status notes in the same message as the next action.
- Ask well, once. For a genuine question use the harness's structured question tool when it has one (Claude Code: ; Codex: when the current mode supports it) with concrete options; otherwise plain text with numbered options. Treat the answer as settled; do not re-open earlier verdicts, plans, or answers unless asked.
- Fan out when work is parallel. Use subagents for independent reads (repo survey, evidence gathering, per-option research, per-area audits) and for independent verification (a reviewer that did not write the change). Writes stay single-owner per path set and sequential. Brief every child with goal, done-when, constraints, must-not, and return shape; verify each child's result before consolidating. Use Claude Code's tool only for orchestration across many subagents that truly needs it; it is expensive.
- Pick the model tier per child; defer to routing config. If the harness or user config already routes subagents (Claude Code
CLAUDE_CODE_SUBAGENT_MODEL
agents.default_subagent_model
agents.<name>.config_file
- Keep a checklist on long runs. For more than about five steps or work that crosses skills, keep at the repo root and tick items as they finish. Do not commit it unless the repo already tracks one.
- Close every run with three headings. (the one genuine question or blocker, else "none"); (files, commits, GitHub objects, deploys, else "nothing"); (evidence, verdict, and ).
Commands
| Command | What it does |
|---|
| (none) / / | Survey current repo(s): visibility, default branch, protection, workflows, secrets posture, topics |
| Plan/create a new GitHub repo (template, visibility, init files, team access) |
| / | Branch protection, rulesets, merge policy, required checks, autodelete heads |
| Carve a package/path/history into a new repo (filter-repo / subtree plan) |
| / | Join multiple repos into one (history strategy, path prefixes, CI unification) |
| Design or migrate to/from monorepo (tooling, packages, CI graph, ownership) |
| / | Repo-as-system architecture: boundaries, apps/packages, deploy units, coupling |
| CI/CD workflows — see CI subcommands |
| Secrets & config — Pulumi ESC default; see references/secrets-esc.md |
| Collaborators, teams, outside collaborators, deploy keys posture |
| / / / | Metadata and identity operations |
| / | Archive or restore a repo |
| Template repo flags / generate from template |
| Mirror or keep a fork/upstream sync plan (no silent force) |
| / | List commands |
Target:
, URL, local path, or “current repo.”
Routing
- No argument: for the current git remote.
- First word is a command: run it; remainder is target/context.
- / : CI subcommands (below).
- Clear intent (“split packages/api into its own repo”, “move secrets to ESC”): map and proceed.
Mutating GitHub (create, settings, transfer, archive, secret writes), Pulumi ESC, or history rewrites requires
explicit approval. Prefer plans + DAG before execution. For complexity judgment on CI/architecture, pair with
.
CI subcommands
| Subcommand | What it does |
|---|
| / | Inventory workflows, required checks, flaky/slow jobs, secrets usage |
| Least privilege permissions, pin actions SHAs or trustworthy versions, OIDC, no plaintext secrets, branch protections aligned to checks, fail-closed on supply chain basics |
| Remove redundant jobs/matrices, cache sanely, consolidate reusable workflows — only if complexity is unwarranted (use lens; keep earned gates) |
| Add a workflow (test/lint/release/deploy) fitting repo stack |
| Extract composite/reusable workflows across monorepo or org |
Details: references/ci.md.
(Pulumi ESC default)
Default method:
Pulumi ESC + GitHub OIDC (
,
,
) so CI does not store long-lived cloud keys in GitHub Secrets.
| Subcommand | What it does |
|---|
| / | Where secrets live today (GitHub / ESC / both); drift risk |
| Bootstrap ESC env + OIDC trust + workflow injection (default path) |
| Move classic GitHub Actions secrets → ESC; remove static secrets when safe |
| Classic repo/org/environment secrets only if user insists |
| Rotation plan for ESC providers / remaining GitHub secrets |
Follow references/secrets-esc.md. Never print secret values.
/ /
- split: map boundaries → history strategy ( preferred) → new remote → CI/secrets/access → update consumers. See references/split.md.
- combine: path prefix plan → history import strategy → unified CI → CODEOWNERS → redirect/archive sources. See references/combine.md.
- monorepo: package layout (apps/packages), task runner, affected CI, ownership, release units. See references/monorepo.md.
Always produce a
DAG of migration steps with right-sized tasks (Goldilocks — see
).
Done when: the DAG is fully executed, consumer repos and import paths are updated, and CI is green on the new layout. Fan out per-repo inventories to parallel read-only subagents (fast tier) during the survey phase; keep
across the migration for any chain longer than five steps.
Repo-level architecture review (not app feature design):
- Deployable units vs packages vs shared libs
- Boundary rules (who may import whom)
- CI/CD and env topology (dev/staging/prod)
- Recommendation: keep / reshape / split / combine — with risks/benefits
Hand off product/UI feeling to ProductFeeling / Impeccable; docs tree to DocSlime; code structure inside a package to
.
Standard hygiene ( checklist)
- Default branch, visibility, homepage/topics
- Branch protection / rulesets vs actual required checks
- Workflows present, permissions blocks, action pinning posture
- Secrets: GitHub vs ESC; long-lived credentials remaining
- Dependabot/Renovate, CODEOWNERS, SECURITY.md, license
- Autodelete head branches, squash/rebase policy
- Forks, templates, archive state
For large orgs (many repos), split the audit by repo across parallel read-only subagents (fast tier); verify each before consolidating.
Output
Blocked on me
none
Changed
nothing
Found
Next:
(from the recommend above)
Related skills
- Complexity of CI/arch/plan →
- Issues/PRs/milestones → / /
- Ship staging/prod → (Stage/Ship phases per repo policy)
- Agent thrash during migration →
- Local clutter after history ops →
- Lost on whether to split → then
Grounding
This skill’s TTPs are grounded in current engineering baselines (DORA, GitHub Docs, Fowler/Beck, Google SRE & SWE book, OpenTelemetry, OWASP LLM / NIST AI RMF, Diátaxis — see handbook
).
DORA CI + loosely coupled topology; GitHub OIDC / pinned Actions / least privilege for supply-chain baseline; Pulumi ESC is this house’s default over long-lived cloud keys.
Handbook card:
handbook/practices/repos.md
.