Docs: harden maintainer flow and security advisory process#16173
Merged
Docs: harden maintainer flow and security advisory process#16173
Conversation
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Comment on lines
+153
to
+159
| gh pr comment <PR> -F - <<'EOF' | ||
| Merged via squash. | ||
|
|
||
| 4. Manual fallback (only if wrapper is unavailable) | ||
| - Merge commit: $merge_sha | ||
|
|
||
| Thanks @$contrib! | ||
| EOF |
Contributor
There was a problem hiding this comment.
Heredoc prevents variable expansion
The heredoc delimiter is single-quoted (<<'EOF'), which suppresses all variable expansion. $merge_sha and $contrib will be printed as literal strings rather than their values. Use an unquoted delimiter (<<EOF) to allow variable interpolation.
Suggested change
| gh pr comment <PR> -F - <<'EOF' | |
| Merged via squash. | |
| 4. Manual fallback (only if wrapper is unavailable) | |
| - Merge commit: $merge_sha | |
| Thanks @$contrib! | |
| EOF | |
| gh pr comment <PR> -F - <<EOF | |
| Merged via squash. | |
| - Merge commit: $merge_sha | |
| Thanks @$contrib! | |
| EOF |
Prompt To Fix With AI
This is a comment left during a code review.
Path: .agents/skills/merge-pr/SKILL.md
Line: 153:159
Comment:
**Heredoc prevents variable expansion**
The heredoc delimiter is single-quoted (`<<'EOF'`), which suppresses all variable expansion. `$merge_sha` and `$contrib` will be printed as literal strings rather than their values. Use an unquoted delimiter (`<<EOF`) to allow variable interpolation.
```suggestion
gh pr comment <PR> -F - <<EOF
Merged via squash.
- Merge commit: $merge_sha
Thanks @$contrib!
EOF
```
How can I resolve this? If you propose a fix, please make it concise.|
|
||
| 5. Push via wrapper (includes pre-push remote verification, one automatic lease-retry path, and post-push API propagation retry). | ||
| ```sh | ||
| cd ~/openclaw |
Contributor
There was a problem hiding this comment.
Inconsistent base directory path
This uses ~/openclaw while both review-pr/SKILL.md (line 55) and merge-pr/SKILL.md (lines 53, 173) use ~/dev/openclaw. An agent following the three-skill sequence (review-pr -> prepare-pr -> merge-pr) would fail at this step if the repo lives at ~/dev/openclaw.
Suggested change
| cd ~/openclaw | |
| cd ~/dev/openclaw |
Prompt To Fix With AI
This is a comment left during a code review.
Path: .agents/skills/prepare-pr/SKILL.md
Line: 57:57
Comment:
**Inconsistent base directory path**
This uses `~/openclaw` while both `review-pr/SKILL.md` (line 55) and `merge-pr/SKILL.md` (lines 53, 173) use `~/dev/openclaw`. An agent following the three-skill sequence (`review-pr` -> `prepare-pr` -> `merge-pr`) would fail at this step if the repo lives at `~/dev/openclaw`.
```suggestion
cd ~/dev/openclaw
```
How can I resolve this? If you propose a fix, please make it concise.
hamidzr
pushed a commit
to hamidzr/openclaw
that referenced
this pull request
Feb 14, 2026
openperf
pushed a commit
to openperf/moltbot
that referenced
this pull request
Feb 14, 2026
openperf
pushed a commit
to openperf/moltbot
that referenced
this pull request
Feb 14, 2026
BigUncle
pushed a commit
to BigUncle/openclaw
that referenced
this pull request
Feb 14, 2026
mverrilli
pushed a commit
to mverrilli/openclaw
that referenced
this pull request
Feb 14, 2026
GwonHyeok
pushed a commit
to learners-superpumped/openclaw
that referenced
this pull request
Feb 15, 2026
6 tasks
hughdidit
pushed a commit
to hughdidit/DAISy-Agency
that referenced
this pull request
Mar 1, 2026
(cherry picked from commit 01d2ad2) # Conflicts: # .agents/skills/PR_WORKFLOW.md # .agents/skills/merge-pr/SKILL.md # .agents/skills/prepare-pr/SKILL.md # .agents/skills/review-pr/SKILL.md
hughdidit
pushed a commit
to hughdidit/DAISy-Agency
that referenced
this pull request
Mar 3, 2026
(cherry picked from commit 01d2ad2) # Conflicts: # .agents/skills/PR_WORKFLOW.md # .agents/skills/merge-pr/SKILL.md # .agents/skills/prepare-pr/SKILL.md # .agents/skills/review-pr/SKILL.md
zooqueen
pushed a commit
to hanzoai/bot
that referenced
this pull request
Mar 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Greptile Overview
Greptile Summary
This PR rewrites the maintainer PR workflow and all three skill files (
review-pr,prepare-pr,merge-pr) to replace the script-wrapper-based approach with directghCLI commands, adds a local-first/no-remote-write-until-approved policy, introduces a GHSA security advisory companion flow, and adds anti "chasing main" guidance.scripts/pr-review,scripts/pr-prepare,scripts/pr-merge, andscripts/committerwrappers (note: the scripts still exist in the repo). The new inline shell snippets make the workflow self-contained.--automerge policy reversal: The previous version explicitly prohibitedgh pr merge --autofor maintainer landings (to ensure deterministic attribution). The newmerge-prskill introduces--autoas a fallback when checks are pending.PR_WORKFLOW.md"chasing main" section aligns with this, so this appears intentional.prepare-pr/SKILL.mduses~/openclawfor the worktree base path whilereview-prandmerge-pruse~/dev/openclaw, breaking the sequential workflow. (2)merge-pr/SKILL.mdcomment heredoc uses<<'EOF'(single-quoted) which prevents$merge_shaand$contribvariable expansion, resulting in literal$strings in the PR comment.Confidence Score: 3/5
.agents/skills/prepare-pr/SKILL.md(wrong base path) and.agents/skills/merge-pr/SKILL.md(heredoc quoting bug).Last reviewed commit: 664cbda