运维部署
- 作者仓库星标 0
- 作者更新于 实时读取
- 作者仓库 skills-registry
- 领域
- 安全
- 兼容 Agent
-
- Claude Code
- Cursor
- Cline
- Codex
- Windsurf
- Gemini CLI
- +20
- 信任分
- 88 / 100 · 社区维护
- 作者 / 版本 / 许可
- @tomevault-io · 未声明 license
- Token 消耗评级
- 低消耗
- 接入复杂程度
- 即装即用
- 是否需要外部 API Key
- 不需要
- 兼容的系统
- 未声明（默认跨平台）
- 底层运行要求
- 无特殊要求
- 文件与系统权限
-
- 只读
- 允许写入 / 修改
- 网络行为
- 允许外网请求
- 安装命令数
- 26 条
档案由构建时根据 SKILL.md 与安装命令自动衍生，可能与作者实际意图存在差异。
需要注意： 未限定 allowed-tools，默认拥有全部工具权限。
---
name: ship
description: Ship current branch — CI, SonarCloud, code review, security review, fix all issues, merge. Assum…
category: 安全
runtime: 无特殊运行时
---
# ship 输出预览
## PART A: 任务判断
- 适用问题：安全审计、密钥扫描、权限检查或风险分析。
- 输入要求：目标材料、限制条件、期望输出和验收方式。
- 证据边界：围绕“Phase 1: Create PR / Phase 2: CI Monitor / Phase 3: SonarCloud Check”读取原文规则，不把推断写成作者承诺。
## PART B: 执行结果
- **01** 任务判断：确认你的需求是否属于安全审计、密钥扫描、权限检查或风险分析，并标出输入、限制和预期结果。
- **02** 执行计划：优先按“Phase 1: Create PR / Phase 2: CI Monitor / Phase 3: SonarCloud Check”拆成步骤，说明每一步会读取什么、修改什么、产出什么。
- **03** 交付结果：给出可复制的命令、文件改动、检查清单或内容草稿，并说明如何继续迭代。
- **04** 风险边界：结合 读取文件、写入/修改文件、会按任务需要访问外部网络、通常不需要额外 API Key 给出执行前确认项。
## Running Rules
- 读取文件、写入/修改文件；会按任务需要访问外部网络；通常不需要额外 API Key。
- 先小样例验证，再放大到真实任务。
- 交付时同时给结果、检查口径和下一步迭代建议。 先确认触发方式
原文没有稳定的斜杠命令要求。安装验证后通常全局生效，直接在对话里点名这个 Skill 并描述任务即可。
给清楚输入和边界
告诉 Agent 目标文件或材料、期望结果、不可改范围、是否允许联网或执行命令。本 Skill 的权限画像是：读取文件、写入/修改文件。
小样例验证后再放大
先用一个小任务确认它会围绕“Phase 1: Create PR / Phase 2: CI Monitor / Phase 3: SonarCloud Check”工作；涉及文件或命令时，先看 diff、日志、预览或测试结果。
复核后再交付
检查最终产物是否包含明确结果、必要证据和下一步动作；如果输出泛泛而谈，就补充输入、边界和验收标准后重跑。
---
name: ship
description: Ship current branch — CI, SonarCloud, code review, security review, fix all issues, merge. Assum…
category: 安全
source: tomevault-io/skills-registry
---
# ship
## 什么时候使用
- 用于审阅代码、文档或方案并给出可执行反馈 适合处理安全审计、密钥扫描、权限检查和风险分析，核心价值是把输入、判断、执行、验证和交付边界固定下来，避免 Agent 泛泛回答。 把任务拆成可执行、可检查、可继续迭代的步骤；通常不需要额外 A…
- 面向安全审计、密钥扫描、权限检查或风险分析，优先处理能明确输入、步骤和验收标准的工作。
## 需要提供什么
- 目标材料、目录范围、期望结果和不可改动内容。
- 是否允许联网、执行命令、读写文件或调用外部服务。
## 执行规则
- 围绕「Phase 1: Create PR / Phase 2: CI Monitor / Phase 3: SonarCloud Check」组织步骤，不把推断写成作者事实。
- 读取文件、写入/修改文件；会按任务需要访问外部网络；通常不需要额外 API Key。
- 先跑小样例，确认结果可检查后再扩大任务范围。
## 输出要求
- 给出最终产物、关键证据、验证方式和下一步动作。
- 信息不足时标记 unknown，不编造命令、平台或依赖。 证据边界与执行链路
作者原文负责流程事实；仓库文件负责来源和命令；流狐只补充适用场景、限制和质量判断。
skill "ship" {
输入层 -> 用户目标 + 目标文件 + 禁止范围 + 验收标准
上下文层 -> Phase 1: Create PR / Phase 2: CI Monitor / Phase 3: SonarCloud Check
规则层 -> SKILL.md 触发条件 / 执行顺序 / 输出格式
运行层 -> 无特殊运行时 | 读取文件、写入/修改文件 | 会按任务需要访问外部网络
安全层 -> 通常不需要额外 API Key + 小任务验证 + diff / 日志复核
输出层 -> 可复制结果 + 检查清单 + 下一步迭代
}Ship Current Branch
Assumes code is already committed and pushed. Handles: PR creation, CI monitoring, SonarCloud, code review, security review, fixing all issues, and merging.
IMPORTANT: NEVER include Co-Authored-By, "Generated with Claude Code", or any Claude/AI attribution in commit messages, PR descriptions, or any other artifacts.
Phase 1: Create PR
- Determine the current branch:
git branch --show-current - Check if a PR already exists:
gh pr list --head <branch> --json number,url - If no PR exists, create one:
gh pr create --base dev --title "<concise title>" --body "<description>" - Note the PR number.
Phase 2: CI Monitor
- Find the latest workflow run:
gh run list --branch <branch> --limit 1 --json status,conclusion,databaseId - If the run is in progress, watch it:
gh run watch <id> - If it failed:
- Get failed logs:
gh run view <id> --log-failed - Diagnose and fix the issue.
git add,git commit,git push.- Go back to step 1.
- Get failed logs:
- If it succeeded, proceed.
Phase 3: SonarCloud Check
- Wait 60 seconds for SonarCloud analysis to propagate.
- Use
get_project_quality_gate_statuswith project keyBrad-Edwards_aptlto check the quality gate. - Use
search_sonar_issues_in_projectsto find new issues on the current branch. - If issues found:
- Fix them.
git add,git commit,git push.- Re-run Phase 2.
- If clean, proceed.
Phase 4: Code Review
CRITICAL: You MUST use the Skill tool to invoke the built-in review skill.
- Merge dev into the current branch:
git fetch origin dev && git merge origin/dev - If there are merge conflicts, resolve them, commit, and push.
- Call the Skill tool with
skill="review"to invoke the real built-in code review. - After the review completes, fix ALL issues it identified.
- Do NOT defer ANY issues.
- Do NOT categorize issues as "low priority" to avoid work.
- You are an LLM. You have no time constraints. Fix everything.
- The ONLY reason to stop and escalate to the user is if a fix requires a significant architectural change touching 5+ files outside the current feature scope.
- After fixing, re-read all findings and confirm each one was addressed.
Phase 5: Security Review
CRITICAL: You MUST use the Skill tool to invoke the built-in security-review skill.
- Call the Skill tool with
skill="security-review"to invoke the real built-in security review. - After the review completes, fix ALL issues it identified.
- Same rules as Phase 4: fix everything, defer nothing.
- After fixing, confirm all findings were addressed.
Phase 6: Final Commit & CI
If ANY fixes were made in Phases 4-5:
git addall changed files.git commit -m "Fix code review and security review findings"git push- Re-run Phase 2 (CI Monitor).
- Re-run Phase 3 (SonarCloud).
Phase 7: Report (DO NOT MERGE)
You MUST NOT merge the PR. You MUST NOT run gh pr merge. The user reviews and merges.
- Summary of all changes made during the ship process
- Review findings and what was fixed
- Security review findings and what was fixed
- Confirmation: CI green, SonarCloud passed, PR ready for user review
- PR URL
Source: Brad-Edwards/aptl — distributed by TomeVault.
先判断是否适合
作者设计意图
作者的方法与取舍
边界和复核