QVAC-18394 feat: add devops pod skills (pr-status, pr-create, daily-update, pr-review) by Proletter · Pull Request #1929 · tetherto/qvac

Proletter · 2026-05-06T16:00:42Z

Stacked on #1926. Auto-rebases to main on merge of base.

🎯 What problem does this PR solve?

Resolves the four QVAC-18394 subtasks: Stale-Prs, Create-pr, Daily-update, Pr-review.
DevOps engineers had no Cursor-native automation for the daily PR loop.

📝 How does it solve it?

Adds four disable-model-invocation: true skills under .cursor/skills/devops-*/, grounded in the rules from #1926:

devops-pr-status — wraps _lib/pr-skills/pr-status.mjs --pod devops --mode team (stale / needs-review / conflicts).
devops-pr-create — generates titles + devops.md body; trigger detection drives required sections.
devops-daily-update — emits the team's Slack standup format (🔨 / 📅 / 🚧). Read-only; copy-paste from /tmp/.
devops-pr-review — wraps /pr-review, layers a 15-check GHA security audit.

No new shared infra — reuses _lib/pr-skills/.

🧪 How was it tested?

Frontmatter parses; cross-references resolve; gh flags verified.
Audited against .cursor/rules/sdk/skill-authoring-guidelines.mdc.
ReadLints clean.

Made with Cursor

Per review feedback: rules auto-attach via globs and pollute the context window on every devops surface. The format spec is already encoded in devops-pr-create (regex validation, allowed prefixes/tags, trigger detection) and devops-pr-review (title validation against the same regex) — both invoked explicitly, never autoloaded. - Delete .cursor/rules/devops/commit-and-pr-format.mdc (5 KB). - main.mdc: drop the rule from the related-rules table and replace the "Commit messages and PR titles" section with a one-line pointer to the devops-pr-create skill. Skill-side cross-references to the deleted rule are cleaned up on PR #1929 (next in the stack) since that's where the skills live. Co-authored-by: Cursor <cursoragent@cursor.com>

…pdate, pr-review) Resolves the four QVAC-18394 subtasks by adding the DevOps pod's user-facing Cursor skills on top of the conventions and team file landed in the prereq branch. The skills lean on the existing _lib/pr-skills/ shared library for pod discovery, PR enumeration, Slack-handle mapping, and worktree management, so no new shared infra is added — only thin SKILL.md surfaces and DevOps-specific workflows. Files: - .cursor/skills/devops-pr-status/SKILL.md — Stale-Prs subtask. Thin wrapper invoking pr-status.mjs --pod devops --mode team. The shared script already segregates PRs into needs-your-re-review / stale (>3d) / needs-review and flags merge conflicts; no separate stale-only mode is needed. - .cursor/skills/devops-pr-create/SKILL.md — Create-pr subtask. Generates TICKET prefix[tag]?: subject titles + devops.md PR body, with trigger detection (action-pinning / permissions / IaC plan / [bc]) driving which template sections are required. Client-side title validation since no pr-validation-devops.yml exists yet. - .cursor/skills/devops-daily-update/SKILL.md — Daily-update subtask. Aggregates yesterday's merged PRs, today's open PRs, reviews owed, and recent CI runs into a Slack/Asana-ready message. Bounded to <=6 shell calls. Read-only; never posts. Includes a secret-pattern scrub before writing the temp file. - .cursor/skills/devops-pr-review/SKILL.md — Pr-review subtask, absorbs gha-audit. Wraps /pr-review (does NOT fork it) and layers a deterministic GitHub Actions security audit (15 checks A1-A15) sourced verbatim from .cursor/rules/devops/github-actions.mdc and secrets-and-credentials.mdc. Findings flow into the same pending-review payload the user confirms. All four skills: - disable-model-invocation: true (state-changing or PR-posting flows) - Reference rules and team file landed by the prereq PR - Inherit safety + efficiency rules from .cursor/rules/devops/agentic-automation.mdc (read-only by default, plan-then-apply for state changes, bounded shell calls) Validated: - All four SKILL.md frontmatter parses (name matches directory; non-trivial description) - All 12 cross-file references resolve (rules, team file, PR template, shared lib, parent skills) - gh search prs / gh run list flags + JSON fields verified against gh CLI 2.x help output - ReadLints clean - No formatter mangling Co-authored-by: Cursor <cursoragent@cursor.com>

…late The first draft used a generic Markdown layout (`## Yesterday`, `## Today`, `## Blockers`, `_(none)_` for empty sections, GitHub-flavored links). The team's actual daily-update format on Slack is different: 🔨 *Done today* - QVAC-XXXXX: <past-tense action> - <optional sub-bullet> 📅 *Planned for tomorrow* - QVAC-XXXXX: <forward-looking action> - QVAC-YYYYY 🚧 *Blockers / risks* - N/A Changes: - Replaced the section names and added the canonical 🔨 / 📅 / 🚧 emoji - Switched from Markdown headings to Slack-bold (`*Section*`) so the output renders correctly when pasted into Slack (Slack does not render `##`) - Empty sections now render `- N/A` (literal), not `_(none)_` - Bullets lead with `TICKET:` (auto-linked by the workspace's Asana app), not `#<pr-num>` — falls back to `#<num>` only when no ticket can be extracted from PR title or branch name - Sub-bullets at 4-space indent for ticket-level context - Default `--format` is now `slack` (not `markdown`) — Slack is the primary destination; chat preview keeps the Markdown form - Temp file extension changed `.md` → `.txt` to reflect Slack mrkdwn (not GitHub-flavored Markdown) as the canonical form - Added ticket-extraction rules (PR title → branch name → `#<pr-num>`) - Added a per-section routing table (merged-today / pushed-today / open-no-recent-commits / reviews-owed / conflicting / stale-review / CI-failing) so the agent knows which bucket each item lands in Lookback default unchanged at "yesterday 00:00 local" — covers both an EOD post late evening and a morning standup at 7am without manual `--since`. Quality gates updated to enforce the new layout (correct emoji + section names; `- N/A` for empty; no Markdown headings in Slack form; no GitHub- style links). The skill is still read-only and never posts. The user copies from the temp file and pastes into Slack manually. Co-authored-by: Cursor <cursoragent@cursor.com>

Self-audit pass against `.cursor/rules/sdk/skill-authoring-guidelines.mdc` and the SDK pod's reference skills (sdk-pr-status, sdk-pr-create, sdk-changelog, sdk-backmerge). Documentation-only. Description tightening: - devops-pr-status: 341 → 275 chars - devops-pr-create: 269 → 231 chars - devops-daily-update: 398 → 255 chars - devops-pr-review: 386 → 271 chars Reference: sdk-pr-status's description is 256 chars. All four are now in the same 230–280 range, vs the prior 270–400 range. WHAT/WHEN preserved on each. Heading consistency: - "## Quality gates" → "## Quality Checklist" in devops-daily-update, devops-pr-review (sdk-changelog / sdk-backmerge / sdk-pr-create all use "Quality Checklist") - "## Validation gate (CLIENT-SIDE)" → "## Validation" in devops-pr-create (no SDK skill uses uppercase parenthetical scope qualifiers in headings) Editorial cleanup: - devops-pr-status: dropped the "Resolves the Stale-Prs subtask of QVAC-18394 …" paragraph (skill bodies should not reference their own PR/ticket; SDK skills never do) - devops-daily-update: dropped the upfront "## Canonical template" section (~25 lines). Step 8's "#### Slack form (canonical)" is the single source of truth for the format. Folded the one unique line — bare-ticket bullets allowed when self-evident — into Step 8. Reduced devops-daily-update from 269 → 242 lines. Other line-counts stable (46, 183, 140). No behaviour changes. Cross-file references still resolve. Frontmatter parses; name matches dir; disable-model-invocation: true preserved on all four. ReadLints clean. Co-authored-by: Cursor <cursoragent@cursor.com>

- github-actions.mdc § Permissions: accept top-level OR per-job permissions blocks as equivalent (per-job is the more secure narrower-scope pattern). - github-actions.mdc § File layout: add integration-<scope>-<pkg>.yml to the canonical filename list (existing repo convention). - devops-pr-review SKILL.md: tighten A2 + A15 check descriptions to mirror the loosened rule (audit becomes more permissive — no consumers break). - devops-daily-update SKILL.md: trim merged-PRs gh-search --json field set to what the API actually exposes (closedAt, not mergedAt/ additions/deletions); add cap of 5 most-recently-updated reviews to the standup output with overflow line. - devops-pr-create SKILL.md + devops.md PR template: drop the redundant "be concise" Note line from the template head. All issues uncovered by the end-to-end test session of the four new devops skills on this branch. Co-authored-by: Cursor <cursoragent@cursor.com>

…r-create - devops-pr-status: tee dashboard stdout to /tmp/devops-pr-status-<date>.txt and redirect stderr to a sibling .stderr file. Print pbcopy/xclip/wl-copy commands so the operator can paste the dashboard straight into a Slack thread (Slack auto-renders the indented plain text as nested bullets and turns #<num> into PR auto-links). - devops-pr-create: add an explicit step 8 to write the assembled PR body to /tmp/pr-body.md (the gh CLI Integration section already cat's that path). Add the pbcopy/xclip/wl-copy commands as step 9 for direct paste into the GitHub PR-create form. Discovered during the test pass — the dashboard output was useful but the operator had to manually copy from the terminal. Now there's a single pbcopy command to grab paste-ready content. Co-authored-by: Cursor <cursoragent@cursor.com>

…skills Mirror the rule deletion on PR #1926 — remove dead links from devops-pr-create and devops-pr-review SKILL.md, and inline the title regex / allowed prefixes / allowed tags so the skills stay self-contained without auto-loading anything via globs. - devops-pr-create: Format References now points at the inline Validation regex; the "see rule" parenthetical in Validation is replaced with a one-line note that no pr-validation-devops.yml exists yet; the References bullet for the deleted rule is removed. - devops-pr-review: drop commit-and-pr-format from the auto-load list in step 4 (it's deleted, no longer auto-loads); inline the format spec in step 5 (regex + prefixes + tags); replace the rule bullet in References with a pointer to devops-pr-create as the canonical home for the format spec. No behavior changes — same regex, same prefix/tag list, same validation logic. Co-authored-by: Cursor <cursoragent@cursor.com>

github-actions · 2026-05-07T15:16:38Z

Tier-based Approval Status

**PR Tier:** TIER1

**Current Status:** ✅ APPROVED

**Requirements:**
- 1 Team Member approval ✅ (2/1)
- 1 Team Lead OR Management approval ✅ (1/1)



---
*This comment is automatically updated when reviews change.*

…ate (#1926) * QVAC-18394 infra: add devops pod conventions, team file, and PR template Baseline DevOps pod metadata and conventions to unblock the QVAC-18394 skill subtasks (Stale-Prs, Create-pr, Daily-update, Pr-review). Documentation and config only; no behavior change. Files: - .github/teams/devops.json — pod metadata (leads, members, ownedPaths) - .cursor/rules/devops/main.mdc — pod entry point + operating principles - .cursor/rules/devops/github-actions.mdc — workflow/action conventions - .cursor/rules/devops/secrets-and-credentials.mdc — secrets handling + leak-response playbook - .cursor/rules/devops/agentic-automation.mdc — read-only-default, plan-then-apply, validation-before-success for AI-driven work - .cursor/rules/devops/commit-and-pr-format.mdc — commit/PR title format scoped to .github/** and scripts/** (sdk pod's rule is package-scoped) - .github/PULL_REQUEST_TEMPLATE/devops.md — PR body template mirroring sdk-pod.md / addon.md discipline (flat sections only) Validated: - All .mdc frontmatter parses cleanly (description, globs, alwaysApply) - devops.json parses cleanly - No linter errors, no secret patterns matched - PR template structure mirrors existing templates (no H3 nesting, no tables, no HTML) Co-authored-by: Cursor <cursoragent@cursor.com> * QVAC-18394 chore: expand devops pod roster with 5 team members Adds the rest of the active DevOps engineers to .github/teams/devops.json so /devops-pr-status correctly partitions reviewers between "Reviews:" (team) and "Other:" (outside) buckets. Without this, every team-member review currently lands in "Other:" and the dashboard reports approvals as still-needed. Members (alphabetical, case-insensitive): - darkynt (Matt Cavanagh) - GiacomoSorbiWork (Giacomo) - sidj-thr - tamer-hassan-tether - yauhenipankratovich-web Removes Proletter from members per the cross-pod convention (lead is listed in `leads` only — see .github/teams/sdk.json). Validation: - JSON parses; pr-status.mjs --pod devops --mode team loads the new roster without error. - No code/path changes, data-only update. Co-authored-by: Cursor <cursoragent@cursor.com> * QVAC-18394 chore: drop commit-and-pr-format rule (skill-only) Per review feedback: rules auto-attach via globs and pollute the context window on every devops surface. The format spec is already encoded in devops-pr-create (regex validation, allowed prefixes/tags, trigger detection) and devops-pr-review (title validation against the same regex) — both invoked explicitly, never autoloaded. - Delete .cursor/rules/devops/commit-and-pr-format.mdc (5 KB). - main.mdc: drop the rule from the related-rules table and replace the "Commit messages and PR titles" section with a one-line pointer to the devops-pr-create skill. Skill-side cross-references to the deleted rule are cleaned up on PR #1929 (next in the stack) since that's where the skills live. Co-authored-by: Cursor <cursoragent@cursor.com> * QVAC-18394 feat: add devops pod skills (pr-status, pr-create, daily-update, pr-review) (#1929) * QVAC-18394 feat: add devops pod skills (pr-status, pr-create, daily-update, pr-review) Resolves the four QVAC-18394 subtasks by adding the DevOps pod's user-facing Cursor skills on top of the conventions and team file landed in the prereq branch. The skills lean on the existing _lib/pr-skills/ shared library for pod discovery, PR enumeration, Slack-handle mapping, and worktree management, so no new shared infra is added — only thin SKILL.md surfaces and DevOps-specific workflows. Files: - .cursor/skills/devops-pr-status/SKILL.md — Stale-Prs subtask. Thin wrapper invoking pr-status.mjs --pod devops --mode team. The shared script already segregates PRs into needs-your-re-review / stale (>3d) / needs-review and flags merge conflicts; no separate stale-only mode is needed. - .cursor/skills/devops-pr-create/SKILL.md — Create-pr subtask. Generates TICKET prefix[tag]?: subject titles + devops.md PR body, with trigger detection (action-pinning / permissions / IaC plan / [bc]) driving which template sections are required. Client-side title validation since no pr-validation-devops.yml exists yet. - .cursor/skills/devops-daily-update/SKILL.md — Daily-update subtask. Aggregates yesterday's merged PRs, today's open PRs, reviews owed, and recent CI runs into a Slack/Asana-ready message. Bounded to <=6 shell calls. Read-only; never posts. Includes a secret-pattern scrub before writing the temp file. - .cursor/skills/devops-pr-review/SKILL.md — Pr-review subtask, absorbs gha-audit. Wraps /pr-review (does NOT fork it) and layers a deterministic GitHub Actions security audit (15 checks A1-A15) sourced verbatim from .cursor/rules/devops/github-actions.mdc and secrets-and-credentials.mdc. Findings flow into the same pending-review payload the user confirms. All four skills: - disable-model-invocation: true (state-changing or PR-posting flows) - Reference rules and team file landed by the prereq PR - Inherit safety + efficiency rules from .cursor/rules/devops/agentic-automation.mdc (read-only by default, plan-then-apply for state changes, bounded shell calls) Validated: - All four SKILL.md frontmatter parses (name matches directory; non-trivial description) - All 12 cross-file references resolve (rules, team file, PR template, shared lib, parent skills) - gh search prs / gh run list flags + JSON fields verified against gh CLI 2.x help output - ReadLints clean - No formatter mangling Co-authored-by: Cursor <cursoragent@cursor.com> * QVAC-18394 fix: align devops-daily-update output to team's slack template The first draft used a generic Markdown layout (`## Yesterday`, `## Today`, `## Blockers`, `_(none)_` for empty sections, GitHub-flavored links). The team's actual daily-update format on Slack is different: 🔨 *Done today* - QVAC-XXXXX: <past-tense action> - <optional sub-bullet> 📅 *Planned for tomorrow* - QVAC-XXXXX: <forward-looking action> - QVAC-YYYYY 🚧 *Blockers / risks* - N/A Changes: - Replaced the section names and added the canonical 🔨 / 📅 / 🚧 emoji - Switched from Markdown headings to Slack-bold (`*Section*`) so the output renders correctly when pasted into Slack (Slack does not render `##`) - Empty sections now render `- N/A` (literal), not `_(none)_` - Bullets lead with `TICKET:` (auto-linked by the workspace's Asana app), not `#<pr-num>` — falls back to `#<num>` only when no ticket can be extracted from PR title or branch name - Sub-bullets at 4-space indent for ticket-level context - Default `--format` is now `slack` (not `markdown`) — Slack is the primary destination; chat preview keeps the Markdown form - Temp file extension changed `.md` → `.txt` to reflect Slack mrkdwn (not GitHub-flavored Markdown) as the canonical form - Added ticket-extraction rules (PR title → branch name → `#<pr-num>`) - Added a per-section routing table (merged-today / pushed-today / open-no-recent-commits / reviews-owed / conflicting / stale-review / CI-failing) so the agent knows which bucket each item lands in Lookback default unchanged at "yesterday 00:00 local" — covers both an EOD post late evening and a morning standup at 7am without manual `--since`. Quality gates updated to enforce the new layout (correct emoji + section names; `- N/A` for empty; no Markdown headings in Slack form; no GitHub- style links). The skill is still read-only and never posts. The user copies from the temp file and pastes into Slack manually. Co-authored-by: Cursor <cursoragent@cursor.com> * QVAC-18394 chore: align devops skills to sdk-pod conventions Self-audit pass against `.cursor/rules/sdk/skill-authoring-guidelines.mdc` and the SDK pod's reference skills (sdk-pr-status, sdk-pr-create, sdk-changelog, sdk-backmerge). Documentation-only. Description tightening: - devops-pr-status: 341 → 275 chars - devops-pr-create: 269 → 231 chars - devops-daily-update: 398 → 255 chars - devops-pr-review: 386 → 271 chars Reference: sdk-pr-status's description is 256 chars. All four are now in the same 230–280 range, vs the prior 270–400 range. WHAT/WHEN preserved on each. Heading consistency: - "## Quality gates" → "## Quality Checklist" in devops-daily-update, devops-pr-review (sdk-changelog / sdk-backmerge / sdk-pr-create all use "Quality Checklist") - "## Validation gate (CLIENT-SIDE)" → "## Validation" in devops-pr-create (no SDK skill uses uppercase parenthetical scope qualifiers in headings) Editorial cleanup: - devops-pr-status: dropped the "Resolves the Stale-Prs subtask of QVAC-18394 …" paragraph (skill bodies should not reference their own PR/ticket; SDK skills never do) - devops-daily-update: dropped the upfront "## Canonical template" section (~25 lines). Step 8's "#### Slack form (canonical)" is the single source of truth for the format. Folded the one unique line — bare-ticket bullets allowed when self-evident — into Step 8. Reduced devops-daily-update from 269 → 242 lines. Other line-counts stable (46, 183, 140). No behaviour changes. Cross-file references still resolve. Frontmatter parses; name matches dir; disable-model-invocation: true preserved on all four. ReadLints clean. Co-authored-by: Cursor <cursoragent@cursor.com> * QVAC-18394 fix: devops skill issues found during test pass - github-actions.mdc § Permissions: accept top-level OR per-job permissions blocks as equivalent (per-job is the more secure narrower-scope pattern). - github-actions.mdc § File layout: add integration-<scope>-<pkg>.yml to the canonical filename list (existing repo convention). - devops-pr-review SKILL.md: tighten A2 + A15 check descriptions to mirror the loosened rule (audit becomes more permissive — no consumers break). - devops-daily-update SKILL.md: trim merged-PRs gh-search --json field set to what the API actually exposes (closedAt, not mergedAt/ additions/deletions); add cap of 5 most-recently-updated reviews to the standup output with overflow line. - devops-pr-create SKILL.md + devops.md PR template: drop the redundant "be concise" Note line from the template head. All issues uncovered by the end-to-end test session of the four new devops skills on this branch. Co-authored-by: Cursor <cursoragent@cursor.com> * QVAC-18394 fix: emit paste-ready output files in devops pr-status + pr-create - devops-pr-status: tee dashboard stdout to /tmp/devops-pr-status-<date>.txt and redirect stderr to a sibling .stderr file. Print pbcopy/xclip/wl-copy commands so the operator can paste the dashboard straight into a Slack thread (Slack auto-renders the indented plain text as nested bullets and turns #<num> into PR auto-links). - devops-pr-create: add an explicit step 8 to write the assembled PR body to /tmp/pr-body.md (the gh CLI Integration section already cat's that path). Add the pbcopy/xclip/wl-copy commands as step 9 for direct paste into the GitHub PR-create form. Discovered during the test pass — the dashboard output was useful but the operator had to manually copy from the terminal. Now there's a single pbcopy command to grab paste-ready content. Co-authored-by: Cursor <cursoragent@cursor.com> * QVAC-18394 chore: drop commit-and-pr-format rule cross-references in skills Mirror the rule deletion on PR #1926 — remove dead links from devops-pr-create and devops-pr-review SKILL.md, and inline the title regex / allowed prefixes / allowed tags so the skills stay self-contained without auto-loading anything via globs. - devops-pr-create: Format References now points at the inline Validation regex; the "see rule" parenthetical in Validation is replaced with a one-line note that no pr-validation-devops.yml exists yet; the References bullet for the deleted rule is removed. - devops-pr-review: drop commit-and-pr-format from the auto-load list in step 4 (it's deleted, no longer auto-loads); inline the format spec in step 5 (regex + prefixes + tags); replace the rule bullet in References with a pointer to devops-pr-create as the canonical home for the format spec. No behavior changes — same regex, same prefix/tag list, same validation logic. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>

Proletter requested a review from a team as a code owner May 6, 2026 16:00

Proletter requested a review from a team as a code owner May 6, 2026 16:18

Proletter force-pushed the feat/QVAC-18394-devops-skills branch from 3b22dda to a7d31f8 Compare May 7, 2026 08:48

Proletter and others added 6 commits May 7, 2026 13:32

Proletter force-pushed the feat/QVAC-18394-devops-skills branch from a7d31f8 to 5ac0e3c Compare May 7, 2026 12:33

NamelsKing approved these changes May 7, 2026

View reviewed changes

NamelsKing approved these changes May 10, 2026

View reviewed changes

tamer-hassan-tether approved these changes May 11, 2026

View reviewed changes

sidj-thr approved these changes May 11, 2026

View reviewed changes

Proletter merged commit 5a020bd into feat/QVAC-18394-devops-team-rules May 11, 2026
7 of 9 checks passed

Proletter deleted the feat/QVAC-18394-devops-skills branch May 11, 2026 09:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

QVAC-18394 feat: add devops pod skills (pr-status, pr-create, daily-update, pr-review)#1929

QVAC-18394 feat: add devops pod skills (pr-status, pr-create, daily-update, pr-review)#1929
Proletter merged 6 commits into
feat/QVAC-18394-devops-team-rulesfrom
feat/QVAC-18394-devops-skills

Proletter commented May 6, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 7, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

Proletter commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎯 What problem does this PR solve?

📝 How does it solve it?

🧪 How was it tested?

Uh oh!

github-actions Bot commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Tier-based Approval Status

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Proletter commented May 6, 2026 •

edited

Loading

github-actions Bot commented May 7, 2026 •

edited

Loading