[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AD47FND6TESXRBS4PAKGFD":3,"skill-same:01M6AD47FND6TESXRBS4PAKGFD":62},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":33,"linkOnly":34,"markdownContent":35,"markdownBody":36,"frontMatter":37,"refName":38,"commitSha":39,"skillDirectory":40,"forksCount":41,"repositoryHtmlUrl":42,"repositoryHomepageUrl":43,"ownerHtmlUrl":44,"ownerBlogUrl":45,"ownerDescription":46,"updatedAt":47,"install":48,"resources":61},"01M6AD47FND6TESXRBS4PAKGFD","checkout-credential-review",null,"Review code that performs git or gh operations against repository checkouts in gh-aw, checking that the right credentials are available at the right time and that sparseness, shallowness and credential-free factors are properly considered.","github\u002Fgh-aw","github","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","01M6AC83DS133TPXFSP1DHNCC6","GitHub","01M6AD3VCZ4WKQSFSRTPN7N9DN",5625,"MIT","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fcheckout-credential-review\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32],"review","checkout credential review","credential","checkout","code","git","repository","credentials","review code","gh","operations","time","free","at","2026-11-10 10:12:30",false,"---\nname: checkout-credential-review\ndescription: Review code that performs git or gh operations against repository checkouts in gh-aw, checking that the right credentials are available at the right time and that sparseness, shallowness and credential-free factors are properly considered.\n---\n\n# Checkout Credential Review\n\nUse this skill when reviewing or writing code in `pkg\u002Fworkflow\u002F`, `actions\u002Fsetup\u002Fjs\u002F`, or compiled `.lock.yml` workflows that runs `git`, `gh`, or any other remote-touching operation against a repository checkout.\n\n## Background\n\nEach entry in a workflow's `checkout:` block may declare its own credentials (`github-token:`, `github-app:`), and the compiler wires those into the corresponding `actions\u002Fcheckout` step ([pkg\u002Fworkflow\u002Fcheckout_step_generator.go](..\u002F..\u002F..\u002Fpkg\u002Fworkflow\u002Fcheckout_step_generator.go)). Generated checkouts always set `persist-credentials: false`, so the on-disk repo retains **no** credentials after the step finishes — only `actions\u002Fcheckout`'s own internal token is used during the clone, and it is scrubbed in its post-step.\n\nA separate step that wants to authenticate later must either (a) re-inject a token at command level (e.g. `git -c http.extraheader=...`) or (b) be passed the per-checkout token via env. The compiler does *not* automatically thread per-checkout `github-token`s into downstream steps.\n\nTwo important contexts deliberately run with **no git credentials**:\n\n- The **safe-outputs MCP server** and its handlers (`generate_git_bundle.cjs`, `generate_git_patch.cjs`, `create_pull_request.cjs`). Errors in these paths explicitly say \"the safe-outputs MCP server has no credentials for private repositories\" — fetch\u002Fpush will fail for private repos.\n- The **agent runtime** after `actions\u002Fcheckout`. The agent prompt in [actions\u002Fsetup\u002Fmd\u002Fsafe_outputs_push_to_pr_branch.md](..\u002F..\u002F..\u002Factions\u002Fsetup\u002Fmd\u002Fsafe_outputs_push_to_pr_branch.md) explicitly tells the model not to attempt `git fetch`, `git pull`, `git push`, or any other authenticated git operation, and to report unavailable branches rather than try to fetch them.\n\n## Review checklist\n\nWhen you see a new `git`, `gh`, `execFileSync('git'…)`, or compiled `run:` block:\n\n1. **Does it touch a remote?** Local-only commands (`symbolic-ref`, `rev-parse`, `log`, `show`, `merge-base`, `diff`, `status`) need no credentials. Anything in `fetch | pull | push | clone | ls-remote | remote (set-url|add|update)` does, plus on-demand blob fetches in partial clones.\n2. **Which checkout is it operating on?** If it's a cross-repo entry from `checkout:`, the relevant credential is *that entry's* `github-token`, not the workflow's default `GITHUB_TOKEN`. Confirm the per-entry token is actually threaded into the step's env (or refuse to do remote operations and degrade gracefully).\n3. **Which job\u002Fcontext emits it?** Agent job and safe-outputs MCP server both run without git credentials by design. Any remote git operation there must be wrapped in `try\u002Fcatch`, fail soft, and surface a clear \"no credentials\" error rather than a raw git stderr.\n4. **Sparse \u002F shallow \u002F monorepo concerns.** Avoid emitting steps that deepen (`git fetch --unshallow`, `--deepen=N`) or widen (`git fetch origin '+refs\u002Fheads\u002F*'`) a sparse or shallow checkout of a large monorepo — these need credentials *and* can pull hundreds of MB. Prefer expanding `fetch:` \u002F `fetch-depth:` \u002F `sparse-checkout:` at compile time so it happens during `actions\u002Fcheckout` with its internal token, never later.\n5. **`gh` is REST, not git.** `gh api …` uses whatever `GH_TOKEN` is in the step's env — it does **not** automatically inherit per-checkout PATs. For cross-org private repos, either thread the right token in or accept the call will 404 and handle it.\n\n## Related\n\n- [docs\u002Fsrc\u002Fcontent\u002Fdocs\u002Freference\u002Fcheckout.md](..\u002F..\u002F..\u002Fdocs\u002Fsrc\u002Fcontent\u002Fdocs\u002Freference\u002Fcheckout.md) — \"Git Credentials After Checkout\"\n- [docs\u002Fsparseness.md](..\u002F..\u002F..\u002Fdocs\u002Fsparseness.md) — sparse\u002Fblobless credential lifecycle\n- [pkg\u002Fworkflow\u002Fcheckout_step_generator.go](..\u002F..\u002F..\u002Fpkg\u002Fworkflow\u002Fcheckout_step_generator.go) — token wiring per checkout\n- [actions\u002Fsetup\u002Fmd\u002Fsafe_outputs_push_to_pr_branch.md](..\u002F..\u002F..\u002Factions\u002Fsetup\u002Fmd\u002Fsafe_outputs_push_to_pr_branch.md) — agent-facing guidance\n","# Checkout Credential Review\n\nUse this skill when reviewing or writing code in `pkg\u002Fworkflow\u002F`, `actions\u002Fsetup\u002Fjs\u002F`, or compiled `.lock.yml` workflows that runs `git`, `gh`, or any other remote-touching operation against a repository checkout.\n\n## Background\n\nEach entry in a workflow's `checkout:` block may declare its own credentials (`github-token:`, `github-app:`), and the compiler wires those into the corresponding `actions\u002Fcheckout` step ([pkg\u002Fworkflow\u002Fcheckout_step_generator.go](..\u002F..\u002F..\u002Fpkg\u002Fworkflow\u002Fcheckout_step_generator.go)). Generated checkouts always set `persist-credentials: false`, so the on-disk repo retains **no** credentials after the step finishes — only `actions\u002Fcheckout`'s own internal token is used during the clone, and it is scrubbed in its post-step.\n\nA separate step that wants to authenticate later must either (a) re-inject a token at command level (e.g. `git -c http.extraheader=...`) or (b) be passed the per-checkout token via env. The compiler does *not* automatically thread per-checkout `github-token`s into downstream steps.\n\nTwo important contexts deliberately run with **no git credentials**:\n\n- The **safe-outputs MCP server** and its handlers (`generate_git_bundle.cjs`, `generate_git_patch.cjs`, `create_pull_request.cjs`). Errors in these paths explicitly say \"the safe-outputs MCP server has no credentials for private repositories\" — fetch\u002Fpush will fail for private repos.\n- The **agent runtime** after `actions\u002Fcheckout`. The agent prompt in [actions\u002Fsetup\u002Fmd\u002Fsafe_outputs_push_to_pr_branch.md](..\u002F..\u002F..\u002Factions\u002Fsetup\u002Fmd\u002Fsafe_outputs_push_to_pr_branch.md) explicitly tells the model not to attempt `git fetch`, `git pull`, `git push`, or any other authenticated git operation, and to report unavailable branches rather than try to fetch them.\n\n## Review checklist\n\nWhen you see a new `git`, `gh`, `execFileSync('git'…)`, or compiled `run:` block:\n\n1. **Does it touch a remote?** Local-only commands (`symbolic-ref`, `rev-parse`, `log`, `show`, `merge-base`, `diff`, `status`) need no credentials. Anything in `fetch | pull | push | clone | ls-remote | remote (set-url|add|update)` does, plus on-demand blob fetches in partial clones.\n2. **Which checkout is it operating on?** If it's a cross-repo entry from `checkout:`, the relevant credential is *that entry's* `github-token`, not the workflow's default `GITHUB_TOKEN`. Confirm the per-entry token is actually threaded into the step's env (or refuse to do remote operations and degrade gracefully).\n3. **Which job\u002Fcontext emits it?** Agent job and safe-outputs MCP server both run without git credentials by design. Any remote git operation there must be wrapped in `try\u002Fcatch`, fail soft, and surface a clear \"no credentials\" error rather than a raw git stderr.\n4. **Sparse \u002F shallow \u002F monorepo concerns.** Avoid emitting steps that deepen (`git fetch --unshallow`, `--deepen=N`) or widen (`git fetch origin '+refs\u002Fheads\u002F*'`) a sparse or shallow checkout of a large monorepo — these need credentials *and* can pull hundreds of MB. Prefer expanding `fetch:` \u002F `fetch-depth:` \u002F `sparse-checkout:` at compile time so it happens during `actions\u002Fcheckout` with its internal token, never later.\n5. **`gh` is REST, not git.** `gh api …` uses whatever `GH_TOKEN` is in the step's env — it does **not** automatically inherit per-checkout PATs. For cross-org private repos, either thread the right token in or accept the call will 404 and handle it.\n\n## Related\n\n- [docs\u002Fsrc\u002Fcontent\u002Fdocs\u002Freference\u002Fcheckout.md](..\u002F..\u002F..\u002Fdocs\u002Fsrc\u002Fcontent\u002Fdocs\u002Freference\u002Fcheckout.md) — \"Git Credentials After Checkout\"\n- [docs\u002Fsparseness.md](..\u002F..\u002F..\u002Fdocs\u002Fsparseness.md) — sparse\u002Fblobless credential lifecycle\n- [pkg\u002Fworkflow\u002Fcheckout_step_generator.go](..\u002F..\u002F..\u002Fpkg\u002Fworkflow\u002Fcheckout_step_generator.go) — token wiring per checkout\n- [actions\u002Fsetup\u002Fmd\u002Fsafe_outputs_push_to_pr_branch.md](..\u002F..\u002F..\u002Factions\u002Fsetup\u002Fmd\u002Fsafe_outputs_push_to_pr_branch.md) — agent-facing guidance\n",{"name":5,"description":7},"main","8541229759617347888641eba917d3b0ad66a984",".github\u002Fskills\u002Fcheckout-credential-review",625,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw","https:\u002F\u002Fgh.io\u002Fgh-aw","https:\u002F\u002Fgithub.com\u002Fgithub","https:\u002F\u002Fgithub.com\u002Fabout","How people build software.","2026-11-13 03:17:57",{"source":8,"skillName":5,"commands":49,"prompt":59,"zipAvailable":60},[50,53,56],{"tool":51,"command":52},"npx","npx skills add github\u002Fgh-aw --skill checkout-credential-review",{"tool":54,"command":55},"bunx","bunx skills add github\u002Fgh-aw --skill checkout-credential-review",{"tool":57,"command":58},"pnpm","pnpm dlx skills add github\u002Fgh-aw --skill checkout-credential-review","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fcheckout-credential-review\u002FSKILL.md",true,[],[63,91,108,133,159,177],{"skillNo":64,"name":65,"nameZh":6,"description":66,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":67,"categories":68,"keywords":77,"publishedAt":33},"01M6ADC942STTXHFV410J4DH0X","GitHub Agentic Workflows","GitHub Agentic Workflows (`gh-aw`) is a GitHub CLI extension for writing Agentic Workflows in markdown and compiling them to GitHub Actions.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002FSKILL.md",[69,74],{"categoryNo":70,"categoryName":71,"taxonomyType":72,"taxonomyTypeDesc":73},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":75,"categoryName":76,"taxonomyType":72,"taxonomyTypeDesc":73},"01JBSEEDCAT000000000000023","Skill与智能体开发",[9,78,79,80,81,82,28,83,84,85,86,87,88,89,90],"agentic","agentic workflows","github agentic workflows","workflows","github cli","extension","for","compiling","cli","writing","actions","github actions","markdown",{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":97,"publishedAt":33},"01M6ADC6ZXSA46N9XD6VNAP1MS","windows-compatibility","Cross-platform path handling and command patterns","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002F.squad\u002Ftemplates\u002Fskills\u002Fwindows-compatibility\u002FSKILL.md",[],[98,99,100,101,102,103,104,105,106,107,24],"windows","windows compatibility","compatibility","bugs","path","high","platform","cross-platform","patterns","command",{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":114,"publishedAt":33},"01M6ADC44957SVQF96R5YY247P","versioning-policy","Semver versioning rules for Squad SDK and CLI — prevents prerelease version incidents","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002F.squad\u002Ftemplates\u002Fskills\u002Fversioning-policy\u002FSKILL.md",[],[115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,84,131,86,132],"policy","versioning policy","versioning","incident","gate","implementation","version","Rules","workspace","pr","ci","npm","semver","release","squad","resolution","incidents","sdk",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":143,"publishedAt":33},"01M6ADC1PHMEAEVR87F8PDR89X","tiered-memory","Three-tier agent memory model (hot\u002Fcold\u002Fwiki) for context reduction per spawn","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002F.squad\u002Ftemplates\u002Fskills\u002Ftiered-memory\u002FSKILL.md",[139,142],{"categoryNo":140,"categoryName":141,"taxonomyType":72,"taxonomyTypeDesc":73},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":75,"categoryName":76,"taxonomyType":72,"taxonomyTypeDesc":73},[144,145,146,147,84,148,149,150,151,152,153,154,155,156,157,158],"tiered memory","memory","memory-management","model","cold","proposal","runtime","three","spawn","management","context","wiki","agent memory","performance","design",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":168,"publishedAt":33},"01M6ADBZTDGFM0E25EWRQEMYEH","test-discipline","Update tests when changing APIs — no exceptions","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002F.squad\u002Ftemplates\u002Fskills\u002Ftest-discipline\u002FSKILL.md",[165],{"categoryNo":166,"categoryName":167,"taxonomyType":72,"taxonomyTypeDesc":73},"01JBSEEDCAT000000000000008","测试与质量",[169,170,171,172,173,103,174,118,175,176],"test discipline","discipline","test","sync","when","tests","quality","update",{"skillNo":178,"name":129,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":182,"publishedAt":33},"01M6ADBX5MJP4Z7CG4XTV8ZVT8","Squad's command catalog and interactive menu. Invoke via \u002Fsquad (slash command) or natural language (\"squad commands\", \"what can squad do\", \"show me squad options\"). Presents categorized operations (Install & Upgrade, Team Management, Issues & PRs, Plugins & Skills, Model & Cost, Sessions & State) as an interactive picker. Routes to the right squad CLI command or the Squad coordinator agent.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Fblob\u002Fmain\u002F.squad\u002Ftemplates\u002Fskills\u002Fsquad\u002FSKILL.md",[],[129,183,184,185,186,187,188,189,190,191,192,193,194,107,147,195,196,197,198,199,200,201,86],"show","interactive menu","invoke","coordinator","as","commands","upgrade","options","me","natural language","do","install","team","show me","plugins","issues","state","squad commands","sessions"]