submit-pr

Submit Pull Request Workflow

Create a well-documented pull request for the current feature branch, following the project's trunk-based development workflow and PR template.

[!CAUTION] Scope boundary: This skill pushes code, creates pull requests, monitors CI, and commits CI fixes (with user approval). It does NOT implement new features or run formal code reviews. When the PR is created and CI passes, stop — the workflow is complete.

[!WARNING] Checkpoint protocol. When this workflow reaches a ### CHECKPOINT, you must actively prompt the user for a decision — do not simply present information and continue. Use your agent's interactive prompting mechanism (e.g., AskUserQuestion in Claude Code) to require an explicit response before proceeding. This prevents queued or in-flight messages from being misinterpreted as approval. If your agent lacks interactive prompting, output the checkpoint content and stop all work until the user explicitly responds.

Step 1: Pre-Submission Checks

Verify the branch is ready for a pull request:

1. Confirm we are on a feature branch (not main). If on main, stop and ask the user to create a feature branch first.

2. Sync with main:

   git fetch origin
   git rebase origin/main
   

   If there are conflicts, stop and help the user resolve them before proceeding.

3. Run your project's quality checks:

   # Adapt to your project's toolchain
   type-check      # TypeScript tsc, mypy, etc.
   lint            # ESLint, Ruff, golangci-lint, etc.
   format:check    # Prettier, Black, gofmt, etc.
   test            # Vitest, Jest, pytest, etc.
   build           # If a build step exists
   

   If formatting checks fail, auto-fix by running the formatter on the reported files and stage the changes.

4. Perform a final security scan on changed files:

   • Are there hardcoded secrets, API keys, or credentials in the diff?
   • Are all user inputs validated and sanitized?
   • Are authentication and authorization checks present on new endpoints?
   • Are error responses safe? (no internal details leaked)
   • Are dependencies free of known CVEs?