github-pre-push-gates

Pre-Push Quality Gates

Before pushing a branch to a shared remote, run through these gates. They prevent pushing credentials, PII, private history, or a broken tree. The skill covers the pre-PR quality phase — use github-pr-workflow for the PR lifecycle itself.

Dependency audit interpretation

• The standard production gate is npm audit --omit=dev --audit-level=high, but a zero result there does not clear a vulnerable developer toolchain. Run the full audit too when the repository ships or executes from source.
• Separate lockfile evidence from installed-tree evidence. npm audit --package-lock-only can pass while stale node_modules still reports old versions; use a clean npm ci in CI and then run ordinary npm audit before declaring the dependency fix verified.
• If a patched transitive version requires an override, verify every resolved package path and exercise tests/build/validation. Do not use npm audit fix --force without reviewing proposed major downgrades and behavior changes.

Workflow overview

[code complete] → [immutable verification] → [privacy scan] → [reviewer] → [push + SHA verify] → [PR]

Each gate is optional by severity — skip when the scope doesn't warrant it, but never skip the privacy scan when pushing to a shared/public remote.

Multi-agent candidate freeze

Before any final gate or read-only review, verify that no write-capable agent still owns the checkout or can advance the branch from an orchestrator/sibling worktree. A clean status alone is insufficient: interrupted parent agents can leave delegated workers alive, continuation controllers can auto-start the next task, and command | tee log can mask an agent failure unless the shell uses set -o pipefail. Freeze the exact SHA across gates and recheck HEAD/status/writers after every long command. For process checks, shared-ref/worktree freezes, dirty-tree fingerprints, safe interrupted-writer recovery, and synthetic secret-fixture classification,