What is repo-onboarding-standards?

A repository setup guide that establishes shared rules for AI coding assistance, continuous integration (automated build and test checks), security, and releases. It is intended for bringing a new or inconsistent code repository up to a common baseline.

Use it when starting work in a repository, adding project instructions, provisioning issue labels, checking CI coverage, or reviewing release and security requirements.

It removes the guesswork of deciding which project rules, labels, checks, and release controls a repository needs before work begins.

repo-onboarding-standards — Skill for Claude Code by chf3198

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add chf3198/copilot-governance --skill repo-onboarding-standards

Clone the repo

git clone --depth 1 https://github.com/chf3198/copilot-governance

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/chf3198/copilot-governance/repo-onboarding-standards/github.svg)](https://agentmods.dev/skills/chf3198/copilot-governance/repo-onboarding-standards)

Your own site

<a href="https://agentmods.dev/skills/chf3198/copilot-governance/repo-onboarding-standards"><img src="https://agentmods.dev/badge/skills/chf3198/copilot-governance/repo-onboarding-standards/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/chf3198/copilot-governance/repo-onboarding-standards"><img src="https://agentmods.dev/badge/skills/chf3198/copilot-governance/repo-onboarding-standards.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 35 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 562 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00035	$0.00562
Opus 5	$0.00017	$0.00281
Sonnet 5	$0.00007	$0.00112
Haiku 4.5	$0.00003	$0.00056

Measured 11d ago against content hash 4e77e80fc0f6, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

repo-onboarding-standards scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/repo-onboarding-standards/SKILL.md · 55 lines

How it starts

The opening of the file, as written. The whole thing — 55 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Repo Onboarding Standards

When to use

First session in a new repository.
Existing repositories lacking standardized AI customization and release/security gates.
Requests like: "include all global-skills in your initialization process."

Procedure

Run global-skills-bootstrap in mode=init for repository scaffolding.
Provision canonical label taxonomy: node scripts/global/label-provision.js --repo=<owner/repo>. This seeds all type:*, status:*, priority:*, role:*, area:*, lane:*, resolution:*, and governance labels required for the baton lifecycle. Manifest: scripts/global/label-manifest.json (Refs #2785).
Classify repository type and risk profile using existing routing skills.
Generate baseline repo instructions (.github/copilot-instructions.md) with build/test/gate truth.
Add targeted .github/instructions/*.instructions.md files for stack-specific rules.
Verify CI has minimum baseline: lint/test, dependency/security review, artifact/release checks.
Add or update release policy controls (version integrity, docs sync, packaging audit).
For platforms that support exact-version install/pin, require version-selectability controls:
- immutable artifact retention,
- exact-version install smoke checks,
- canonical version index/source alignment for update prompts,
- documented rollback and version-yank policy.
Produce an onboarding report with required vs optional controls and evidence.

Required handoffs

Run global-skills-bootstrap first for new repositories.
Route standards selection via repo-standards-router.
Route GitHub workflow governance controls via github-ops-tree-router.
Use workflow-self-anneal only post-failure/process mismatch.

Output format

repo_classification: type + confidence
baseline_status: complete|partial|missing
required_controls: must-have controls
optional_controls: nice-to-have controls
execution_plan: sequenced rollout tasks
evidence: files and checks used for conclusions

Read the full file on GitHub · 55 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

11d ago First seen · 55 lines · 35 tokens per session scan A 4e77e80fc0f6

Subscribe to this mod's changes

repo-onboarding-standards is a skill published in the GitHub repository chf3198/copilot-governance (2 stars, last pushed 1mo ago), licensed MIT. It adds 35 tokens to every session and 562 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

CI and CD DevOps and cloud Git and workflow Releases

ship

Ship workflow: detect + merge base branch, run tests, review diff, bump VERSION, update CHANGELOG, commit, push, create PR. (gstack).

garrytan/gstack · 35 tokens

gitlab-devops

GitLab DevOps operations — issues, merge requests, CI/CD pipelines, repository browsing, labels, milestones, releases, and wiki management. Use when querying GitLab project status, monitoring pipeline executions, browsing repository files, creating issues for network findings, opening merge requests for config…

automateyournetwork/netclaw · 67 tokens

seed-snapshot-release

An automated workflow for creating and tracking a snapshot release of the pull request on the current branch. A snapshot release is a temporary package build used for testing a branch before a normal release.

daangn/seed-design · 19 tokens

push-ci

Push to remote and monitor CI. Validates branch safety, executes git push WITH explicit user approval, then monitors CI run status via gh CLI. Use when: user says 'push', 'push and watch CI', 'ship it', 'push-ci'. Not for: committing (use /smart-commit), creating PRs (use /create-pr), merging (use /merge-prep).

sd0xdev/sd0x-harness · 82 tokens

release-engineering

Plan and verify software releases with versioning, changelogs, release branches, feature flags, canaries, migration gates, rollback, deployment checks, and release readiness. Use when preparing a release, shipping a risky PR, coordinating app/backend/database rollout, recovering from a bad deploy, or defining release…

majiayu000/spellbook · 69 tokens

cmux-release

Prefer the /release command. It determines the new version (minor by default), gathers commits since the last tag, updates CHANGELOG.md, runs ./scripts/bump-version.sh, commits, runs ./scripts/release-pretag-guard.sh, then tags and pushes.

manaflow-ai/cmux · 39 tokens