github-pr-workflow

A workflow for managing GitHub pull requests, which are proposed code changes reviewed before they are merged into a repository.

In plain words
What is it for?
Create branches, commit and push changes, open and update pull requests, watch continuous-integration checks, and merge approved work using GitHub CLI or REST.
Why use it?
It organizes the steps from creating a branch and commit through opening a pull request, checking automated tests, and merging it.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/furkangonel/cowrangler/github-pr-workflow
Any agent
npx skills add furkangonel/cowrangler --skill github-pr-workflow
Clone the repo
git clone --depth 1 https://github.com/furkangonel/cowrangler

Made for: Claude Code, Codex.

Per session 25 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,519 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 2 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00025 $0.01519
Opus 5 $0.00013 $0.00759
Sonnet 5 $0.00005 $0.00304
Haiku 4.5 $0.00003 $0.00152

Measured 2d ago against content hash aec43fd01275, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

github-pr-workflow scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Sends data to an external URLmediumData exfiltration

A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.

| PR kapat | `gh pr close N` | `curl -X PATCH .../pulls/N -d '{"state":"closed"}'` |

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

PR yaşam döngüsünü yönetmek için kapsamlı rehber. Her bölüm önce `gh` CLI yolunu, ardından `git` + `curl` geri dönüş yolunu gösterir.
bundled_skills/github-pr-workflow/SKILL.md · 178 lines

How it starts

The opening of the file, as written. The whole thing — 178 lines — stays where its author put it; the contents beside it link to each section on GitHub.

GitHub Pull Request İş Akışı

PR yaşam döngüsünü yönetmek için kapsamlı rehber. Her bölüm önce gh CLI yolunu, ardından git + curl geri dönüş yolunu gösterir.

Ön Koşullar

  • GitHub'a kimlik doğrulama yapılmış (gh auth login veya GITHUB_TOKEN env değişkeni)
  • GitHub remote'u olan bir git deposunun içinde

Auth Algılama

if command -v gh &>/dev/null && gh auth status &>/dev/null; then
  AUTH="gh"
else
  AUTH="git"
  if [ -z "$GITHUB_TOKEN" ]; then
    GITHUB_TOKEN=$(grep "^GITHUB_TOKEN=" ~/.cowrangler/credentials.env 2>/dev/null | head -1 | cut -d= -f2 | tr -d '\n\r')
  fi
fi

REMOTE_URL=$(git remote get-url origin)
OWNER_REPO=$(echo "$REMOTE_URL" | sed -E 's|.*github\.com[:/]||; s|\.git$||')
OWNER=$(echo "$OWNER_REPO" | cut -d/ -f1)
REPO=$(echo "$OWNER_REPO" | cut -d/ -f2)

1. Branch Oluştur

git fetch origin
git checkout main && git pull origin main
git checkout -b feat/kullanici-girisi-ekle

Branch isimlendirme:

  • feat/açıklama — yeni özellikler
  • fix/açıklama — hata düzeltmeleri
  • refactor/açıklama — yeniden yapılandırma
  • docs/açıklama — belgeler
  • ci/açıklama — CI/CD değişiklikleri

2. Commit

git add src/auth.ts tests/auth.test.ts
git commit -m "feat: JWT tabanlı kullanıcı kimlik doğrulaması ekle

- Giriş/kayıt endpoint'leri eklendi
- Şifre hashleme ile User modeli eklendi
- Korumalı route'lar için auth middleware eklendi"

Conventional Commits formatı:

type(scope): kısa açıklama

Gerekirse uzun açıklama. 72 karakterde sar.

Tipler: feat, fix, refactor, docs, test, ci, chore, perf

3. Push ve PR Oluştur

git push -u origin HEAD

gh ile:

gh pr create \
  --title "feat: JWT tabanlı kullanıcı kimlik doğrulaması" \
  --body "## Özet
- Giriş/kayıt API endpoint'leri
- JWT token üretimi ve doğrulaması

## Test Planı
- [ ] Birim testleri geçiyor

Closes #42"

curl ile:

BRANCH=$(git branch --show-current)
curl -s -X POST \
  -H "Authorization: token $GITHUB_TOKEN" \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/repos/$OWNER/$REPO/pulls \
  -d "{\"title\":\"feat: JWT kimlik doğrulaması\",\"body\":\"Closes #42\",\"head\":\"$BRANCH\",\"base\":\"main\"}"

Read the full file on GitHub · 178 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 178 lines · 25 tokens per session scan B aec43fd01275

Subscribe to this mod's changes

github-pr-workflow is a skill published in the GitHub repository furkangonel/cowrangler (2 stars, last pushed 4d ago), licensed MIT. It adds 25 tokens to every session and 1,519 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.