Borrowing it
Nothing to install: this file belongs to Human-Agent-Society/CORAL. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Human-Agent-Society/CORAL/main/.claude/skills/promoting-dev-to-main/SKILL.mdgit clone --depth 1 https://github.com/Human-Agent-Society/CORALWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/human-agent-society/coral/promoting-dev-to-main)<a href="https://agentmods.dev/skills/human-agent-society/coral/promoting-dev-to-main"><img src="https://agentmods.dev/badge/skills/human-agent-society/coral/promoting-dev-to-main/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/human-agent-society/coral/promoting-dev-to-main"><img src="https://agentmods.dev/badge/skills/human-agent-society/coral/promoting-dev-to-main.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.00569 |
| Opus 5 | $0.00016 | $0.00284 |
| Sonnet 5 | $0.00007 | $0.00114 |
| Haiku 4.5 | $0.00003 | $0.00057 |
Grade A, and why
promoting-dev-to-main scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Promoting dev to main
Core rule
Merge dev → main release PRs with a merge commit. Never squash or rebase
these promotions.
Ordinary contribution PRs still target dev and may be squash-merged. The
release promotion is the exception because main must retain dev in its
ancestry. Squashing a promotion makes the next release re-present old commits
and can create large false conflicts.
Workflow
-
Confirm the PR is exactly
base=main,head=devand no duplicate release PR is open. -
Review
main..dev, required CI, and deployment checks. -
In GitHub, open the merge-method dropdown and choose Create a merge commit. With the CLI, use:
gh pr merge <number> --repo Human-Agent-Society/CORAL --merge -
Keep the long-lived
devbranch. Do not delete or force-push it. -
Fetch both branches and verify the released
devtip is an ancestor ofmain:git fetch origin dev main git merge-base --is-ancestor origin/dev origin/mainExit status
0is required. -
Confirm post-merge CI, release automation, deployments, and production smoke checks.
If GitHub reports conflicts
Do not force-rebase the shared dev branch. First inspect the topology and
reproduce conflicts with git merge-tree.
If an earlier release was squash-merged, main may have the same tree as an
earlier dev commit without sharing its ancestry. Verify tree equivalence
before choosing a repair. Prefer merging main back into dev and pushing
normally; use an ancestry-only ours merge only when exact tree equality
proves main contains no unique content to preserve.
Red flags
- GitHub's primary button says Squash and merge.
- A command uses
--squash,--rebase, or a force-push. - The release workflow proposes deleting
dev. - Conflict resolution starts before checking commit topology and tree equality.
Stop when any red flag appears and return to the workflow above.
Quick reference
| PR | Allowed merge method |
|---|---|
Feature/fix/docs branch → dev |
Repository default; usually squash |
dev → main release promotion |
Merge commit only |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 69 lines · 33 tokens per session scan A c86ac311166b
promoting-dev-to-main is a skill published in the GitHub repository Human-Agent-Society/CORAL (975 stars, last pushed 3d ago), licensed Apache-2.0. It adds 33 tokens to every session and 569 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
codew-release-qa-sweep
Use before claiming Codewhale release work is done: run the full gate sweep and list the manual QA targets.
gh-credit-harvest
Harvest one community PR into a release branch with authorship and credit preserved, verified green, and a warm thank-you.
release
Prepare a named version: preflight, version consistency, build/package, smoke test, checksums/notes, and release readiness. Publishing/tagging/deploy need separate authorization. Explicit-only.
loop-it
Automated issue loop with checkpoint/resume: fetch open GitHub issues → dependency-aware topological sort → implement each issue end-to-end → review with /review-it → document with /note-it → ship with /ship-it → repeat. Persists state to .loop-state.json for crash recovery. Triggers on: loop-it, loop issues, auto…
ship-it
A GitHub delivery workflow that commits completed changes, pushes a branch, creates and merges a pull request, and closes the related issue.
release-helper
Ensures configuration and code changes are released correctly. Use PROACTIVELY whenever you edit config.json, change any setting, or fix a configuration bug in this project, so the change reaches production.