pr-jira-linker

PR-Jira Linker

Detects PRs/MRs missing Jira references, finds or creates the matching Jira issue, and links them bidirectionally.

Required Tools

• GitHub (MCP: user-github): list_pull_requests, pull_request_read, update_pull_request
• GitLab (MCP: plugin-gitlab-GitLab): get_merge_request, get_merge_request_commits, search, create_workitem_note
• Jira (MCP: user-mcp-atlassian): jira_search, jira_add_comment, jira_create_issue
• Shell — git commands, curl for GitLab API fallback (constrained; see safety rules below)

Configuration

The skill reads repository lists and project defaults from a user-provided config.yaml file. A minimal example:

defaults:
  project_key: "MYPROJECT"
  issue_type: "Task"
  security_level: "Red Hat Employee"
  priority: "Normal"
  component: "Engineering"
  team: "My Team"
  team_id: "your-team-id-here"

repos:
  gitlab:
    - project: "my-org/my-repo"
      host: "gitlab.example.com"
  github:
    - owner: "my-org"
      repo: "my-repo"

Jira Key Detection

Scan for pattern [A-Z][A-Z0-9]+-[0-9]+ in: (1) PR/MR title, (2) description, (3) branch name, (4) commit messages. If found, mark as candidate key detected and verify bidirectional linkage (PR/MR references Jira key and Jira issue has PR/MR URL comment) before classifying as linked.

Mode 1: Single PR/MR

Trigger: User provides a PR/MR URL or says "link this PR to Jira".

Step 1: Read the PR/MR

Use pull_request_read (GitHub) or get_merge_request (GitLab). If GitLab MCP is down, fall back to curl --negotiate -u: against the GitLab REST API under the following mandatory safety constraints:

1. Host allowlist: Only issue requests to hostnames explicitly listed in config.yaml under repos.gitlab[].host. Reject any target not in the allowlist.
2. No raw IPs: Reject URLs containing raw IP addresses (IPv4 or IPv6). Resolve hostnames and reject any that resolve to private/reserved ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16, ::1, fc00::/7, fe80::/10) to prevent SSRF.
3. URL canonicalization: Parse the URL, verify scheme is https://, and reconstruct from validated components. Do not pass user-supplied URLs directly to shell commands.
4. Safe argument passing: Pass URL, host, and path as separate, safely shell-quoted arguments. Never string-concatenate untrusted input into commands. Pass credentials via environment variables (e.g., GITLAB_TOKEN), not interpolated into command strings.
5. Resource limits: Always use --max-time 30 --max-redirs 3 to enforce timeouts and limit redirects.
6. Protocol restriction: Use --proto '=https' to prevent protocol downgrade or scheme switching.