A pull-request workflow for the drydock repository. It defines how to use development and release branches, name branches, write commit messages, and run required checks.

Use it when creating or updating drydock branches, commits, or pull requests, including choosing labels and running local CI checks.

It prevents pull requests from targeting the release branch incorrectly and catches formatting, shell-script, test, and commit-message problems before pushing.

How sideralith/drydock configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to sideralith/drydock. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/sideralith/drydock/main/.claude/skills/drydock-prs/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/sideralith/drydock

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/sideralith/drydock/drydock-prs.svg)](https://agentmods.dev/skills/sideralith/drydock/drydock-prs)

Your own site

<a href="https://agentmods.dev/skills/sideralith/drydock/drydock-prs"><img src="https://agentmods.dev/badge/skills/sideralith/drydock/drydock-prs.svg" alt="Measured on agentmods" height="20"></a>

Per session 55 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,200 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00055	$0.01200
Opus 5	$0.00028	$0.00600
Sonnet 5	$0.00011	$0.00240
Haiku 4.5	$0.00006	$0.00120

Measured 7d ago against content hash 9359b14d0f51, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

drydock-prs scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/drydock-prs/SKILL.md · 60 lines

How it starts

The opening of the file, as written. The whole thing — 60 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Activation Contract

Active when working in the drydock repo AND about to create a branch, commit, push, or open/update a PR against it. Do NOT apply to PR work on other repos.

Hard Rules

PRs target dev, NEVER main. main holds only released versions; each commit on main is a tagged release. A feature/fix PR against main is the wrong base branch.
Branch naming: type/short-description (e.g., feat/add-podman-support, fix/submount-detection-macos). The type segment matches the commit type prefix.
Conventional Commits on EVERY commit subject: type(scope): subject. Valid types: feat | fix | docs | refactor | test | style | chore. CI-enforced by scripts/lint-commits.sh (job: Lint (commit-message)).
NO Co-Authored-By trailers — prohibited (CLAUDE.md §5). Soft norm, not CI-enforced.
NEVER --no-verify. NEVER --force on shared branches.
Three CI gates MUST be green; run locally before push:
- shellcheck bin/drydock lib/*.sh scripts/*.sh install.sh → no errors
- shfmt -d bin/drydock lib/ scripts/ install.sh → no diff
- scripts/test.sh → all pass (NOT bare bats test/ inside a drydock container — /tmp is noexec under INV-8; the wrapper redirects bats' tmpdir to an exec-allowed path)
- Plus: scripts/lint-commits.sh → mirrors the commit-message gate locally
Every PR should link the issue it closes (e.g., Closes #N in the body). The maintainer closes the linked issue manually at merge time because the merge target is dev, not the default branch — GitHub does not auto-close.
Every Bash script MUST start with set -euo pipefail (CLAUDE.md §3). No eval over user input; no bash -c "$untrusted".
Every compose path MUST be parameterized (${HOME}, ${USER_NAME}, ${DRYDOCK_*}). No literal user-specific paths.

Decision Gates

Changed lines > 400? → Apply size:l AND either split per chained-pr OR negotiate size:exception with the maintainer BEFORE opening. Do not open a size:l PR silently.
Touching an invariant (INV-1 … INV-8)? → Cite the INV explicitly in PR body, restate the rule, and justify why the change preserves it. Do NOT silently soften an invariant.
Adding adversarial protection (socket-proxy, sandboxing, namespace remap, rootless Docker)? → INV-7 / §4 boundary push. Requires documented real-user demand AND maintenance-cost analysis in the PR body.
PR is a release (dev → main)? → Maintainer-only path. Bumps DRYDOCK_VERSION in lib/common.sh, tags vX.Y.Z, publishes a GitHub Release. NOT a normal contribution route.
Mutating host artifacts (sibling .git/config, host ~/.gitconfig, ~/.ssh, ~/.gnupg)? → INV-1 violation. Route via drydock-owned files under ~/.config/drydock/ and container-only mechanisms (url.insteadOf, managed SSH config, GIT_SSH_COMMAND).

Read the full file on GitHub · 60 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

7d ago First seen · 60 lines · 55 tokens per session scan A 9359b14d0f51

Subscribe to this mod's changes

drydock-prs is a skill published in the GitHub repository sideralith/drydock (5 stars, last pushed 1mo ago), licensed MIT. It adds 55 tokens to every session and 1,200 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Claude Code Commits Git and workflow Releases ai-agents cli containerization defense-in-depth developer-tools

git

This skill should be used when the user asks to "commit changes", "create a pull request", "rebase safely", "manage branches", "fix merge conflicts", "undo a commit", "comment on a PR", "create a release", or performs any git/GitHub operations. Provides safety patterns, atomic commit formatting, PR descriptions…

dean0x/devflow · 82 tokens

commit-pr

Mandatory Codex/Copilot publication adapter for opencode-swarm. Use for every GitHub issue assignment that results in code changes, commits, pushes, draft PRs, PR body edits, PR readying, release notes, or CI closeout. Must be loaded before git push, gh pr create, gh pr edit, or gh pr ready. Routes to the single…

ZaxbyHub/opencode-swarm · 100 tokens

release-expert

Multi-repo release coordination: version alignment, RC lifecycle, release waves, rollback planning. Use when saying "release", "version alignment", or "cut an RC".

anton-abyzov/specweave · 0 tokens

do

Work an increment task by task through the ledger: task next, claim, implement, commit, task done with evidence. Use when saying "implement", "start working", or "continue increment".

anton-abyzov/specweave · 0 tokens

contributing

Codex adapter for the opencode-swarm contribution checklist. Use when preparing user-visible changes, release note fragments, local validation, branch hygiene, PR checklist items, or contribution-policy compliance before publishing work.

ZaxbyHub/opencode-swarm · 44 tokens

atomic-git-discipline

Compressed commit message and PR body generator. Cuts noise from both while preserving intent and reasoning. Conventional Commits format. Subject ≤50 chars, body only when "why" isn't obvious; PR bodies state only what the diff can't show, 120 words max. Use when user says "write a commit", "commit message", "generate…

damusix/atomic-claude · 106 tokens

drydock: Skill for Claude Code