GitHub Triage
trailofbits/skills
Triages open GitHub issues and pull requests with the gh CLI, optionally merging ready PRs, closing resolved issues with evidence and assigning local priority and size estimates.
Sorts a backlog of open pull requests into must-merge, candidate, superseded and deferred, writes a triage doc and works the merge loop before a release.
$ npx skills add jamiepine/voicebox --skill triage-prs -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install jamiepine/voicebox triage-prs --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/jamiepine/voicebox.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/triage-prs .claude/skills/triage-prs && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "triage-prs" agent skill from https://github.com/jamiepine/voicebox/tree/main/.agents/skills/triage-prs into .claude/skills/triage-prs/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage-prs", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/jamiepine/voicebox/tree/main/.agents/skills/triage-prsType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add jamiepine/voicebox --skill triage-prs -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install jamiepine/voicebox triage-prs --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/jamiepine/voicebox.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.agents/skills/triage-prs .agents/skills/triage-prs && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "triage-prs" agent skill from https://github.com/jamiepine/voicebox/tree/main/.agents/skills/triage-prs into .agents/skills/triage-prs/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage-prs", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add jamiepine/voicebox --skill triage-prs -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install jamiepine/voicebox triage-prs --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/jamiepine/voicebox.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.agents/skills/triage-prs .cursor/skills/triage-prs && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "triage-prs" agent skill from https://github.com/jamiepine/voicebox/tree/main/.agents/skills/triage-prs into .cursor/skills/triage-prs/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage-prs", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/jamiepine/voicebox.git --path .agents/skills/triage-prs--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add jamiepine/voicebox --skill triage-prs -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install jamiepine/voicebox triage-prs --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/jamiepine/voicebox.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.agents/skills/triage-prs .gemini/skills/triage-prs && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "triage-prs" agent skill from https://github.com/jamiepine/voicebox/tree/main/.agents/skills/triage-prs into .gemini/skills/triage-prs/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage-prs", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install jamiepine/voicebox triage-prsInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add jamiepine/voicebox --skill triage-prs -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/jamiepine/voicebox.git skills-src && mkdir -p .github/skills && cp -r skills-src/.agents/skills/triage-prs .github/skills/triage-prs && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "triage-prs" agent skill from https://github.com/jamiepine/voicebox/tree/main/.agents/skills/triage-prs into .github/skills/triage-prs/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage-prs", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add jamiepine/voicebox --skill triage-prs -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install jamiepine/voicebox triage-prs --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/jamiepine/voicebox.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.agents/skills/triage-prs .opencode/skills/triage-prs && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "triage-prs" agent skill from https://github.com/jamiepine/voicebox/tree/main/.agents/skills/triage-prs into .opencode/skills/triage-prs/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage-prs", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
triage-prsSorts a backlog of open pull requests into must-merge, candidate, superseded and deferred, writes a triage doc and works the merge loop before a release.
Meant for a solo maintainer's pre-release pass, this skill turns a backlog of open pull requests into a shipped set of merges in one session. The agent writes a tracked, resumable triage document named after the target version, then works through it: rebasing where needed, merging in isolation-safe batches, applying post-merge follow-ups, and closing superseded or partly applicable PRs while crediting their authors. It sits before the draft-release-notes and release-bump skills.
It starts by creating a separate review worktree so that checking out contributor branches does not touch main, then collects metadata for every open PR through the gh CLI: size, mergeable state, whether maintainers may edit the branch, and touched file paths to spot overlaps. Each PR goes into exactly one bucket, the first being small, mergeable, low-cost bug fixes that merge first. The excerpt stops after that first tier.
11 steps, taken from the step headings in SKILL.md.
Read from SKILL.md and the folder at commit 8af7efe. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Shell commands in SKILL.md call:
gitghFrom the folder's file list and the shell code blocks in SKILL.md.
Hosts in commands or code, which the agent is likely to contact:
github.comFrom URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Pre-Release PR Triage loads about 3.1k tokens when it runs. Until then it costs about 86 tokens; SKILL.md has 1,180 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
The full file from jamiepine/voicebox at commit 8af7efe, republished under its MIT licence (© jamiepine). 1,180 words, ~3,123 tokens.
.claude/skills/triage-prs/SKILL.md (or your agent's skills folder).Turn a backlog of open PRs into a shipped set of merges in a single focused session. Produce a tracked, resumable plan (<VERSION>_PR_TRIAGE.md), then work it — rebasing where needed, merging in isolation-safe batches, applying post-merge follow-ups, and closing superseded or partially-applicable PRs with credit to their authors.
This skill pairs with draft-release-notes and release-bump: triage first, then draft notes against the new main, then cut the release.
gh CLI authenticated against the repomain with checkouts of contributor branches)0.4.0_PR_TRIAGE.md)git worktree list # check for stale ones first
git worktree prune
git worktree add ../voicebox-pr-review -b pr-review-<VERSION> mainKeep the main worktree for release-prep work (changelog drafts, direct-to-main follow-ups). Keep the review worktree for gh pr checkout — each checkout moves HEAD to a contributor branch, which you don't want to do in the main worktree.
gh pr list --state open --limit 50 --json \
number,title,author,isDraft,mergeable,mergeStateStatus,files,additions,deletions,reviewDecision,statusCheckRollup,maintainerCanModify \
--jq '.[] | {num: .number, title, author: .author.login, mergeable, state: .mergeStateStatus, canModify: .maintainerCanModify, changes: "+\(.additions)/-\(.deletions)", files: [.files[].path]}'You want, for each PR:
+additions/-deletions)CLEAN, UNSTABLE, DIRTY = conflicts, UNKNOWN = GitHub still computing)UNKNOWN is common right after a push to main — just try the merge and see.
Sort each PR into exactly one bucket:
Tier 1 — Merge: small, mergeable, fixes a real bug, clean CI, low review cost. One-liners, dependency relaxations, targeted safety hardening. These are the easy wins.
Tier 2 — Candidate, review: medium size (50-200 lines), touches more surface area, looks sound but needs a closer read. New user-facing features that fit the product direction.
Supersede: the fix or feature is already covered by something merged. Close with a comment pointing to the superseding PR. Check carefully — "similar title" isn't proof; compare the actual diffs.
Defer to next release: big features, dirty conflicts, draft PRs, anything touching the release pipeline in ways that would introduce risk. Don't merge these in a speedrun — they need dedicated focus.
Create <VERSION>_PR_TRIAGE.md in the PR-review worktree root. Structure:
# <Repo> <VERSION> — PR Triage
Working doc for tracking which open PRs land in <VERSION>. Delete after release cut.
Last updated: <DATE>
## Progress
**Tier 1: 0 / N merged**
**Tier 2: 0 / M handled**
**Supersede triage: pending**
---
## Merge for <VERSION> — critical bug fixes
| PR | Status | Size | What it fixes | Why must-have |
|---|---|---|---|---|
| [#123](url) | [ ] | +5/-0 | ... | ... |
## Strong candidate — needs a quick review
| PR | Status | Size | Summary |
|---|---|---|---|
## Close as superseded
| PR | Status | Reason |
|---|---|---|
## Defer to <NEXT_VERSION>
- [#xxx](url) ... — reason
---
## Order of attack
1. Close superseded PRs (one-liner comments)
2. Merge tier-1 in dependency-free batches — check file paths don't overlap
3. Review tier-2 individually
4. Rerun `draft-release-notes` to pick up everything
5. Run `release-bump`The Progress header is the most important part — it's your scoreboard and lets you resume cleanly if the session gets interrupted.
For each PR in the tier-1 / tier-2 list:
a. Checkout in the review worktree:
cd ../voicebox-pr-review
git checkout pr-review-<VERSION> # reset to neutral base
gh pr checkout <N>b. Read the actual commit, not main..HEAD:
git show HEAD # the PR's actual changes
git show --stat HEAD # files touched + line countsDo NOT review via git diff main..HEAD if the PR branch is older than main. That diff includes every commit that landed on main after the PR was forked as - (deletion) lines. A 3-line PR can look like a 700-line revert. This is the single easiest way to misjudge a PR.
c. Evaluate concerns: correctness, scope, interaction with already-merged work, version compatibility (e.g. can't use an API that requires a dependency version we don't yet pin).
d. Rebase if the branch is behind main:
git fetch origin main
git rebase origin/mainThis is essential before squash-merging. GitHub's squash computes diff(PR-head, merge-base) — on a stale branch, that diff includes reverting every in-between commit. Rebasing moves the merge-base forward so the squash is clean.
e. If maintainer edits are allowed, push the rebase back to the contributor's fork:
git remote add <author> https://github.com/<author>/<repo>.git
git fetch <author> <branch> # get their ref first
git push <author> HEAD:<branch> --force-with-leaseThis keeps GitHub's PR UI in sync with the rebased state and makes the merge clean from the GitHub side.
f. Merge:
gh pr merge <N> --squashg. Update the triage doc — flip the checkbox to ✅ merged <sha> (use the short SHA from gh pr view <N> --json mergeCommit --jq '.mergeCommit.oid[0:7]'). Update the Progress header.
PRs with ≤5 line changes, clean CI, non-overlapping file paths, and obviously-correct intent (e.g. one-line dependency relax, env var add, import path fix) can be merged in a single loop without the review-per-PR ceremony:
for pr in 425 384 416 429; do
echo "=== Merging PR $pr ==="
gh pr merge $pr --squash
doneVerify afterward that each landed cleanly:
for pr in 425 384 416 429; do
gh pr view $pr --json state,mergeCommit --jq "{pr: $pr, state, sha: .mergeCommit.oid[0:7]}"
doneSometimes a PR is worth merging despite a known minor issue (e.g. incomplete dtype map, stale sentinel cleanup). Don't block the merge; apply the follow-up as a normal branch + PR right after:
cd <main-worktree>
git pull --ff-only origin main
git checkout -b fix/<short-name>
# edit...
git commit -m "fix(<area>): <one-liner>"
git push -u origin fix/<short-name>
gh pr create --title "..." --body "Follow-up to #<N>. ..."Record both SHAs in the triage doc (✅ merged <pr-sha> + follow-up <pr>).
Direct-to-main exception: only under an explicit, scoped policy (e.g. "release speedrun"). Don't default to it.
gh pr close <N> --comment "Closing — superseded by merged #<M> which landed <brief description>. Thanks!"Check the diffs first — "similar title" is not enough. If the PR is partially superseded (the diagnosis is right but only half the changes are still needed), do a partial-apply instead.
When a PR has both valuable and questionable changes bundled:
cd <main-worktree>
git pull --ff-only origin main
# Cherry-pick specific files from the PR branch
git checkout <pr-commit-sha> -- <file1> <file2>
# Review the staged changes, adjust as needed
git diff --cached
# Apply any surgical edits to files you don't want to bulk-replace
# (e.g. the PR's file predates a recent main commit you need to preserve)
# Commit with a trailer crediting the original author
git commit -m "$(cat <<'EOF'
<subject>
<body explaining what was kept vs dropped>
Co-Authored-By: <author> <noreply@github.com>
EOF
)"
git push ... # branch + PR, unless under the direct-to-main exceptionThen close the PR with a comment explaining what was applied and what was dropped, referencing the commit SHA.
Every merge, every close, every follow-up → update <VERSION>_PR_TRIAGE.md. The doc is your session log. If you're interrupted and resume tomorrow, the doc is the only source of truth for "where am I."
draft-release-notes (to regenerate [Unreleased] against the new main), then release-bumpYou can delete the triage doc after the release ships, or keep it in version history as a record.
main..HEAD on a stale branch lies. It shows everything main gained since the branch split as deletions. Always review via git show HEAD for the PR's actual commit.diff(PR-head, merge-base). Rebase moves the merge-base forward.mergeable=UNKNOWN is transient — GitHub is recomputing after a push. Just try the merge.DELETE /history/failed must be registered before DELETE /history/{id}, or the parameterized path will consume "failed" as an ID.-weak_framework overrides -framework for the same framework, regardless of order — use it via cargo:rustc-link-arg=-Wl,-weak_framework,Name when a dependency hard-links something optional.torch_dtype= → dtype=, check the min-version pin supports it. Sometimes the right move is to cherry-pick half the PR.cpal::Stream and similar !Send audio types can't cross await points or spawn_blocking. Sometimes a "not-ideal but correct" sync wait is the best available fix; flag but don't block.TORCH_CUDA_ARCH_LIST=...+PTX or wait for stable support instead.# Bulk PR metadata
gh pr list --state open --limit 50 --json number,title,author,mergeable,mergeStateStatus,additions,deletions,maintainerCanModify,files
# Detailed single-PR view
gh pr view <N> --json body,author,headRefName,baseRefName,mergeable,maintainerCanModify,files,statusCheckRollup
# The actual commit, not the branch-vs-main diff
git show HEAD
git show --stat HEAD
gh pr diff <N>
# Rebase contributor branch onto current main
git fetch origin main && git rebase origin/main
# Push rebase back to contributor fork (maintainerCanModify=true required)
git remote add <author> https://github.com/<author>/<repo>.git
git fetch <author> <branch>
git push <author> HEAD:<branch> --force-with-lease
# Merge
gh pr merge <N> --squash
# Confirm merge SHA for triage doc
gh pr view <N> --json state,mergeCommit --jq '{state, sha: .mergeCommit.oid[0:7]}'
# Close superseded
gh pr close <N> --comment "Closing — superseded by merged #<M>. Thanks!"main..HEAD. This is the single most important line in this skill.Co-Authored-By: trailers and close comments that link to the applied commit.© jamiepine, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Just SKILL.md in .agents/skills/triage-prs of jamiepine/voicebox.
Open the folder on GitHubat commit 8af7efe
Pre-Release PR Triage next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Pre-Release PR Triage this skilljamiepine/voicebox | 57k | — | ~3.1k | Automated safety check: Pass | MIT | |
| GitHub Triagetrailofbits/skills | 7.4k | — | ~5.8k | Automated safety check: Notes | CC-BY-SA-4.0 | |
| Contributor-First PR MergeHKUDS/OpenHarness | 16k | 1 repos | ~847 | Automated safety check: Pass | MIT | |
| Ansible Backport Creatoransible/ansible | 71k | — | ~1.2k | Automated safety check: Pass | GPL-3.0 | |
| Codewhale Landing Workflowcodewhale-hq/Codewhale | 41k | — | ~1.6k | Automated safety check: Pass | MIT | |
| Ouroboros Maintainer TriageQ00/ouroboros | 6.2k | — | ~1.7k | Automated safety check: Pass | MIT |
trailofbits/skills
Triages open GitHub issues and pull requests with the gh CLI, optionally merging ready PRs, closing resolved issues with evidence and assigning local priority and size estimates.
HKUDS/OpenHarness
Merges external GitHub pull requests while keeping the original author credited, and fixes conflicts after the merge instead of rewriting the contribution.
ansible/ansible
Creates backports of a merged Ansible devel pull request onto the right stable branches by cherry-picking its merge commit onto new backport branches.
codewhale-hq/Codewhale
Decides how verified work should reach main, directly, in a worktree or on an integration branch, while keeping contributor credit and respecting merge gates.
Q00/ouroboros
Triages and works through GitHub issues and pull requests in the Q00/ouroboros repo as a maintainer, within a stated review boundary and clear limits on what it may change.
rtk-ai/rtk
Audits open GitHub issues, categorizes them, flags duplicates and linked PRs in three phases, with optional deep analysis and comments posted only after validation.
jamiepine/voicebox
Walks through adding a new text-to-speech engine to Voicebox end to end: dependency audit, backend, frontend wiring, PyInstaller bundling and frozen-build testing.
jamiepine/voicebox
Writes or refreshes the Unreleased section of CHANGELOG.md as a themed narrative built from the commits, PRs and diff since the last version tag.
jamiepine/voicebox
Ends a release cycle by moving the Unreleased changelog notes under a dated version heading, bumping version files with bumpversion and tagging the commit.
Categories
Sorts a backlog of open pull requests into must-merge, candidate, superseded and deferred, writes a triage doc and works the merge loop before a release. Meant for a solo maintainer's pre-release pass, this skill turns a backlog of open pull requests into a shipped set of merges in one session. The agent writes a tracked, resumable triage document named after the target version, then works through it: rebasing where needed, merging in isolation-safe batches, applying post-merge follow-ups, and closing superseded or partly applicable PRs while crediting their authors.
Pre-Release PR Triage fits situations like: clearing a backlog of 10 or more open PRs before a minor or major release; landing the critical subset of PRs without reviewing each one deeply; closing superseded PRs while giving their authors credit.
Run `npx skills add jamiepine/voicebox --skill triage-prs -a claude-code`. Or copy the skill folder (.agents/skills/triage-prs in jamiepine/voicebox) into .claude/skills/triage-prs in your project. Claude Code loads it when a task matches its description.
Run `npx skills add jamiepine/voicebox --skill triage-prs -a codex`. Or copy the skill folder (.agents/skills/triage-prs in jamiepine/voicebox) into .agents/skills/triage-prs in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add jamiepine/voicebox --skill triage-prs -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/triage-prs, .gemini/skills/triage-prs, .github/skills/triage-prs and .opencode/skills/triage-prs in your project.
Going by SKILL.md and its folder, Pre-Release PR Triage needs the command-line tools its instructions call (git and gh). Our summary lists: The gh CLI authenticated against the repository; Git, with a dedicated worktree for PR review.
SKILL.md names 1 domain. In commands or code: github.com; the agent is likely to contact it when it follows the instructions. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
Pre-Release PR Triage is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
About 3.1k tokens (SKILL.md is roughly 12k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
Skills that share tags, products or a category with Pre-Release PR Triage: GitHub Triage (trailofbits/skills, 7.4k stars), Contributor-First PR Merge (HKUDS/OpenHarness, 16k stars), Ansible Backport Creator (ansible/ansible, 71k stars) and Codewhale Landing Workflow (codewhale-hq/Codewhale, 41k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
jamiepine (a GitHub user) maintains it in jamiepine/voicebox, which has 56,702 GitHub stars. The repository holds 4 skills in this directory. The repository was last updated on October 7, 2026.
Source: jamiepine/voicebox on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.