Verdaccio Pull Request Workflow
verdaccio/verdaccio
Takes a change through a verdaccio pull request: branch, local checks, changeset, title and body, labels, CI and review rounds, and ports to other release lines.
Take a change through a pull request in the pnpm repository — opening it, then staying with it after every push until CI is green and the review round is quiet.
$ npx skills add pnpm/pnpm --skill pull-requests -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install pnpm/pnpm pull-requests --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/pnpm/pnpm.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/pull-requests .claude/skills/pull-requests && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "pull-requests" agent skill from https://github.com/pnpm/pnpm/tree/main/.agents/skills/pull-requests into .claude/skills/pull-requests/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pull-requests", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/pnpm/pnpm/tree/main/.agents/skills/pull-requestsType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add pnpm/pnpm --skill pull-requests -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install pnpm/pnpm pull-requests --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/pnpm/pnpm.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.agents/skills/pull-requests .agents/skills/pull-requests && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "pull-requests" agent skill from https://github.com/pnpm/pnpm/tree/main/.agents/skills/pull-requests into .agents/skills/pull-requests/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pull-requests", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add pnpm/pnpm --skill pull-requests -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install pnpm/pnpm pull-requests --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/pnpm/pnpm.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.agents/skills/pull-requests .cursor/skills/pull-requests && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "pull-requests" agent skill from https://github.com/pnpm/pnpm/tree/main/.agents/skills/pull-requests into .cursor/skills/pull-requests/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pull-requests", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/pnpm/pnpm.git --path .agents/skills/pull-requests--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add pnpm/pnpm --skill pull-requests -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install pnpm/pnpm pull-requests --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/pnpm/pnpm.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.agents/skills/pull-requests .gemini/skills/pull-requests && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "pull-requests" agent skill from https://github.com/pnpm/pnpm/tree/main/.agents/skills/pull-requests into .gemini/skills/pull-requests/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pull-requests", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install pnpm/pnpm pull-requestsInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add pnpm/pnpm --skill pull-requests -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/pnpm/pnpm.git skills-src && mkdir -p .github/skills && cp -r skills-src/.agents/skills/pull-requests .github/skills/pull-requests && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "pull-requests" agent skill from https://github.com/pnpm/pnpm/tree/main/.agents/skills/pull-requests into .github/skills/pull-requests/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pull-requests", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add pnpm/pnpm --skill pull-requests -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install pnpm/pnpm pull-requests --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/pnpm/pnpm.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.agents/skills/pull-requests .opencode/skills/pull-requests && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "pull-requests" agent skill from https://github.com/pnpm/pnpm/tree/main/.agents/skills/pull-requests into .opencode/skills/pull-requests/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pull-requests", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
pull-requestsTake a change through a pull request in the pnpm repository — opening it, then staying with it after every push until CI is green and the review round is quiet.
Pull Requests is an agent skill from pnpm/pnpm. Take a change through a pull request in the pnpm repository — opening it, then staying with it after every push until CI is green and the review round is quiet. Use when opening a PR, after pushing to one, when a check fails, or when review comments arrive.
Its SKILL.md is about 2.2k tokens, which your agent loads only when the skill is triggered. The skill folder holds 3 other files, including scripts (for example `scripts/resolve-pr-conflicts.sh` and `scripts/resolve-pr-conflicts.test.sh`).
It sits in Development, covering Pull requests. It works with pnpm. The repository describes itself as: Fast, disk space efficient package manager. The licence is MIT.
5 steps, taken from the first numbered list in SKILL.md.
Read from SKILL.md and the folder at commit 3da5bd3. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Ships 2 files in scripts/ (Shell), which the agent can run.
Shell commands in SKILL.md call:
ghFrom the folder's file list and the shell code blocks in SKILL.md.
No URLs in SKILL.md. Its commands use gh, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Pull Requests loads about 2.2k tokens when it runs. Until then it costs about 68 tokens; SKILL.md has 1,487 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
The full file from pnpm/pnpm at commit 3da5bd3, republished under its MIT licence (© pnpm). 1,487 words, ~2,219 tokens.
.claude/skills/pull-requests/SKILL.md (or your agent's skills folder). This skill also uses 2 other files; get the full folder from GitHub.Pushing is the middle of the task. The PR is done when the checks pass and a review round produces nothing left to act on. Until then the work is yours.
Several bots review this repository, and they re-review on every push. A push therefore always buys a new round, and the round arrives minutes later, after the turn that pushed would otherwise have ended. Stay for it.
Open it as a draft (gh pr create --draft). Fill in
.github/pull_request_template.md and pass it as the body; gh pr create does
not apply the template on its own. Keep every section, mark the checklist
honestly, and drop only the lines the template says to drop.
When the change comes from an issue, link it from the Summary with a closing
keyword (Closes pnpm/pnpm#123) and then comment on the issue itself. The
cross-reference GitHub adds to the issue timeline is silent and says nothing
about what was done, so the people waiting on the issue learn nothing from it.
The comment carries what they need: that a PR is open, the approach it takes,
and whether it covers the whole issue or one part of it. Say so plainly when it
is partial. Do not close the issue by hand; the closing keyword does that when
the PR merges.
CI runs on a draft here; the reviewers do not. That asymmetry is the whole point of opening as one. A failing lint job, a test you forgot to update, a bug your own review pass catches — in draft each of those costs a push and nothing else, while on a ready PR each one burns a review round and leaves a thread behind.
So stay in draft until the checks are green and your own pass over the diff is
clean, then gh pr ready <pr>. The first round of review then reads a finished
change instead of a half-fixed one, and its findings are about the design rather
than the leftovers.
Do not leave a draft behind when you stop. A draft with no note on it reads as abandoned: either mark it ready or say in a comment what is left to do.
This is the loop for a PR that is ready for review. Steps 1 and 4 apply while it is still a draft too; the review steps start when you mark it ready.
gh pr checks <pr> --watch blocks for longer than a
foreground command is usually allowed to run, so run it in the background or
poll it. Started in the same breath as the push it can return before the runs
exist; give the push a moment first. Watch to the end rather than stopping at
the first failure: the push that fixes it cancels whatever was still running,
so a second failure you never waited for costs another full cycle.resolveReviewThread); the REST comment API cannot do it.gh pr edit --title, --body). This is not housekeeping: the title becomes
the squash commit's subject and the template's Squash Commit Body section
becomes its message, so whatever is stale at merge time is what lands in the
history for good.A round is finished only when every reviewer's summary comment names your head commit; each one says which commit it reviewed. Green checks and an empty comment list prove nothing on their own, because a round that has not started yet looks exactly like one that found nothing. Stop when every reviewer has reported on the head commit, none of them found anything left to act on, and the checks are green.
Report at the end which findings were real, which were not, and anything you declined that a human should settle.
Waiting is not idle time, and in the draft phase this pass is the whole job. Use the review-code skill to review your own diff. A finding you catch here costs one push; the same finding caught by a reviewer costs a round, and rounds are where the bugs from the last round get written.
Push what you find as soon as you find it rather than banking it until the run finishes. The main CI workflows cancel a PR branch's in-progress run when the next push lands, so waiting for a run you are about to supersede buys nothing. Send the fixes in one push, though: a push also restarts a review that is in flight, and a trickle of pushes restarts it over and over.
Never write a failure off as pre-existing, flaky, or unrelated without evidence
for that claim — AGENTS.md makes this a repo rule, and the first guess is
usually wrong. Pull the failing log (gh run view <run> --log-failed),
reproduce it locally with the selection from the
testing-changes skill, and fix the cause.
A fork PR's runs can sit awaiting approval and then show up cancelled: a
scheduled sweep cancels approval-held workflows after 30 minutes
(.github/workflows/cancel-unapproved-workflows.yml). That is not a test
failure, and the run has to be approved and restarted.
A PR that merged cleanly when you opened it stops merging cleanly as soon as
something landing on main touches the same lines. Nothing announces this, so
check it each time round the loop: gh pr view <pr> --json mergeable,mergeStateStatus.
CONFLICTING means rebase; UNKNOWN means GitHub has not computed it yet, which
is what you see right after a push, so ask again rather than reading it as a
verdict. BLOCKED is about required checks and reviews, not conflicts.
Rebase with ./.agents/skills/pull-requests/scripts/resolve-pr-conflicts.sh <pr> (documented under "Resolving
Conflicts in GitHub PRs" in AGENTS.md); it resolves a pnpm-lock.yaml conflict
by reinstalling and stops with the file list when a conflict needs you. Resolve
those files, stage them, and run the same command with --continue, which
resumes the paused rebase instead of checking the branch out again. Add
--no-push when you want to inspect the rewritten commits before publishing
them; it stops after the rebase and prints the push command. The rebase is
recorded as belonging to the PR it was started for, so --continue refuses a
pause that belongs to another PR — the same head branch name can belong to
another fork — instead of force-pushing the rewritten commits to its branch.
Rebase rather than merging main in: the branch protection on main requires
linear history and merge commits are disabled, which is why the script and
GitHub's update-branch button both rebase.
Fold the rebase into the push that carries your fixes when you can, and answer the threads after that push, not before: the rebase rewrites your fix commits, so a hash quoted ahead of it names a commit the branch never receives. The force push also marks the open comments outdated and moves their anchors, which is the second reason the reply has to carry the hash — the line the comment hangs on no longer points at the fix.
Re-read the diff after a rebase. A conflict resolved wrongly is a real bug that arrives with no review comment attached to it.
Rounds do not reliably converge. The code a round comments on is mostly the code the last round made you write, so a quiet round is the signal to stop, not a round count. While the rounds keep finding real problems, keep going.
Sign every comment, issue, and PR body with an agent footer naming the agent and the model.
© pnpm, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
SKILL.md and 2 other files (scripts) in .agents/skills/pull-requests of pnpm/pnpm.
Open the folder on GitHubat commit 3da5bd3
Pull Requests next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Pull Requests this skillpnpm/pnpm | 37k | — | ~2.2k | Automated safety check: Pass | MIT | |
| Verdaccio Pull Request Workflowverdaccio/verdaccio | 18k | — | ~1.9k | Automated safety check: Pass | MIT | |
| Verdaccio PR Reviewverdaccio/verdaccio | 18k | — | ~1.7k | Automated safety check: Pass | MIT | |
| Dsh Web Community Plugin Developerzhu1090093659/dsh-web | 8.4k | — | ~951 | Automated safety check: Pass | Apache-2.0 | |
| Contributingkortix-ai/suna | 20k | — | ~3k | Automated safety check: Warn | Custom licence | |
| ZCF Release AutomationUfoMiao/zcf | 6.1k | — | ~3.4k | Automated safety check: Pass | MIT |
verdaccio/verdaccio
Takes a change through a verdaccio pull request: branch, local checks, changeset, title and body, labels, CI and review rounds, and ports to other release lines.
verdaccio/verdaccio
Reviews an existing verdaccio/verdaccio pull request end to end, verifies each finding and reports whether it is mergeable, optionally fixing it on the PR branch.
zhu1090093659/dsh-web
Develop a DSH community plugin in the contributor's own repository, and register it in the community plugin index owned by the dsh-community-plugins repository — the index is community.json at that…
kortix-ai/suna
The pull request loop for this repo: branch → commit → verify in your own box (local tests + local stack) → PR into main → demo video recorded with agent-browser on the local stack → gh --attach →…
UfoMiao/zcf
Automates a version release with changesets: analyzes code changes, writes a bilingual CHANGELOG, bumps the version and commits through a release branch and pull request.
pockethost/pockethost
Run pnpm check:push (lint, types, tests) before git push or PR-ready work.
pnpm/pnpm
Curate a pending release page - merging entries that describe one change, dropping notes for defects that never shipped, ordering by importance, and checking the version the intents ask for.
pnpm/pnpm
Run the tests that cover a change in the pnpm repository, in the Rust workspace (pnpm/, pnpr/) or the TypeScript CLI (pnpm11/), and recognize the cases where a scoped run passes without testing…
pnpm/pnpm
Review a pnpm diff or pull request against the repository review guide and product conventions, verify findings, and report actionable issues.
pnpm/pnpm
Implement a pnpm feature, bug fix, or refactor by checking existing capabilities, prioritizing code reuse and deduplication, assessing architecture impact, and validating the final change.
pnpm/pnpm
Review and fix an existing pnpm pull request, rebase it, commit and push fixes, then follow CI and review to completion.
pnpm/pnpm
Triage an incoming GitHub issue against the pnpm codebase and related open issues, then apply exactly one implementation-readiness label using pnpm's state: taxonomy.
Works with
Categories
Take a change through a pull request in the pnpm repository — opening it, then staying with it after every push until CI is green and the review round is quiet. Pull Requests is an agent skill from pnpm/pnpm. Take a change through a pull request in the pnpm repository — opening it, then staying with it after every push until CI is green and the review round is quiet.
Pull Requests fits situations like: after pushing to one; review comments arrive.
Run `npx skills add pnpm/pnpm --skill pull-requests -a claude-code`. Or copy the skill folder (.agents/skills/pull-requests in pnpm/pnpm) into .claude/skills/pull-requests in your project. Claude Code loads it when a task matches its description.
Run `npx skills add pnpm/pnpm --skill pull-requests -a codex`. Or copy the skill folder (.agents/skills/pull-requests in pnpm/pnpm) into .agents/skills/pull-requests in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add pnpm/pnpm --skill pull-requests -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/pull-requests, .gemini/skills/pull-requests, .github/skills/pull-requests and .opencode/skills/pull-requests in your project.
Going by SKILL.md and its folder, Pull Requests needs a shell for the scripts in its folder and the command-line tools its instructions call (gh). Our summary lists: A Bash shell.
SKILL.md contains no URLs. Its commands use gh, which can reach the network depending on how they are called. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
Pull Requests is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
About 2.2k tokens (SKILL.md is roughly 8.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
Skills that share tags, products or a category with Pull Requests: Verdaccio Pull Request Workflow (verdaccio/verdaccio, 18k stars), Verdaccio PR Review (verdaccio/verdaccio, 18k stars), Dsh Web Community Plugin Developer (zhu1090093659/dsh-web, 8.4k stars) and Contributing (kortix-ai/suna, 20k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
pnpm (a GitHub organization) maintains it in pnpm/pnpm, which has 36,755 GitHub stars. The repository holds 7 skills in this directory. The repository was last updated on October 7, 2026.
Source: pnpm/pnpm on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.