Push

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

.claude/agents

.claude/skills

.github/CLAUDE.md

CLAUDE.md

apps/backend/CLAUDE.md

import { test, expect } from "../../fixtures/test-base";

apps/web/generated/licenses.json

Audit 0.4.1 · source sha 786d4817799e · 18 Oct 2026Report an issue or request a re-scan

• Publisherkdlbs GitHub organizationOwner of the repository this skill is read from
• Source folderkdlbs/kandev/.agents/skills/pushThe exact folder we audited
• LicenceAGPL-3.0As the repository states it
• Commit pinned for this verdict786d4817799eA new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Push a committed branch whose task-defined checks passed. With --fixup, continue with CI and review handling in the primary conversation.

---
name: push
description: Push a committed branch whose task-defined checks passed. With --fixup, continue with CI and review handling in the primary conversation.
---

# Push

## Planner Entry

Push the verified commit directly in the primary conversation. With `--fixup`,
continue with `/pr-fixup` in that same conversation; do not delegate polling or
delivery.

## Available skills

- **`/commit`** — Creates the artifact after task-defined checks pass.
- **`/pr-fixup`** — Wait for CI checks and CodeRabbit, Greptile, Claude, OpenCode, and cubic review feedback, fix any failures or valid comments, and push again.

## Options

- `--fixup` — after pushing, begin `/pr-fixup` in the same conversation.

> **Note:** This skill normally uses `git push`. It uses `gh pr view` before a
> no-upstream fallback so a checked-out fork PR is not accidentally pushed to
> its base repository.

## Your task

Push the already committed branch to its remote.

### Steps

**Create a todo/task for each step below and mark them as completed as you go.**

1. **Uncommitted changes:** If there are dirty or staged changes, stop: a new
   commit and the affected task checks are required first.

2. **Task-check evidence:** Require the task-defined unit, integration, and E2E
   checks affected by this commit to pass. If the checkout or commit changed
   afterward, rerun only the affected task checks.

3. **Safety check:** Verify the current branch is NOT `main` or `master`. If it is, stop and ask the user — direct pushes to the default branch should go through a PR.

4. **Push** the current branch:
   ```bash
   git push
   ```
   If the branch has no upstream, first look up the current branch's PR. Treat
   an unavailable or ambiguous lookup as a stop condition; only a confirmed
   absence of a PR permits the ordinary `origin` fallback. For a confirmed PR,
   require its `headRefName` to match the checked-out local branch, then inspect
   its delivery target:
   ```bash
   gh pr view --json isCrossRepository,headRepositoryOwner,headRepository,headRefName,headRefOid,maintainerCanModify
   ```
   For a cross-repository PR, the PR head owner can push its own fork directly.
   When acting as a base-repository maintainer on somebody else's fork,
   `maintainerCanModify` must be `true`; do not treat that field as a universal
   fork-owner gate. Push the exact current commit to the reported head owner,
   repository, and ref. Before using the HTTPS URL, configure Git to use the
   authenticated `gh` credential helper:
   ```bash
   gh auth setup-git
   git push "https://github.com/<head-owner>/<head-repository>.git" "HEAD:refs/heads/<head-ref>"
   ```
   If that push fails with `git repository does not match any credential lease
   scope`, do not put a token in command arguments or logs. Retry after
   `gh auth setup-git`; if HTTPS still rejects the contributor-fork push, use
   the SSH fallback below or report the authentication/scope blocker.
   Never embed the token in a remote URL, command argument, log, or persisted
   credential. Re-fetch the PR and require its `headRefOid` to equal local
   `HEAD` afterward.
   If HTTPS still rejects a contributor-fork push and SSH authentication is
   available, verify the exact target with
   `git ls-remote [email protected]:<head-owner>/<head-repository>.git`, then retry
   the same exact ref over SSH (using the exact remote-OID lease if history was
   rewritten). Re-fetch and verify the PR head OID again. Do not substitute a
   local `fork` remote or an inferred repository.
   Do not use a conveniently named local `fork`/`contributor` remote: linked
   worktrees share remote configuration, so it can refer to another task.
   Re-fetch the PR and require `headRefOid` to equal local `HEAD`.

   Only for a non-PR or same-repository PR, use `git push -u origin HEAD`
   rather than transcribing the branch name. Then verify
   `git rev-parse HEAD` equals `git rev-parse '@{upstream}'`, and report the
   branch from `git branch --show-current`.
   If the branch was rebased or history was rewritten, first confirm the current
   branch is not `main` or `master`, then use the exact remote-OID lease
   `git push --force-with-lease=refs/heads/<branch>:<captured-remote-sha>`.
   Use generic `--force-with-lease` only when no remote OID was captured; never
   use an unconditional force push.
   If the branch modifies `.github/workflows/*` and GitHub rejects the push with
   a message like `refusing to allow an OAuth App to create or update workflow
   ... without workflow scope`, treat it as push authentication/scope, not a code
   or branch-protection failure. Retry with an SSH remote when available, for
   example `git push [email protected]:<owner>/<repo>.git <branch>`, or tell the
   user the token needs `workflow` scope.

   If both HTTPS and SSH pushes time out and an authorized GitHub connector
   exposes Git database writes, preserve the tested tree by creating blobs for
   the exact file contents, a tree from the known parent tree, and a commit with
   the same parent and message, then fast-forward the existing branch ref. Fetch
   that ref, verify its content and commit, and reset the local worktree only to
   the fetched SHA. This can produce a different commit SHA, so all subsequent
   checks and final evidence must use the fetched head.

5. **Report** the pushed commit hash and branch.

6. **If `--fixup`:** Continue with `/pr-fixup` in this conversation.

Excerpt, first 5,453 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/kdlbs/kandev
git -C kandev checkout 786d4817799e

Works in

1. 2026-10-18
   !CAUTION B 89 / 100

   first audit · source 786d4817799e

Questions about Push

• github.com/kdlbs/kandev/tree/main/.agents/skills/push — the audited source at commit 786d4817799e and every finding aboveObserved · 18 Oct 2026

Spotted something wrong? Report a correction · Methodology