feat(skills): add upgrade-apache-steward skill + git submodule update guidance - #27
Merged
Merged
Conversation
… guidance in AGENTS.md / README.md Adds a fifth secure-config skill plus the missing post-pull submodule-update guidance for adopters who consume the framework as a tracker submodule. - `upgrade-apache-steward` skill: pulls the user's local `airflow-steward` checkout to `origin/main` with `--ff-only` after pre-flight checks. Refuses on a dirty working tree, on local commits ahead of upstream, and on a non-tracking branch. Surfaces the commits and the per-file change summary with explicit focus on the secure-setup blast radius (`.claude/settings.json`, `tools/agent-isolation/`, the two setup docs, `pinned-versions.toml`). Hands off to `update-secure-config` for the user-side drift report and reminds the user to handle the parent-tracker submodule pointer when the framework is consumed as a submodule. - `update-secure-config`: framework-behind branch now cross-references `upgrade-apache-steward` instead of just printing the bare `git pull` command — the new skill wraps the same operation in the right pre-flight checks plus the submodule-pointer reminder. - `secure-agent-setup.md` Quick start: agent-guided list grows from four to five skills and explicitly names the upgrade / drift-report split (run `/upgrade-apache-steward` to advance the framework, then `/update-secure-config` to see what that did to the user-side install). - `AGENTS.md` Local setup: opens with the `git submodule update --init --recursive` rule for adopter trackers — plain `git pull` only advances the framework submodule pointer in the tracker's index, not the framework's working tree, and stale-submodule failures are silent. Names a one-line `.git/hooks/post-merge` so adopters can wire it in once. - `README.md` Adopting the framework: same submodule-update rule with the explicit post-merge hook recipe, plus a cross-reference to the new skill for upgrading the framework itself. Generated-by: Claude Code (Opus 4.7)
andreahlert
added
the
mode:platform
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
upgrade-apache-steward— fifth secure-config skill. Pulls the user's localairflow-stewardcheckout toorigin/mainwith--ff-onlyafter pre-flight checks (clean working tree, on tracking branch, no commits ahead). Surfaces commits and per-file changes with secure-setup focus. Refuses to act on a dirty tree or diverged history. Hands off toupdate-secure-configfor user-side drift.git submodule update --init --recursiveafter every pull on the adopter tracker repo, since plaingit pullonly advances the framework submodule pointer in the tracker index without updating the framework's working tree (silent failure mode: skills run against the previous version of the framework). Both docs name a one-line.git/hooks/post-mergerecipe for adopters who want this automatic.secure-agent-setup.mdQuick start: agent-guided list grows to five skills; explicitly names the upgrade / drift-report split.update-secure-config: framework-behind follow-up bullet now points at the new skill instead of a baregit pullcommand.Test plan
prek run --files <changed files>clean (markdownlint, typos, placeholder linter, doctoc TOC regen).upgrade-apache-steward/SKILL.mdfrontmatter parses (name/description/when_to_use).upgrade-apache-steward↔update-secure-config,upgrade-apache-steward↔secure-agent-setup.md, AGENTS.md →upgrade-apache-stewardskill, README.md → skill.secure-agent-setup.mdlists exactly 5 skills, in the order setup → verify → upgrade → update → sync.