feat(skills): add security scanning to cicd - #26

Merged
harrymove-ctrl merged 2 commits into
mainfrom
reopen/cicd-security-validation
Aug 30, 2026
Merged

feat(skills): add security scanning to cicd#26
harrymove-ctrl merged 2 commits into
mainfrom
reopen/cicd-security-validation

Conversation

@harrymove-ctrl

@harrymove-ctrlharrymove-ctrl commented Aug 30, 2026

Copy link
Copy Markdown
Contributor

Reopens #23, which was reverted from main along with #22.

GitHub does not allow reopening a merged PR, so this is a fresh PR carrying the
same work. The commit is @Abdol164's original, cherry-picked unchanged — the
diff against main is byte-identical to #23 (7 files, +177/-23).

Why it was reverted

#23 was merged on top of #22; #22 was merged prematurely, so both were reverted
(ae4ae31, 567ffba). This PR is independent of #25 again, exactly as #23 was
independent of #22.

Ordering — read before merging

This conflicts with #25 (the reopened #22) on four files:

docs/ai/skills/conventions.md
skills/cicd/SKILL.md
skills/cicd/references/ci-structure.md
skills/delivery-review/SKILL.md

Both PRs will report MERGEABLE because GitHub tests each against main
independently, not against each other.

The one that matters is skills/delivery-review/SKILL.md. This PR edits lens 6
in place to name the scans that backed it; #25 deletes that inline lens block
and moves the lenses to references/lenses.md. If #25 lands first, this
edit has no target left — resolving the conflict by taking either side drops
it silently, and security-scanning.md ships while the review lens meant to
consume it never mentions scans. CI stays green either way.

If #25 lands first, re-target the lens-6 change to
skills/delivery-review/references/lenses.md, and take 0.4.0 for
cmk:cicd (a new guidance facet) over #25's 0.3.4 wording bump.

@Abdol164@harrymove-ctrl
feat(skills): add security scanning to cicd
a4556d6
The pipeline this skill composes validates build, test and docs and never
scans. Adds the four classes, scoped to what the diff touches and disclosed
either way, so a scan that could not run is not read as one that found
nothing — the scanner-level form of skipped-job-reports-success.
delivery-review's security lens now names the scans that backed it, so it
can meet the evidence bar that skill already sets.
@harrymove-ctrlharrymove-ctrl mentioned this pull request Aug 30, 2026
Merged
@harrymove-ctrl@claude
Merge main into reopen/cicd-security-validation
d75f97f
Resolves the overlap with #25, which landed first:
- cicd/SKILL.md — keep main's "Use when…" description house form, carry this
branch's "add security scanning" / "scan for vulnerabilities" triggers, and
take 0.4.0 (a new guidance facet) over main's 0.3.4 wording bump.
- delivery-review/SKILL.md — #25 moved the seven lenses out to
references/lenses.md, so this branch's inline lens-6 edit had no target
left. Re-applied it there instead: the security lens still has to name the
scans that backed it and the classes that did not run. Taking either side
of that conflict verbatim would have dropped the change silently, with CI
green either way.
- conventions.md — main's roster, with cmk:cicd moved out of the 0.2.1 clause
into the 0.4.x band to match the version this branch sets.
- docs/ai/skills/delivery-review.md — record references/lenses.md and the new
Red Flags / Rationalizations sections, which #25's lens extraction left out
of the companion doc.
Verified after resolution: security-scanning.md, the ci-structure security
section, the empty-scan-reads-as-clean trap, the three Verify items and the
lens-6 scan disclosure are all present; #25's lens extraction and scope-band
reference are intact; skill-lint passes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@harrymove-ctrl
harrymove-ctrl merged commit 0c7127a into mainAug 30, 2026
2 checks passed
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@harrymove-ctrl@Abdol164
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
feat(skills): add security scanning to cicd - #26
Merged
harrymove-ctrl merged 2 commits into
mainfrom 
reopen/cicd-security-validation
Aug 30, 2026
Merged
feat(skills): add security scanning to cicd#26
harrymove-ctrl merged 2 commits into
mainfrom 
reopen/cicd-security-validation
Conversation
@harrymove-ctrl
@harrymove-ctrlharrymove-ctrl
commented
Aug 30, 2026

Copy link


Copy Markdown

Contributor
Reopens #23, which was reverted from main along with #22.
GitHub does not allow reopening a merged PR, so this is a fresh PR carrying the

same work. The commit is @Abdol164's original, cherry-picked unchanged — the

diff against main is byte-identical to #23 (7 files, +177/-23).
Why it was reverted
#23 was merged on top of #22; #22 was merged prematurely, so both were reverted

(ae4ae31, 567ffba). This PR is independent of #25 again, exactly as #23 was

independent of #22.
Ordering — read before merging
This conflicts with #25 (the reopened #22) on four files:
docs/ai/skills/conventions.md
skills/cicd/SKILL.md
skills/cicd/references/ci-structure.md
skills/delivery-review/SKILL.md

Both PRs will report MERGEABLE because GitHub tests each against main

independently, not against each other.
The one that matters is skills/delivery-review/SKILL.md. This PR edits lens 6

in place to name the scans that backed it; #25 deletes that inline lens block

and moves the lenses to references/lenses.md. If #25 lands first, this

edit has no target left — resolving the conflict by taking either side drops

it silently, and security-scanning.md ships while the review lens meant to

consume it never mentions scans. CI stays green either way.
If #25 lands first, re-target the lens-6 change to
skills/delivery-review/references/lenses.md, and take 0.4.0 for
cmk:cicd (a new guidance facet) over #25's 0.3.4 wording bump.
@Abdol164@harrymove-ctrl
feat(skills): add security scanning to cicd
a4556d6
The pipeline this skill composes validates build, test and docs and never
scans. Adds the four classes, scoped to what the diff touches and disclosed
either way, so a scan that could not run is not read as one that found
nothing — the scanner-level form of skipped-job-reports-success.
delivery-review's security lens now names the scans that backed it, so it
can meet the evidence bar that skill already sets.
@harrymove-ctrlharrymove-ctrl
mentioned this pull request
Aug 30, 2026
 Merged

@harrymove-ctrl@claude
Merge main into reopen/cicd-security-validation
d75f97f
Resolves the overlap with #25, which landed first:
- cicd/SKILL.md — keep main's "Use when…" description house form, carry this
branch's "add security scanning" / "scan for vulnerabilities" triggers, and
take 0.4.0 (a new guidance facet) over main's 0.3.4 wording bump.
- delivery-review/SKILL.md — #25 moved the seven lenses out to
references/lenses.md, so this branch's inline lens-6 edit had no target
left. Re-applied it there instead: the security lens still has to name the
scans that backed it and the classes that did not run. Taking either side
of that conflict verbatim would have dropped the change silently, with CI
green either way.
- conventions.md — main's roster, with cmk:cicd moved out of the 0.2.1 clause
into the 0.4.x band to match the version this branch sets.
- docs/ai/skills/delivery-review.md — record references/lenses.md and the new
Red Flags / Rationalizations sections, which #25's lens extraction left out
of the companion doc.
Verified after resolution: security-scanning.md, the ci-structure security
section, the empty-scan-reads-as-clean trap, the three Verify items and the
lens-6 scan disclosure are all present; #25's lens extraction and scope-band
reference are intact; skill-lint passes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@harrymove-ctrl
harrymove-ctrl
merged commit 0c7127a
into
mainAug 30, 2026

2 checks passed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@harrymove-ctrl@Abdol164

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(skills): add security scanning to cicd - #26
Merged
harrymove-ctrl merged 2 commits into
mainfrom 
reopen/cicd-security-validation
Aug 30, 2026
Merged
feat(skills): add security scanning to cicd#26
harrymove-ctrl merged 2 commits into
mainfrom 
reopen/cicd-security-validation
Conversation
@harrymove-ctrl
@harrymove-ctrlharrymove-ctrl
commented
Aug 30, 2026

Copy link


Copy Markdown

Contributor
Reopens #23, which was reverted from main along with #22.
GitHub does not allow reopening a merged PR, so this is a fresh PR carrying the

same work. The commit is @Abdol164's original, cherry-picked unchanged — the

diff against main is byte-identical to #23 (7 files, +177/-23).
Why it was reverted
#23 was merged on top of #22; #22 was merged prematurely, so both were reverted

(ae4ae31, 567ffba). This PR is independent of #25 again, exactly as #23 was

independent of #22.
Ordering — read before merging
This conflicts with #25 (the reopened #22) on four files:
docs/ai/skills/conventions.md
skills/cicd/SKILL.md
skills/cicd/references/ci-structure.md
skills/delivery-review/SKILL.md

Both PRs will report MERGEABLE because GitHub tests each against main

independently, not against each other.
The one that matters is skills/delivery-review/SKILL.md. This PR edits lens 6

in place to name the scans that backed it; #25 deletes that inline lens block

and moves the lenses to references/lenses.md. If #25 lands first, this

edit has no target left — resolving the conflict by taking either side drops

it silently, and security-scanning.md ships while the review lens meant to

consume it never mentions scans. CI stays green either way.
If #25 lands first, re-target the lens-6 change to
skills/delivery-review/references/lenses.md, and take 0.4.0 for
cmk:cicd (a new guidance facet) over #25's 0.3.4 wording bump.
@Abdol164@harrymove-ctrl
feat(skills): add security scanning to cicd
a4556d6
The pipeline this skill composes validates build, test and docs and never
scans. Adds the four classes, scoped to what the diff touches and disclosed
either way, so a scan that could not run is not read as one that found
nothing — the scanner-level form of skipped-job-reports-success.
delivery-review's security lens now names the scans that backed it, so it
can meet the evidence bar that skill already sets.
@harrymove-ctrlharrymove-ctrl
mentioned this pull request
Aug 30, 2026
 Merged

@harrymove-ctrl@claude
Merge main into reopen/cicd-security-validation
d75f97f
Resolves the overlap with #25, which landed first:
- cicd/SKILL.md — keep main's "Use when…" description house form, carry this
branch's "add security scanning" / "scan for vulnerabilities" triggers, and
take 0.4.0 (a new guidance facet) over main's 0.3.4 wording bump.
- delivery-review/SKILL.md — #25 moved the seven lenses out to
references/lenses.md, so this branch's inline lens-6 edit had no target
left. Re-applied it there instead: the security lens still has to name the
scans that backed it and the classes that did not run. Taking either side
of that conflict verbatim would have dropped the change silently, with CI
green either way.
- conventions.md — main's roster, with cmk:cicd moved out of the 0.2.1 clause
into the 0.4.x band to match the version this branch sets.
- docs/ai/skills/delivery-review.md — record references/lenses.md and the new
Red Flags / Rationalizations sections, which #25's lens extraction left out
of the companion doc.
Verified after resolution: security-scanning.md, the ci-structure security
section, the empty-scan-reads-as-clean trap, the three Verify items and the
lens-6 scan disclosure are all present; #25's lens extraction and scope-band
reference are intact; skill-lint passes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@harrymove-ctrl
harrymove-ctrl
merged commit 0c7127a
into
mainAug 30, 2026

2 checks passed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@harrymove-ctrl@Abdol164

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(skills): add security scanning to cicd - #26
Merged
harrymove-ctrl merged 2 commits into
mainfrom 
reopen/cicd-security-validation
Aug 30, 2026
Merged
feat(skills): add security scanning to cicd#26
harrymove-ctrl merged 2 commits into
mainfrom 
reopen/cicd-security-validation
Conversation
@harrymove-ctrl
@harrymove-ctrlharrymove-ctrl
commented
Aug 30, 2026

Copy link


Copy Markdown

Contributor
Reopens #23, which was reverted from main along with #22.
GitHub does not allow reopening a merged PR, so this is a fresh PR carrying the

same work. The commit is @Abdol164's original, cherry-picked unchanged — the

diff against main is byte-identical to #23 (7 files, +177/-23).
Why it was reverted
#23 was merged on top of #22; #22 was merged prematurely, so both were reverted

(ae4ae31, 567ffba). This PR is independent of #25 again, exactly as #23 was

independent of #22.
Ordering — read before merging
This conflicts with #25 (the reopened #22) on four files:
docs/ai/skills/conventions.md
skills/cicd/SKILL.md
skills/cicd/references/ci-structure.md
skills/delivery-review/SKILL.md

Both PRs will report MERGEABLE because GitHub tests each against main

independently, not against each other.
The one that matters is skills/delivery-review/SKILL.md. This PR edits lens 6

in place to name the scans that backed it; #25 deletes that inline lens block

and moves the lenses to references/lenses.md. If #25 lands first, this

edit has no target left — resolving the conflict by taking either side drops

it silently, and security-scanning.md ships while the review lens meant to

consume it never mentions scans. CI stays green either way.
If #25 lands first, re-target the lens-6 change to
skills/delivery-review/references/lenses.md, and take 0.4.0 for
cmk:cicd (a new guidance facet) over #25's 0.3.4 wording bump.
@Abdol164@harrymove-ctrl
feat(skills): add security scanning to cicd
a4556d6
The pipeline this skill composes validates build, test and docs and never
scans. Adds the four classes, scoped to what the diff touches and disclosed
either way, so a scan that could not run is not read as one that found
nothing — the scanner-level form of skipped-job-reports-success.
delivery-review's security lens now names the scans that backed it, so it
can meet the evidence bar that skill already sets.
@harrymove-ctrlharrymove-ctrl
mentioned this pull request
Aug 30, 2026
 Merged

@harrymove-ctrl@claude
Merge main into reopen/cicd-security-validation
d75f97f
Resolves the overlap with #25, which landed first:
- cicd/SKILL.md — keep main's "Use when…" description house form, carry this
branch's "add security scanning" / "scan for vulnerabilities" triggers, and
take 0.4.0 (a new guidance facet) over main's 0.3.4 wording bump.
- delivery-review/SKILL.md — #25 moved the seven lenses out to
references/lenses.md, so this branch's inline lens-6 edit had no target
left. Re-applied it there instead: the security lens still has to name the
scans that backed it and the classes that did not run. Taking either side
of that conflict verbatim would have dropped the change silently, with CI
green either way.
- conventions.md — main's roster, with cmk:cicd moved out of the 0.2.1 clause
into the 0.4.x band to match the version this branch sets.
- docs/ai/skills/delivery-review.md — record references/lenses.md and the new
Red Flags / Rationalizations sections, which #25's lens extraction left out
of the companion doc.
Verified after resolution: security-scanning.md, the ci-structure security
section, the empty-scan-reads-as-clean trap, the three Verify items and the
lens-6 scan disclosure are all present; #25's lens extraction and scope-band
reference are intact; skill-lint passes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@harrymove-ctrl
harrymove-ctrl
merged commit 0c7127a
into
mainAug 30, 2026

2 checks passed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@harrymove-ctrl@Abdol164

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
feat(skills): add security scanning to cicd - #26
Merged
harrymove-ctrl merged 2 commits into
mainfrom 
reopen/cicd-security-validation
Aug 30, 2026
Merged
feat(skills): add security scanning to cicd#26
harrymove-ctrl merged 2 commits into
mainfrom 
reopen/cicd-security-validation
Conversation
@harrymove-ctrl
@harrymove-ctrlharrymove-ctrl
commented
Aug 30, 2026

Copy link


Copy Markdown

Contributor
Reopens #23, which was reverted from main along with #22.
GitHub does not allow reopening a merged PR, so this is a fresh PR carrying the

same work. The commit is @Abdol164's original, cherry-picked unchanged — the

diff against main is byte-identical to #23 (7 files, +177/-23).
Why it was reverted
#23 was merged on top of #22; #22 was merged prematurely, so both were reverted

(ae4ae31, 567ffba). This PR is independent of #25 again, exactly as #23 was

independent of #22.
Ordering — read before merging
This conflicts with #25 (the reopened #22) on four files:
docs/ai/skills/conventions.md
skills/cicd/SKILL.md
skills/cicd/references/ci-structure.md
skills/delivery-review/SKILL.md

Both PRs will report MERGEABLE because GitHub tests each against main

independently, not against each other.
The one that matters is skills/delivery-review/SKILL.md. This PR edits lens 6

in place to name the scans that backed it; #25 deletes that inline lens block

and moves the lenses to references/lenses.md. If #25 lands first, this

edit has no target left — resolving the conflict by taking either side drops

it silently, and security-scanning.md ships while the review lens meant to

consume it never mentions scans. CI stays green either way.
If #25 lands first, re-target the lens-6 change to
skills/delivery-review/references/lenses.md, and take 0.4.0 for
cmk:cicd (a new guidance facet) over #25's 0.3.4 wording bump.
@Abdol164@harrymove-ctrl
feat(skills): add security scanning to cicd
a4556d6
The pipeline this skill composes validates build, test and docs and never
scans. Adds the four classes, scoped to what the diff touches and disclosed
either way, so a scan that could not run is not read as one that found
nothing — the scanner-level form of skipped-job-reports-success.
delivery-review's security lens now names the scans that backed it, so it
can meet the evidence bar that skill already sets.
@harrymove-ctrlharrymove-ctrl
mentioned this pull request
Aug 30, 2026
 Merged

@harrymove-ctrl@claude
Merge main into reopen/cicd-security-validation
d75f97f
Resolves the overlap with #25, which landed first:
- cicd/SKILL.md — keep main's "Use when…" description house form, carry this
branch's "add security scanning" / "scan for vulnerabilities" triggers, and
take 0.4.0 (a new guidance facet) over main's 0.3.4 wording bump.
- delivery-review/SKILL.md — #25 moved the seven lenses out to
references/lenses.md, so this branch's inline lens-6 edit had no target
left. Re-applied it there instead: the security lens still has to name the
scans that backed it and the classes that did not run. Taking either side
of that conflict verbatim would have dropped the change silently, with CI
green either way.
- conventions.md — main's roster, with cmk:cicd moved out of the 0.2.1 clause
into the 0.4.x band to match the version this branch sets.
- docs/ai/skills/delivery-review.md — record references/lenses.md and the new
Red Flags / Rationalizations sections, which #25's lens extraction left out
of the companion doc.
Verified after resolution: security-scanning.md, the ci-structure security
section, the empty-scan-reads-as-clean trap, the three Verify items and the
lens-6 scan disclosure are all present; #25's lens extraction and scope-band
reference are intact; skill-lint passes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@harrymove-ctrl
harrymove-ctrl
merged commit 0c7127a
into
mainAug 30, 2026

2 checks passed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@harrymove-ctrl@Abdol164

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(skills): add security scanning to cicd - #26
Merged
harrymove-ctrl merged 2 commits into
mainfrom 
reopen/cicd-security-validation
Aug 30, 2026
Merged
feat(skills): add security scanning to cicd#26
harrymove-ctrl merged 2 commits into
mainfrom 
reopen/cicd-security-validation
Conversation
@harrymove-ctrl
@harrymove-ctrlharrymove-ctrl
commented
Aug 30, 2026

Copy link


Copy Markdown

Contributor
Reopens #23, which was reverted from main along with #22.
GitHub does not allow reopening a merged PR, so this is a fresh PR carrying the

same work. The commit is @Abdol164's original, cherry-picked unchanged — the

diff against main is byte-identical to #23 (7 files, +177/-23).
Why it was reverted
#23 was merged on top of #22; #22 was merged prematurely, so both were reverted

(ae4ae31, 567ffba). This PR is independent of #25 again, exactly as #23 was

independent of #22.
Ordering — read before merging
This conflicts with #25 (the reopened #22) on four files:
docs/ai/skills/conventions.md
skills/cicd/SKILL.md
skills/cicd/references/ci-structure.md
skills/delivery-review/SKILL.md

Both PRs will report MERGEABLE because GitHub tests each against main

independently, not against each other.
The one that matters is skills/delivery-review/SKILL.md. This PR edits lens 6

in place to name the scans that backed it; #25 deletes that inline lens block

and moves the lenses to references/lenses.md. If #25 lands first, this

edit has no target left — resolving the conflict by taking either side drops

it silently, and security-scanning.md ships while the review lens meant to

consume it never mentions scans. CI stays green either way.
If #25 lands first, re-target the lens-6 change to
skills/delivery-review/references/lenses.md, and take 0.4.0 for
cmk:cicd (a new guidance facet) over #25's 0.3.4 wording bump.
@Abdol164@harrymove-ctrl
feat(skills): add security scanning to cicd
a4556d6
The pipeline this skill composes validates build, test and docs and never
scans. Adds the four classes, scoped to what the diff touches and disclosed
either way, so a scan that could not run is not read as one that found
nothing — the scanner-level form of skipped-job-reports-success.
delivery-review's security lens now names the scans that backed it, so it
can meet the evidence bar that skill already sets.
@harrymove-ctrlharrymove-ctrl
mentioned this pull request
Aug 30, 2026
 Merged

@harrymove-ctrl@claude
Merge main into reopen/cicd-security-validation
d75f97f
Resolves the overlap with #25, which landed first:
- cicd/SKILL.md — keep main's "Use when…" description house form, carry this
branch's "add security scanning" / "scan for vulnerabilities" triggers, and
take 0.4.0 (a new guidance facet) over main's 0.3.4 wording bump.
- delivery-review/SKILL.md — #25 moved the seven lenses out to
references/lenses.md, so this branch's inline lens-6 edit had no target
left. Re-applied it there instead: the security lens still has to name the
scans that backed it and the classes that did not run. Taking either side
of that conflict verbatim would have dropped the change silently, with CI
green either way.
- conventions.md — main's roster, with cmk:cicd moved out of the 0.2.1 clause
into the 0.4.x band to match the version this branch sets.
- docs/ai/skills/delivery-review.md — record references/lenses.md and the new
Red Flags / Rationalizations sections, which #25's lens extraction left out
of the companion doc.
Verified after resolution: security-scanning.md, the ci-structure security
section, the empty-scan-reads-as-clean trap, the three Verify items and the
lens-6 scan disclosure are all present; #25's lens extraction and scope-band
reference are intact; skill-lint passes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@harrymove-ctrl
harrymove-ctrl
merged commit 0c7127a
into
mainAug 30, 2026

2 checks passed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@harrymove-ctrl@Abdol164

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(skills): add security scanning to cicd - #26
Merged
harrymove-ctrl merged 2 commits into
mainfrom 
reopen/cicd-security-validation
Aug 30, 2026
Merged
feat(skills): add security scanning to cicd#26
harrymove-ctrl merged 2 commits into
mainfrom 
reopen/cicd-security-validation
Conversation
@harrymove-ctrl
@harrymove-ctrlharrymove-ctrl
commented
Aug 30, 2026

Copy link


Copy Markdown

Contributor
Reopens #23, which was reverted from main along with #22.
GitHub does not allow reopening a merged PR, so this is a fresh PR carrying the

same work. The commit is @Abdol164's original, cherry-picked unchanged — the

diff against main is byte-identical to #23 (7 files, +177/-23).
Why it was reverted
#23 was merged on top of #22; #22 was merged prematurely, so both were reverted

(ae4ae31, 567ffba). This PR is independent of #25 again, exactly as #23 was

independent of #22.
Ordering — read before merging
This conflicts with #25 (the reopened #22) on four files:
docs/ai/skills/conventions.md
skills/cicd/SKILL.md
skills/cicd/references/ci-structure.md
skills/delivery-review/SKILL.md

Both PRs will report MERGEABLE because GitHub tests each against main

independently, not against each other.
The one that matters is skills/delivery-review/SKILL.md. This PR edits lens 6

in place to name the scans that backed it; #25 deletes that inline lens block

and moves the lenses to references/lenses.md. If #25 lands first, this

edit has no target left — resolving the conflict by taking either side drops

it silently, and security-scanning.md ships while the review lens meant to

consume it never mentions scans. CI stays green either way.
If #25 lands first, re-target the lens-6 change to
skills/delivery-review/references/lenses.md, and take 0.4.0 for
cmk:cicd (a new guidance facet) over #25's 0.3.4 wording bump.
@Abdol164@harrymove-ctrl
feat(skills): add security scanning to cicd
a4556d6
The pipeline this skill composes validates build, test and docs and never
scans. Adds the four classes, scoped to what the diff touches and disclosed
either way, so a scan that could not run is not read as one that found
nothing — the scanner-level form of skipped-job-reports-success.
delivery-review's security lens now names the scans that backed it, so it
can meet the evidence bar that skill already sets.
@harrymove-ctrlharrymove-ctrl
mentioned this pull request
Aug 30, 2026
 Merged

@harrymove-ctrl@claude
Merge main into reopen/cicd-security-validation
d75f97f
Resolves the overlap with #25, which landed first:
- cicd/SKILL.md — keep main's "Use when…" description house form, carry this
branch's "add security scanning" / "scan for vulnerabilities" triggers, and
take 0.4.0 (a new guidance facet) over main's 0.3.4 wording bump.
- delivery-review/SKILL.md — #25 moved the seven lenses out to
references/lenses.md, so this branch's inline lens-6 edit had no target
left. Re-applied it there instead: the security lens still has to name the
scans that backed it and the classes that did not run. Taking either side
of that conflict verbatim would have dropped the change silently, with CI
green either way.
- conventions.md — main's roster, with cmk:cicd moved out of the 0.2.1 clause
into the 0.4.x band to match the version this branch sets.
- docs/ai/skills/delivery-review.md — record references/lenses.md and the new
Red Flags / Rationalizations sections, which #25's lens extraction left out
of the companion doc.
Verified after resolution: security-scanning.md, the ci-structure security
section, the empty-scan-reads-as-clean trap, the three Verify items and the
lens-6 scan disclosure are all present; #25's lens extraction and scope-band
reference are intact; skill-lint passes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@harrymove-ctrl
harrymove-ctrl
merged commit 0c7127a
into
mainAug 30, 2026

2 checks passed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@harrymove-ctrl@Abdol164

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
feat(skills): add security scanning to cicd - #26
Merged
harrymove-ctrl merged 2 commits into
mainfrom 
reopen/cicd-security-validation
Aug 30, 2026
Merged
feat(skills): add security scanning to cicd#26
harrymove-ctrl merged 2 commits into
mainfrom 
reopen/cicd-security-validation
Conversation
@harrymove-ctrl
@harrymove-ctrlharrymove-ctrl
commented
Aug 30, 2026

Copy link


Copy Markdown

Contributor
Reopens #23, which was reverted from main along with #22.
GitHub does not allow reopening a merged PR, so this is a fresh PR carrying the

same work. The commit is @Abdol164's original, cherry-picked unchanged — the

diff against main is byte-identical to #23 (7 files, +177/-23).
Why it was reverted
#23 was merged on top of #22; #22 was merged prematurely, so both were reverted

(ae4ae31, 567ffba). This PR is independent of #25 again, exactly as #23 was

independent of #22.
Ordering — read before merging
This conflicts with #25 (the reopened #22) on four files:
docs/ai/skills/conventions.md
skills/cicd/SKILL.md
skills/cicd/references/ci-structure.md
skills/delivery-review/SKILL.md

Both PRs will report MERGEABLE because GitHub tests each against main

independently, not against each other.
The one that matters is skills/delivery-review/SKILL.md. This PR edits lens 6

in place to name the scans that backed it; #25 deletes that inline lens block

and moves the lenses to references/lenses.md. If #25 lands first, this

edit has no target left — resolving the conflict by taking either side drops

it silently, and security-scanning.md ships while the review lens meant to

consume it never mentions scans. CI stays green either way.
If #25 lands first, re-target the lens-6 change to
skills/delivery-review/references/lenses.md, and take 0.4.0 for
cmk:cicd (a new guidance facet) over #25's 0.3.4 wording bump.
@Abdol164@harrymove-ctrl
feat(skills): add security scanning to cicd
a4556d6
The pipeline this skill composes validates build, test and docs and never
scans. Adds the four classes, scoped to what the diff touches and disclosed
either way, so a scan that could not run is not read as one that found
nothing — the scanner-level form of skipped-job-reports-success.
delivery-review's security lens now names the scans that backed it, so it
can meet the evidence bar that skill already sets.
@harrymove-ctrlharrymove-ctrl
mentioned this pull request
Aug 30, 2026
 Merged

@harrymove-ctrl@claude
Merge main into reopen/cicd-security-validation
d75f97f
Resolves the overlap with #25, which landed first:
- cicd/SKILL.md — keep main's "Use when…" description house form, carry this
branch's "add security scanning" / "scan for vulnerabilities" triggers, and
take 0.4.0 (a new guidance facet) over main's 0.3.4 wording bump.
- delivery-review/SKILL.md — #25 moved the seven lenses out to
references/lenses.md, so this branch's inline lens-6 edit had no target
left. Re-applied it there instead: the security lens still has to name the
scans that backed it and the classes that did not run. Taking either side
of that conflict verbatim would have dropped the change silently, with CI
green either way.
- conventions.md — main's roster, with cmk:cicd moved out of the 0.2.1 clause
into the 0.4.x band to match the version this branch sets.
- docs/ai/skills/delivery-review.md — record references/lenses.md and the new
Red Flags / Rationalizations sections, which #25's lens extraction left out
of the companion doc.
Verified after resolution: security-scanning.md, the ci-structure security
section, the empty-scan-reads-as-clean trap, the three Verify items and the
lens-6 scan disclosure are all present; #25's lens extraction and scope-band
reference are intact; skill-lint passes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@harrymove-ctrl
harrymove-ctrl
merged commit 0c7127a
into
mainAug 30, 2026

2 checks passed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@harrymove-ctrl@Abdol164