# Git Publish

> git-publish

- Skill: `gleb-nikitin/git-publish` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add gleb-nikitin/git-publish`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gleb-nikitin/git-publish/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: gleb-nikitin (https://skillmd.com/u/gleb-nikitin)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/gleb-nikitin/git-publish

---

# git-publish

Safe git commit and publish operations for project repositories.

Status: development scaffold (target protocol), implementation in progress.

## Usage

```
/Users/glebnikitin/work/rss/skills/git-publish/scripts/run <operation> --repo /absolute/path [args...]
```

`--repo` is always required. Must be an absolute path to a git repo. Never use workspace root (`/Users/glebnikitin/work`).

## Workflow

Standard publish path:
```
commit → push pr → [user merges PR on GitHub] → merge-done
```

Initial publish (new projects without remote history, explicit user request only):
```
commit → push no-pr
```

## Important: log before commit

The script never writes to project logs. The correct sequence:
```
1. do work
2. write to agent/log.md
3. run commit        ← log entry is captured in the commit
4. run push pr
```

Never write to logs between commit and push — it creates a dirty diff that breaks the push.

## Operations

### `commit`

Local safepoint. Saves current state so rollback is possible.

```
run commit --repo /path [point name words...]
```

- Creates exactly one local commit. No push, no branch creation.
- Point name becomes the commit message. Default: `wip: local checkpoint`.
- The script handles safety filtering automatically (see Safety below).
- Output: committed SHA, included files, excluded files with reasons.
- Exit 0 on success or nothing-to-commit. Exit 1 on error.

### `push pr`

Publish the latest safepoint via PR.

```
run push pr --repo /path [--topic <slug>]
```

- `--topic` is optional. Used for branch naming: `publish/<topic>` or `publish/<short-sha>` if omitted.
- Creates a branch from HEAD, pushes it, opens a PR to main via `gh`.
- After PR creation, switches back to main locally.
- Requires clean working tree (no uncommitted changes except safety-excluded files).
- Output: PR URL, branch, commit SHA.

### `push no-pr`

Push main directly to remote. For initial project setup only.

```
run push no-pr --repo /path
```

- Use only for new projects that have never pushed to remote.
- Pushes main to origin.

### `merge-done`

Post-merge cleanup.

```
run merge-done --repo /path
```

- Run only after user confirms the PR was merged.
- Syncs local main with remote, removes the publish branch (local + remote).
- Final state: on `main`, `main == origin/main`, no stale branches.
- Does not write to project logs (caller's responsibility).

## Safety

The `run` script enforces safety filtering automatically:
- Excludes secrets (`.env*`, `*.pem`, `*.key`, `*.p12`, `*.pfx`).
- Excludes agent/workstation artifacts (`.claude/`, `.DS_Store`, editor temps).
- Excludes build artifacts (`dist/`).
- Stages files individually (never `git add -A` or `git add .`).
- Reports all excluded files with reasons.

Default branch is `main`. Override in project `AGENTS.md` if different.