feat(agents): add pull request creation skill - #1079
Conversation
Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>
Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>
Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>
|
📝 WalkthroughWalkthroughChangesContributor pull request workflow
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/skills/contributor-create-pr/SKILL.md:
- Line 204: Update the single-template branch in the PR creation instructions to
assign the temporary file path to NMP_PR_BODY, then redirect the trusted git
show output into that file before gh pr create uses it. Ensure the existing gh
pr create invocation receives the populated NMP_PR_BODY path.
- Around line 31-35: Update the repository URL validation around gh repo view,
remote URL checks, and the fetch/push commands to reject plaintext http:// and
git:// transports; permit only authenticated encrypted HTTPS or SSH URLs before
using any URL. Apply this validation consistently to the referenced command
sections and abort when a URL violates the allowed schemes.
- Around line 31-35: Update the repository validation steps around NMP_REPO and
git remote get-url origin to compare every configured fetch and push URL for
origin against $NMP_REPO before any fetch or push occurs; fail validation on
mismatches rather than only displaying the remote URL, while preserving the
existing GitHub target and authentication checks.
- Around line 42-45: Update the setup flow around NMP_BASE_BRANCH to validate
the origin remote first by retrieving its URL with git remote get-url origin and
comparing it with NMP_REPO. Stop immediately on mismatch, before git fetch,
assigning NMP_BASE_REF, or reading repository policy via git show; preserve the
existing branch discovery and fetch behavior after validation succeeds.
- Around line 197-207: Update the template-resolution workflow in the
contributor PR creation instructions to detect when the trusted base has no pull
request template but the feature branch adds one, and use a controlled bootstrap
PR body for that first-template installation. Preserve the existing behavior for
an absent template without a newly added replacement, multiple templates, and
changes to an existing template; only bypass the stop condition for the explicit
first-template bootstrap case.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 7bd54877-fd8e-467b-850e-571f47f46e4c
📒 Files selected for processing (2)
.agents/skills/contributor-create-pr/SKILL.md.github/PULL_REQUEST_TEMPLATE.md
| NMP_REPO=NVIDIA-NeMo/nemo-platform | ||
| gh auth status | ||
| gh repo view "$NMP_REPO" --json nameWithOwner,defaultBranchRef,url | ||
| git remote get-url origin | ||
| ``` |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
file=".agents/skills/contributor-create-pr/SKILL.md"
printf '%s\n' '--- targeted sections ---'
sed -n '20,55p;200,230p' "$file"
printf '%s\n' '--- git transport and remote checks ---'
rg -n -C 3 'git remote|git fetch|git push|remote\.|url\.|http://|git://' "$file"Repository: NVIDIA-NeMo/nemo-platform
Length of output: 5537
Sensitive Data Exposure (CWE-319): Cleartext Transmission of Sensitive Information
Reachability: Internal
Reject plaintext Git transport.
Validate every fetch and push URL before use. Reject http:// and git:// URLs, and allow only authenticated encrypted schemes such as HTTPS or SSH. Apply this check at lines 31-35, 42-45, and 213-219.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/contributor-create-pr/SKILL.md around lines 31 - 35, Update
the repository URL validation around gh repo view, remote URL checks, and the
fetch/push commands to reject plaintext http:// and git:// transports; permit
only authenticated encrypted HTTPS or SSH URLs before using any URL. Apply this
validation consistently to the referenced command sections and abort when a URL
violates the allowed schemes.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
git remote get-url --all origin
git remote get-url --push --all origin
gh repo view "$NMP_REPO" --json nameWithOwner --jq .nameWithOwnerRepository: NVIDIA-NeMo/nemo-platform
Length of output: 287
🏁 Script executed:
#!/bin/bash
sed -n '1,70p' .agents/skills/contributor-create-pr/SKILL.md
printf '\n--- remote and GitHub command sites ---\n'
rg -n -C 3 'git (fetch|push)|remote|get-url|gh repo view|NMP_REPO' .agents/skills/contributor-create-pr/SKILL.mdRepository: NVIDIA-NeMo/nemo-platform
Length of output: 9552
🏁 Script executed:
#!/bin/bash
python3 - <<'PY'
from pathlib import Path
p = Path(".agents/skills/contributor-create-pr/SKILL.md")
lines = p.read_text().splitlines()
checks = {
"remote_display_checks": [i + 1 for i, line in enumerate(lines)
if "git remote get-url" in line],
"fetch_commands": [i + 1 for i, line in enumerate(lines)
if "git fetch" in line],
"push_commands": [i + 1 for i, line in enumerate(lines)
if "git push" in line],
"remote_url_comparisons": [i + 1 for i, line in enumerate(lines)
if "NMP_REPO" in line and
("remote" in line.lower() or "url" in line.lower())],
}
for name, locations in checks.items():
print(f"{name}={locations}")
print("has_explicit_remote_target_comparison=",
any("nameWithOwner" in line and "remote" in line.lower()
for line in lines))
PYRepository: NVIDIA-NeMo/nemo-platform
Length of output: 327
Security Misconfiguration (CWE-16)
Reachability: Internal · Exploitability: Difficult
Validate the Git remote before fetching or pushing.
gh repo view "$NMP_REPO" validates the GitHub target, but git fetch origin and git push origin use the local origin configuration. Compare every fetch and push URL with $NMP_REPO; displaying the URL does not validate it.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/contributor-create-pr/SKILL.md around lines 31 - 35, Update
the repository validation steps around NMP_REPO and git remote get-url origin to
compare every configured fetch and push URL for origin against $NMP_REPO before
any fetch or push occurs; fail validation on mismatches rather than only
displaying the remote URL, while preserving the existing GitHub target and
authentication checks.
| NMP_BASE_BRANCH="$(gh repo view "$NMP_REPO" --json defaultBranchRef --jq '.defaultBranchRef.name')" | ||
| git fetch --prune origin "$NMP_BASE_BRANCH" | ||
| NMP_BASE_REF="origin/$NMP_BASE_BRANCH" | ||
| git show -s --format='%H %cs %s' "$NMP_BASE_REF" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
file=".agents/skills/contributor-create-pr/SKILL.md"
printf '%s\n' '--- relevant file ---'
sed -n '1,115p' "$file"
printf '%s\n' '--- repository references ---'
rg -n --fixed-strings 'NMP_REPO' .agents/skills/contributor-create-pr/SKILL.md
rg -n --fixed-strings 'git remote' .agents/skills/contributor-create-pr/SKILL.md
rg -n --fixed-strings 'AGENTS.md' .agents/skills/contributor-create-pr/SKILL.md
printf '%s\n' '--- tracked related files ---'
git ls-files '.agents/skills/contributor-create-pr/*'Repository: NVIDIA-NeMo/nemo-platform
Length of output: 9598
🏁 Script executed:
#!/bin/bash
set -eu
file=".agents/skills/contributor-create-pr/SKILL.md"
printf '%s\n' '--- relevant file ---'
sed -n '1,115p' "$file"
printf '%s\n' '--- repository references ---'
rg -n --fixed-strings 'NMP_REPO' "$file"
rg -n --fixed-strings 'git remote' "$file"
rg -n --fixed-strings 'AGENTS.md' "$file"
printf '%s\n' '--- tracked related files ---'
git ls-files '.agents/skills/contributor-create-pr/*'Repository: NVIDIA-NeMo/nemo-platform
Length of output: 9598
LLM Security (CWE-829): Inclusion of Functionality from Untrusted Control Sphere
Reachability: Internal
Validate the origin remote before loading repository policy.
gh repo view "$NMP_REPO" validates the GitHub target but does not validate origin. Compare git remote get-url origin with $NMP_REPO before fetching and reading policy from NMP_BASE_REF. Stop if they do not match.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/contributor-create-pr/SKILL.md around lines 42 - 45, Update
the setup flow around NMP_BASE_BRANCH to validate the origin remote first by
retrieving its URL with git remote get-url origin and comparing it with
NMP_REPO. Stop immediately on mismatch, before git fetch, assigning
NMP_BASE_REF, or reading repository policy via git show; preserve the existing
branch discovery and fetch behavior after validation succeeds.
| Locate the PR template in the trusted base, not in the feature branch and not in a recent PR body: | ||
|
|
||
| ```bash | ||
| git ls-tree -r --name-only "$NMP_BASE_REF" \ | ||
| | rg -i '(^|/)(pull_request_template)(\.md|/.*\.md)$' | ||
| ``` | ||
|
|
||
| - If exactly one template applies, copy it with `git show "$NMP_BASE_REF:<template-path>"` into a file created by `mktemp /tmp/nemo-platform-pr-body.XXXXXX`. | ||
| - If multiple templates exist, select the repository-defined template that matches the change. Ask when selection is ambiguous. | ||
| - If no template exists on the trusted base, report the missing repository dependency and stop before `gh pr create`. Do not invent a template or silently reuse a branch-modified or historical body. | ||
| - If the PR changes the template, still populate the trusted base version and explain the template change in that body. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
cat -n ".agents/skills/contributor-create-pr/SKILL.md" | sed -n '190,220p'Repository: NVIDIA-NeMo/nemo-platform
Length of output: 2196
🏁 Script executed:
# Check the full structure of the file to understand if this is documentation or implementation
wc -l ".agents/skills/contributor-create-pr/SKILL.md"
# Look for implementation code around this section
sed -n '1,50p' ".agents/skills/contributor-create-pr/SKILL.md"Repository: NVIDIA-NeMo/nemo-platform
Length of output: 3427
🏁 Script executed:
# Check if this PR adds .github/PULL_REQUEST_TEMPLATE.md
git diff --name-only origin/main HEAD | grep -i "pull_request_template"
# Also check what files are in .github on both branches
echo "=== Files in .github on base ==="
git ls-tree -r --name-only "origin/main" -- ".github/" | head -20
echo "=== Files in .github on this branch ==="
git ls-tree -r --name-only "HEAD" -- ".github/" | head -20Repository: NVIDIA-NeMo/nemo-platform
Length of output: 2074
🏁 Script executed:
# Check if there's implementation code (not just documentation) that handles this
# Look for any bash/script files in the same skill directory
ls -la ".agents/skills/contributor-create-pr/"
# Check for any implementation that might override the documented logic
find ".agents/skills/contributor-create-pr/" -type f \( -name "*.sh" -o -name "*.yml" -o -name "*.yaml" \)Repository: NVIDIA-NeMo/nemo-platform
Length of output: 336
🏁 Script executed:
# Check if there's any fallback or bootstrap logic earlier in the file
sed -n '1,196p' ".agents/skills/contributor-create-pr/SKILL.md" | grep -A5 -B5 -i "template\|bootstrap\|fallback"Repository: NVIDIA-NeMo/nemo-platform
Length of output: 1503
🏁 Script executed:
# Look at the full section 7 to understand the template handling logic
sed -n '175,210p' ".agents/skills/contributor-create-pr/SKILL.md"Repository: NVIDIA-NeMo/nemo-platform
Length of output: 2485
🏁 Script executed:
# Verify the content of the added PR template file
git show HEAD:.github/PULL_REQUEST_TEMPLATE.md | head -50Repository: NVIDIA-NeMo/nemo-platform
Length of output: 1775
Define bootstrap PR body for first-template installation.
Line 206 stops workflow if no template exists on the trusted base. Line 207 applies only when the base already has a template. This PR adds .github/PULL_REQUEST_TEMPLATE.md as the first template, which creates a chicken-and-egg problem: the workflow that validates and completes the PR body will block itself when the template does not yet exist on origin/main.
Add a controlled bootstrap body for PRs that install the first template. Detect when no template exists on the base but the PR adds one, then use the bootstrap body instead of stopping.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/contributor-create-pr/SKILL.md around lines 197 - 207, Update
the template-resolution workflow in the contributor PR creation instructions to
detect when the trusted base has no pull request template but the feature branch
adds one, and use a controlled bootstrap PR body for that first-template
installation. Preserve the existing behavior for an absent template without a
newly added replacement, multiple templates, and changes to an existing
template; only bypass the stop condition for the explicit first-template
bootstrap case.
| | rg -i '(^|/)(pull_request_template)(\.md|/.*\.md)$' | ||
| ``` | ||
|
|
||
| - If exactly one template applies, copy it with `git show "$NMP_BASE_REF:<template-path>"` into a file created by `mktemp /tmp/nemo-platform-pr-body.XXXXXX`. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
Set NMP_PR_BODY before creating the PR.
The instructions do not assign the temporary file path or redirect git show into it. Line [253] later passes $NMP_PR_BODY, which is unset unless the caller defines it separately. Set NMP_PR_BODY="$(mktemp ...)" and write the trusted template to that path before calling gh pr create.
Also applies to: 249-253
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/contributor-create-pr/SKILL.md at line 204, Update the
single-template branch in the PR creation instructions to assign the temporary
file path to NMP_PR_BODY, then redirect the trusted git show output into that
file before gh pr create uses it. Ensure the existing gh pr create invocation
receives the populated NMP_PR_BODY path.
1 participant
Summary
Add a repository-local pull request workflow and a trusted NeMo Platform pull request template. Together, they consolidate the repository's existing contribution requirements into a repeatable path from completed changes through validation, DCO auditing, publication, and review follow-up.
Changes
.agents/skills/contributor-create-pr/SKILL.mdwith branch and worktree checks, targeted validation selection, mandatory commit sign-off auditing, conventional title validation, safe pushes, CI and automated-review follow-up, and merge-conflict handling..github/PULL_REQUEST_TEMPLATE.md, adapting NemoClaw's core summary, change classification, quality-gate, and verification structure to NeMo Platform's targeted validation, documentation, conventional-title, and DCO workflows.Type of Change
Quality Gates
Verification
Signed-off-by:traileruv run pre-commit run -apasses, or any blocked checks are identified belowTargeted validation:
quick_validate.py .agents/skills/contributor-create-pr: passed.pre-commit run --files .github/PULL_REQUEST_TEMPLATE.md .agents/skills/contributor-create-pr/SKILL.md: passed.git diff --check origin/main...HEAD: passed.origin/main..HEAD: passed.uv 0.10.2while the repository requires<0.10.0, and the isolated worktree lacks the required Studio dependency installation and Node 22.23.2 runtime. Ruff, Ruff format, ty, Helm docs, lock drift, plugin import, merge-conflict, and all applicable changed-file hooks passed.Summary by CodeRabbit
Documentation
Chores