From 9df2b79bb02ca6a20036141163aabb8ce1dd0704 Mon Sep 17 00:00:00 2001
From: amcheste-ai-agent <278991699+amcheste-ai-agent@users.noreply.github.com>
Date: Wed, 8 Jul 2026 15:16:14 -0400
Subject: [PATCH] docs: rescue uncommitted skill hardening from working tree
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Recovered improvements that were live in the symlinked skills but never
committed (found while syncing develop after PR #104):

- Tag ruleset bypass_actors in create-repo and setup-repo — without
  them the ruleset binds admins too and no v* release tag can ever be
  pushed (App 3490270 for /publish-release, RepositoryRole 5 for the
  human).
- Enable/verify "Allow GitHub Actions to create and approve pull
  requests" — required by the monthly dependency release.
- setup-repo check-name guidance for centralized reusable-validate
  repos (validate / Lint, validate / Commit Lint, optional gitleaks).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: amcheste <13696614+amcheste@users.noreply.github.com>
---
 claude-skills/create-repo/SKILL.md | 17 +++++++++++++++++
 claude-skills/setup-repo/SKILL.md  | 14 +++++++++++++-
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/claude-skills/create-repo/SKILL.md b/claude-skills/create-repo/SKILL.md
index 337a0c2..d85f5e4 100644
--- a/claude-skills/create-repo/SKILL.md
+++ b/claude-skills/create-repo/SKILL.md
@@ -128,11 +128,28 @@ gh api repos/amcheste/<name>/rulesets \
     {"type": "deletion"},
     {"type": "non_fast_forward"},
     {"type": "creation"}
+  ],
+  "bypass_actors": [
+    {"actor_id": 3490270, "actor_type": "Integration", "bypass_mode": "always"},
+    {"actor_id": 5, "actor_type": "RepositoryRole", "bypass_mode": "always"}
   ]
 }
 EOF
 ```
 
+The bypass actors matter: rulesets bind everyone, including admins, so
+without them no release tag can ever be pushed. Actor 3490270 is the
+`amcheste-ai-agent` GitHub App; RepositoryRole 5 is repo admin.
+
+**Enable Actions PR creation** (the monthly dependency release cannot open
+its release PR without it):
+
+```bash
+gh api -X PUT repos/amcheste/<name>/actions/permissions/workflow \
+  -f default_workflow_permissions=read \
+  -F can_approve_pull_request_reviews=true
+```
+
 ## Step 4 — Personalise the repo
 
 Open the following files in the editor and prompt the user to fill them in:
diff --git a/claude-skills/setup-repo/SKILL.md b/claude-skills/setup-repo/SKILL.md
index 4f899b3..0c4247d 100644
--- a/claude-skills/setup-repo/SKILL.md
+++ b/claude-skills/setup-repo/SKILL.md
@@ -105,7 +105,9 @@ Require a PR and status checks before merging. Check if `.github/workflows/valid
 gh api repos/<owner/repo>/contents/.github/workflows/validate.yml 2>/dev/null && echo "exists"
 ```
 
-If validate.yml **exists**, ask the user which status check names to require (default: `Lint`, `Commit Lint`). If it **doesn't exist**, apply protection without required checks — just require a PR.
+If validate.yml **exists**, ask the user which status check names to require. Defaults by validate style: a local validate reports `Lint` and `Commit Lint`; a repo calling the centralized `reusable-validate.yml` from amcheste/gh-workflows reports `validate / Lint` and `validate / Commit Lint` (a `uses:` entry under `jobs:` means centralized). If the repo has a `gitleaks.yml` stub, offer to also require `gitleaks / Gitleaks`. If validate.yml **doesn't exist**, apply protection without required checks — just require a PR.
+
+Also verify the repo setting **"Allow GitHub Actions to create and approve pull requests"** is enabled (`gh api repos/<owner/repo>/actions/permissions/workflow`); the monthly dependency release cannot open its PR without it.
 
 ```bash
 gh api repos/<owner/repo>/branches/develop/protection \
@@ -175,11 +177,21 @@ gh api repos/<owner/repo>/rulesets \
     {"type": "deletion"},
     {"type": "non_fast_forward"},
     {"type": "creation"}
+  ],
+  "bypass_actors": [
+    {"actor_id": 3490270, "actor_type": "Integration", "bypass_mode": "always"},
+    {"actor_id": 5, "actor_type": "RepositoryRole", "bypass_mode": "always"}
   ]
 }
 EOF
 ```
 
+The bypass actors matter: rulesets bind everyone, including admins, so
+without them no release tag can ever be pushed. Actor 3490270 is the
+`amcheste-ai-agent` GitHub App (lets Epsilon complete `/publish-release`);
+RepositoryRole 5 is repo admin (lets the human). Everyone else stays fully
+blocked from creating, deleting, or moving `v*` tags.
+
 ## Step 7 — Verify CODEOWNERS routing
 
 Bot-authored PRs (via the `amcheste-ai-agent` GitHub App) need