Add skill: ship-issue

[romulostorel]

Summary

Adds ship-issue — an autonomous PR pipeline that takes a GitHub issue number and runs it from "open ticket" to "open PR with self-review attached" without losing the human in the loop.

The skill spawns independent subagents for the plan and three review dimensions (security, UX, i18n) so planning and reviewing don't collapse into the same head — that separation is where bugs hide when shipping solo.

Six phases

1. Preflight — verify the issue is open, tree is clean, branch is up-to-date, gh is authenticated.
2. Plan (subagent) — designs files-to-edit, multi-tenancy classification (when applicable), test surface, i18n keys, out-of-scope list, risk callouts. Halts for plan approval.
3. Implement — feature branch, code + tests, run the project's quality-gate quartet (test/lint/SAST/dep-audit). Commit on Conventional Commits.
4. Parallel review — three subagents in one message, each blind to the others:
   • Reviewer A: security/SAST (Brakeman/bandit/gosec/npm-audit/cargo-audit per stack)
   • Reviewer B: UX & design-system consistency vs. the repo's existing patterns
   • Reviewer C: i18n & locale completeness (paired locale parity, interpolation parity, hardcoded strings)
5. Auto-fix — high findings: fixed before PR opens. Med: fixed unless costly. Low: cheap ones fixed, rest deferred.
6. PR open + self-review comment — halts for ship-it, then `gh pr create` and posts a self-review comment summarizing what each reviewer caught.

Stack support

Rails-first via `references/rails.md`, encoding the Codeminer42 house style — service objects, thin controllers, no model callbacks, paired locales, `acts_as_tenant`-style multi-tenancy when applicable.

For Node, Python, Go, Rust, and other stacks, the skill probes the repo for the right test/lint/SAST commands and adapts the reviewer briefs (file extensions to scan, i18n format to audit). It does not hallucinate commands — if it can't find one, it asks before proceeding.

Halt-and-confirm

Three mandatory pause points keep shared-state actions human-controlled:

1. Preflight (only if something is off).
2. Plan approval.
3. Final ship-it before `git push` + `gh pr create`.

Validation

Validated end-to-end at Codeminer42/hire42#34 → PR #35 (vendoring Devise views). The full pipeline produced a clean rspec/rubocop/brakeman/bundler-audit run, the three reviewers caught two med + four low findings, the meds and two cheap lows were auto-fixed, the remaining lows were documented as follow-ups in the PR body, and the self-review comment landed on the PR before merge.

Test plan

• `SKILL.md` frontmatter follows the template (name, description, license: MIT, metadata.author, metadata.version)
• Directory name matches frontmatter `name`
• README.md table updated with a row for `ship-issue`
• `references/rails.md` linked from `SKILL.md`
• Try the skill on a fresh issue in another Rails repo to validate Rails-path triggering
• Try the skill on a Node or Python repo to validate the cross-stack probe path