Skip to content
Back to skills

Create Pr

ASecurity

Stage, commit, push, and create GitHub PRs for the current branch — always main, then automatically cherry-picks to release/stable.

  • 303 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added June 6, 2026
devopsbashazuregitdevops

Works with

  • claude code
  • cli

Security analysis

A96/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro shows the line behind each finding and how to fix it

Scanned June 6, 2026

npx -y skills add microsoft/powerplatform-build-tools --skill create-pr --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Create Pr?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Create Pr
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/microsoft-create-pr/badge)](https://www.skillsdirectory.com/skills/microsoft-create-pr)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: create-pr
description: Stage, commit, push, and create GitHub PRs for the current branch — always main, then automatically cherry-picks to release/stable.
user-invocable: true
---

# Create PR

Assumes you are on the right branch with changes ready to commit (or already committed) and `npm run ci` has passed.

For **CLI version bumps** use `/pac-cli-update` — it handles dual PRs (main + release/stable) automatically.
For **reviewing** an existing PR use `/review <number>`.

---

## Step 1 — Stage and commit (skip if already committed)

Stage files explicitly — never `git add .`:

```bash
git add <specific files>
git status  # confirm nothing accidental staged
git commit -m "<type>: <description>"
```

Commit types: `fix:` `feat:` `chore:` `build:` `docs:`

---

## Step 2 — Push and create the main PR

```bash
git push -u origin HEAD 2>&1
```

Capture the current branch name and the SHA(s) to cherry-pick:

```bash
MAIN_BRANCH=$(git branch --show-current)
COMMITS=$(git log origin/main..HEAD --reverse --format="%H")
```

Pick the template matching what changed:

### Dependency update (`package.json` / `package-lock.json` only)

```bash
gh pr create \
  --base main \
  --title "chore: update dependencies" \
  --body "$(cat <<'EOF'
## Summary
- <what was updated and why>

## Dependencies updated

| Package | Before | After | Reason |
| ------- | ------ | ----- | ------ |
| ...     | ...    | ...   | ...    |

## Known limitations / follow-ups
- <accepted risks or deferred items>

## Test plan
- [ ] `npm install` clean
- [ ] `npm audit` — no new vulnerabilities introduced
- [ ] `npm run ci` passes (functional tests exempt)

🤖 Generated with [Claude Code](https://claude.com/claude-code)
EOF
)"
```

### Feature / bug fix (`src/` or `gulp/` changes)

```bash
gh pr create \
  --base main \
  --title "<fix|feat>: <concise description under 70 chars>" \
  --body "$(cat <<'EOF'
## Summary
- <what changed and why>

## Tasks affected
<!-- List any Azure DevOps tasks whose behaviour changed -->

## Architecture impact
<!-- If any layer boundary changed: task.json input names, bundleDependencies,
     service connection schema, BuildToolsHost/RunnerParams interface -->

## Known limitations / follow-ups
- <anything accepted as risk or deferred>

## Test plan
- [ ] `npm run ci` passes (functional tests exempt)
- [ ] Manual pipeline run on DEV stage (if task behaviour changed)

🤖 Generated with [Claude Code](https://claude.com/claude-code)
EOF
)"
```

Capture the main PR number/URL from the output — you'll reference it in the release PR.

---

## Step 3 — Cherry-pick to release/stable

Create a release branch off `release/stable`, cherry-pick all commits from the main branch, push, and open the paired PR.

```bash
RELEASE_BRANCH="${MAIN_BRANCH}-release"

git fetch origin release/stable 2>&1
git checkout -b "$RELEASE_BRANCH" origin/release/stable 2>&1

# Cherry-pick each commit from the main branch (in order)
for SHA in $COMMITS; do
  git cherry-pick "$SHA" 2>&1
done

git push -u origin "$RELEASE_BRANCH" 2>&1
```

Then open the release PR targeting `release/stable`:

```bash
gh pr create \
  --base release/stable \
  --title "<same title as main PR>" \
  --body "$(cat <<'EOF'
## Summary

Cherry-pick of #<main-pr-number> to `release/stable`.

- <one-line description of what changed>

## Paired main PR
#<main-pr-number>

🤖 Generated with [Claude Code](https://claude.com/claude-code)
EOF
)"
```

---

## Step 4 — Prompt user to queue the official build

After printing both PR URLs, tell the user:

```
Both PRs are open for review:
  Main PR:    https://github.com/microsoft/powerplatform-build-tools/pull/<n>
  Release PR: https://github.com/microsoft/powerplatform-build-tools/pull/<m>

Once both are merged, queue the official build to sign and publish the package to the VS Marketplace:
  https://dev.azure.com/dynamicscrm/OneCRM/_build?definitionId=21491

When queuing, set these pipeline variables:
  - GITHUB_TOKEN            GitHub PAT (repo scope, SSO enabled for 'microsoft' org)
  - AZ_DevOps_Read_PAT      PAT to read from the AzDO DPX-Tools-Upstream feed
  - isEsrpEnabled           true
  - PUBLISH_TO_MARKETPLACE  true
```

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…