Skip to content
Back to skills

Hotfix

ASecurity

Emergency hotfix deploy — commit, push homolog, PR to main, merge now. Use on `/hotfix <description>`.

  • 3 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added September 5, 2026
ai-agentsgobashgitapi

Works with

  • terminal
  • api

Security analysis

A100/100

Pro scans all 3 files and shows the line behind each finding

Scanned October 2, 2026

npx -y skills add bravros/bravros --skill hotfix --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Hotfix?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Hotfix
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/bravros-hotfix/badge)](https://www.skillsdirectory.com/skills/bravros-hotfix)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: hotfix
core: true
description: Emergency hotfix deploy — commit, push homolog, PR to main, merge now. Use on `/hotfix <description>`.
---

# hotfix

Read [briefing.md](references/briefing.md) on demand for detailed context and instructions.

INTENT: ship an urgent production fix now, bypassing the plan workflow. Flow: confirm repo → commit → push/merge into homolog → PR homolog→main → wait for mergeability → merge → sync back → deploy status. `$ARGUMENTS` is the description — ask if empty.

## Hard constraints

- **Running `/hotfix` IS the approval for merge-to-main** — the emergency-path exemption: no user question checkpoints between commit and merge.
- **Never route a hotfix through `/pr` → `/pr-review` → `/finish`.** If a review is wanted it is not a hotfix — say so and stop instead of drifting into "how far should /finish take it?".
- **The autopr lock is the one hard gate that remains.** Refuse if `bravros autopr status` reports lock present.
- **The police staging lane — not a token — is what lets the merge through**: head `homolog`, `mergeStateStatus` `CLEAN`, no autonomous lock, plain `gh pr merge 1234 --merge` with the **literal** PR number (no `cd … &&`, no `-R`/URL) — the hook reads raw command text, so a `$VAR` in the PR argument is unreadable → blocked. A repo with `police.staging_lane: reviewed` needs `bravros police unlock` from a separate terminal — say so ONCE, do not loop.
- **Merge-lock is intentionally skipped** — one emergency at a time.
- **NEVER delete the homolog branch after merge. NEVER skip the PR** — main is protected.
- If targeted tests fail, STOP and ask.

## Quick Flow Summary

0. **Confirm repo identity** before anything: `git remote get-url origin` + `basename "$(git rev-parse --show-toplevel)"` — a hotfix in the wrong checkout is the worst possible mistake.
1. Refuse on `main`/`master`. Strip issue ref for PR title / `Closes #42`.
2. Format files → `bravros commit "🩹 hotfix: <description>" <changed files only>`.
3. Push & merge to `homolog` → `gh pr create --base main --head homolog --title "🩹 hotfix: <description>"` (body written with the Write tool to a **literal absolute path** in a previous step, then `--body-file <that path>` as its own call — never `$VAR`, `cp`, or a relative path; no attribution lines).
4. **Wait for mergeability**, or the first merge hits the `UNKNOWN` block: `until [ "$(gh pr view "$PR_NUMBER" --json mergeStateStatus -q .mergeStateStatus)" != "UNKNOWN" ]; do sleep 2; done`.
5. Check autopr gate → `gh pr merge 1234 --merge > /tmp/bravros-merge-1234.txt 2>&1` (substitute the literal number — a `$VAR` here is unreadable to the hook; no `cd … &&`, no `| tail`) → verify state == `MERGED`. A `✋🏽 Police Block` names its reason — relay it in one line; never `gh api`/raw HTTP, never `/promote`.
6. Sync `homolog` from `main` (`git checkout homolog && git pull && git fetch origin main && git merge ...`).
7. Close plan if applicable (`.planning/events.jsonl`) → `bravros commit`.
8. **Deploy status line, explicit**: `merged main @ <sha> · deploy: <auto-triggered / manual / none> · built+restarted: <yes / no / n-a> · verified: <how / not yet>`. Compiled or infra targets (Go binaries, containers, homelab) must say whether a rebuild + restart on the server is still required.
9. Announce via `bash ~/.agent_config/scripts/announce.sh --force "<PT-BR>" studio || true` (template in briefing).

Files in this skill

  • SKILL.md1.5 KB
  • references/briefing.md4 KB
  • skill.yaml2 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.