feat(pr-workflow): add the pull request loop plugin, and sync the marketplace versions

[kaiomagalhaes]

Summary

Adds pr-workflow, a plugin of five skills that make one pull request loop: write the pull request, review it, answer the review, and record the work that you defer. The skills come from a production repository; this version removes the paths, the tooling, and the domain of that repository, so that they work in any git repository. It also fixes a distribution bug that PR #1 introduced: marketplace.json advertised qa-check 3.1.0 with the v3 description, but plugin.json and SKILL.md are both 4.0.0, so claude plugin install showed stale metadata.

Changes

plugins/pr-workflow

• pr-create reads the branch diff, writes a title and a description, and opens the pull request. It finds the default branch with gh repo view instead of assuming main, reads .github/PULL_REQUEST_TEMPLATE.md on each run, and proposes a split into stacked pull requests above 20 files.
• pr-create-reviewed opens a draft, fans out to subagents that get only the pull request number, the diff, and their lens, presents one findings table, and marks the pull request ready. The isolation is the point: a reviewer that inherits the reasoning of the author agrees with it.
• review-pr examines a pull request across code quality, security, and the rules of the repository. It prints the review for your own pull request and posts inline comments on a pull request from a different author, after you approve them.
• pr-address-comments reads all three GitHub comment APIs, because inline comments, top-level comments, and review summaries are three different surfaces, and uses GraphQL to skip resolved threads.
• issue-create learns the title, label, and body conventions from the issues that exist, instead of applying a fixed template.
• Four reference files carry the long-form content: the description guide, the ASD-STE100 rules, the review criteria, and the issue body shapes.

Repository

• marketplace.json: qa-check moves from 3.1.0 to 4.0.0, and its description now matches plugin.json. The marketplace metadata moves to 1.3.0.
• README.md: the install command and the skill table list the new plugin. The copy instruction says that the five skills ship as one plugin, because they call each other.

Implementation Details

• One plugin, not five. pr-create-reviewed delegates its title and description to pr-create, and both it and review-pr read the same review-criteria.md. Separate plugins would let a user install half of a loop and break those links.
• The repository is a parameter, not a constant. Each skill that needed a repository-specific fact now reads it at run time: gh repo view for the default branch, ls .claude/agents/ for the specialist reviewers, gh label list for the label taxonomy, and REVIEW.md, CLAUDE.md, AGENTS.md, or CONTRIBUTING.md for the rules. Where the source skill named an accounting invariant, the text names "the load-bearing domain of the repository" and tells the skill where to find it.
• --body-file everywhere. A finding or a description that contains a backtick or a single quotation mark breaks an inline --body argument. The GitHub review API path writes a JSON file with the Write tool, so that the tool escapes each string.

Test Plan

• Each of the four *.json manifests parses.
• Each SKILL.md frontmatter parses as YAML, and its name matches its directory name.
• The version of each plugin matches between marketplace.json and plugin.json, and the descriptions match. All three plugins agree.
• Each references/*.md link resolves from its skill directory, and this includes the cross-skill link from pr-create-reviewed to ../review-pr/references/review-criteria.md.
• A search for the terms of the source repository finds no match: its name, its paths, its package manager, its deployment platform, its domain vocabulary, its agent names, and its lesson numbers.
• Each gh flag in the skills exists in gh 2.98.0: --body-file on pr create, pr edit, pr comment, pr review, and issue create; --input and -F key=@file on gh api.
• Not run: an end-to-end run of each skill against a live pull request. The skills are prose, so this needs a human reviewer to read them, or a real pull request in a repository that installs the plugin.

Notes

Risks:

• pr-create and pr-create-reviewed tell the model to run /qa-check before the push, and pr-create tells it to run /supply-chain-check when a lock file changes. Each reference says "if the plugin is installed", so a user who installs only pr-workflow is not blocked. A user who installs all three gets the full gate.
• The skills are written in ASD-STE100, to match the qa-check v4 rewrite. review-pr also makes the model write its findings in ASD-STE100, which is a stronger claim, and is worth a read.

Follow-ups:

• Seven more skills in the source repository are domain-specific: an accounting playbook, an endpoint scaffold, a documentation lockstep check, a domain-context loader, a migration playbook, an environment-variable protocol, and a configuration integrity check. Two of them, the migration playbook and the environment-variable protocol, could generalize later. The other five are only meaningful with the documentation of that repository.

🤖 Generated with Claude Code