Secure PR Workflow

Follow these steps in order. Do not skip any step.

Step 1 — Pre-flight checks

Run the linter and tests locally. If either fails, fix the issues before continuing.

ruff check .
ruff format --check .
pytest

Step 2 — Security review

Run the /security-review slash command to perform a full security review of all pending changes. This reviews the diff for:

• Hardcoded secrets or API keys
• Injection vulnerabilities
• Unsafe data handling
• Dependency issues
• Any other security concerns

Do not proceed to step 3 until the security review is complete and all findings are addressed.

Step 3 — Create the PR

Create the pull request using the standard format:

gh pr create --title "<short title>" --body "$(cat <<'EOF'
## Summary
<bullet points summarizing changes>

## Security Review
- [x] Security review completed via `/security-review`
- [x] No hardcoded secrets or API keys
- [x] No injection vulnerabilities found

## Test plan
<bulleted checklist of testing done>

🤖 Generated with [Claude Code](https://claude.com/claude-code)
EOF
)"

Step 4 — Watch CI checks

After the PR is created, wait for all CI checks (lint, test, CodeQL) to complete:

gh pr checks --watch

Report the final status of each check to the user. If any check fails, investigate the failure, fix it, push the fix, and re-watch.