feat: Add Repo Guardian templates to gh-aw-adoption skill

[rysweet]

Summary

• Adds repo-guardian.md and repo-guardian-gate.yml template files to the existing gh-aw-adoption skill
• Updates SKILL.md with a featured "Repo Guardian" section including quick setup instructions (4 steps)
• Adds Repo Guardian to the Security & Compliance workflow list

What's Changed

.claude/skills/gh-aw-adoption/repo-guardian.md (new)

• gh-aw agentic workflow template (the AI agent prompt)
• Reviews PRs for ephemeral content: meeting notes, temp scripts, point-in-time docs
• Uses safe-outputs with max 1 comment; read-only GitHub access
• Adapted from cybergym production workflow

.claude/skills/gh-aw-adoption/repo-guardian-gate.yml (new)

• Standard GitHub Actions workflow that enforces Repo Guardian as a blocking CI check
• Triggers on PR events and PR comment events (to re-run after override)
• Requires no secrets; reads PR comments to determine pass/fail

.claude/skills/gh-aw-adoption/SKILL.md (updated)

• Added "Repo Guardian: Featured First Workflow" section before the workflow catalog
• Includes quick 4-step setup: copy templates → compile → add secret → commit
• References template file locations within the skill directory

Two-Workflow Architecture

PR opened
  → repo-guardian.lock.yml (compiled from .md)
    → AI agent reads changed files (read-only)
    → Posts ONE comment: "Passed" or "Action Required"
  
  → repo-guardian-gate.yml
    → Waits 60s for agent comment
    → Fails CI if "Action Required" without override
    → Override: PR comment "repo-guardian:override <reason>"

Test plan

• Copy repo-guardian.md to a test repo and compile with gh aw compile repo-guardian
• Verify the compiled .lock.yml matches the cybergym production version structure
• Confirm repo-guardian-gate.yml is valid GitHub Actions YAML
• Test override mechanism with a flagged PR

🤖 Generated with Claude Code

[github-actions]

🤖 Auto-fixed version bump

The version in pyproject.toml has been automatically bumped to the next patch version.

If you need a minor or major version bump instead, please update pyproject.toml manually and push the change.

[github-actions]

Repo Guardian - Passed

All 4 changed files have been reviewed:

• .claude/skills/gh-aw-setup/SKILL.md - Durable skill documentation ✅
• .claude/skills/gh-aw-setup/repo-guardian-gate.yml - GitHub Actions workflow configuration ✅
• .claude/skills/gh-aw-setup/repo-guardian.md - Reusable workflow template ✅
• pyproject.toml - Standard project configuration (version bump) ✅

No ephemeral content detected. All files are permanent, reusable project components.

AI generated by Repo Guardian

[github-actions]

🤖 Auto-fixed version bump

The version in pyproject.toml has been automatically bumped to the next patch version.

If you need a minor or major version bump instead, please update pyproject.toml manually and push the change.

[github-actions]

Repo Guardian - Passed

All 4 changed files have been reviewed:

• .claude/skills/gh-aw-adoption/SKILL.md - Durable skill documentation ✅
• .claude/skills/gh-aw-adoption/repo-guardian-gate.yml - GitHub Actions workflow configuration ✅
• .claude/skills/gh-aw-adoption/repo-guardian.md - Reusable agentic workflow template ✅
• pyproject.toml - Standard project configuration (version bump) ✅

No ephemeral content detected. All files are permanent, reusable project components.

AI generated by Repo Guardian

AI generated by Repo Guardian

[nlscng]

I restarted my session on my attempt to port repo guardian to amplihack with pre commit hook this afternoon, and somehow i've driven it into deterministic pattern matching and grep-like checks.