feat: Create language-agnostic GitHub plugin for RSE power users

[cdcore09]

Summary

Create a new standalone GitHub plugin that provides agents, skills, and commands for GitHub power users working on research software engineering (RSE) projects. This plugin must be language-agnostic and work with any project in any language or combination of languages.

This plugin is NOT meant to replace the gh CLI. Instead, it's designed to be a gh CLI power user's companion — encoding RSE best practices for GitHub Actions, releases, organization management, repository health, and project automation. It assumes the user already knows basic gh usage and focuses on advanced patterns, opinionated best practices, and RSE-specific workflows.

The current project-management plugin contains several GitHub-related skills (github-actions, github-org-management, release-management, issue-triage, pre-commit-workflows, community-health-files) and agents (github-workflow-specialist, github-org-manager), but all are scoped to scientific Python. This new plugin should generalize that content for any language ecosystem.

---

Scope

What This Plugin IS

• RSE best practices for GitHub — opinionated guidance for how research software projects should use GitHub features
• A gh CLI power user toolkit — advanced gh commands, scripting patterns, and automation recipes
• GitHub Actions expertise — CI/CD patterns, reusable workflows, security hardening, caching strategies
• Release engineering — versioning, changelog management, automated publishing workflows
• Organization management — repo health auditing, lifecycle management, bulk operations
• Project automation — issue triage, labeling, stale management, templates

What This Plugin IS NOT

• Not a replacement for gh CLI basics (the user can read gh help)
• Not a GitHub API tutorial (though it uses gh api extensively)
• Not a git tutorial (the user knows git)

Core Areas

1. GitHub Actions & CI/CD

Topic	Coverage
Workflow design	Triggers, matrix strategies, concurrency, path filtering
Caching	Language-agnostic caching strategies (not just pip/conda)
Reusable workflows	Organization-shared workflows, composite actions, workflow_call
Security hardening	SHA-pinned actions, minimal permissions, script injection prevention, Dependabot for actions
Self-hosted runners	Setup, GPU runners, HPC integration
OIDC & Trusted Publishers	Token-free authentication to package registries and cloud providers
Secrets management	Repository vs environment secrets, OIDC for cloud providers
Testing patterns	Matrix builds for multi-language projects, large test data management
Container builds in CI	Building and pushing images (cross-references containerization plugin)
Artifact management	Upload/download artifacts between jobs, retention policies

Language-specific CI patterns as reference:

• Python (pytest, tox, nox, pixi)
• R (R CMD check, testthat)
• Julia (Pkg.test)
• Rust (cargo test, cargo clippy)
• Go (go test, golangci-lint)
• Node.js (npm test, vitest, eslint)
• C/C++ (CMake, CTest)

2. Release Engineering

Topic	Coverage
Semantic versioning	Language-agnostic SemVer guidance, pre-release conventions
Changelog management	towncrier, keep-a-changelog, conventional commits, auto-generated notes
GitHub Releases	Creating releases, auto-generated notes, .github/release.yml configuration
Tag management	Annotated tags, tag-triggered workflows, version extraction
Automated publishing	Tag-triggered workflows for any package registry
Multi-ecosystem publishing	PyPI, CRAN, npm, crates.io, Maven Central, etc. — patterns for each
Coordinated releases	Multi-package release coordination in monorepos

3. Organization Management

Topic	Coverage
Repository health auditing	Automated health checks across all org repos
Lifecycle management	Active → maintenance → archive transitions
Naming conventions	Org-wide naming standards and enforcement
The .github repository	Organization-wide defaults, profile README
Team & permissions	Team structure, least-privilege access, branch protection
Bulk operations	Multi-repo management with gh CLI scripting
Repository templates	Template repos for consistent project scaffolding

4. Project Automation

Topic	Coverage
Issue triage	Label taxonomies, priority frameworks, triage workflows
Issue & PR templates	Templates for bug reports, feature requests, RFCs
Stale management	Stale bot configuration, close policies
GitHub Projects	Project boards, custom fields, automation rules
Branch protection	Required reviews, status checks, merge strategies
CODEOWNERS	Ownership patterns for monorepos and multi-team projects
Community health files	CODE_OF_CONDUCT, CONTRIBUTING, SECURITY, SUPPORT, CITATION

5. Advanced gh CLI Patterns

Topic	Coverage
gh api scripting	Complex API queries, pagination, bulk operations
gh alias	Custom command aliases for common RSE workflows
gh extension	Useful extensions for RSE work
jq patterns	JSON processing for gh output
Cross-repo scripting	Operating across multiple repos in an organization

---

Proposed Plugin Structure

plugins/github/
  .claude-plugin/
    plugin.json
  README.md
  LICENSE
  agents/
    github-actions-expert.md          # CI/CD workflow design and optimization
    github-org-strategist.md          # Org management, health, lifecycle
    release-engineer.md               # Release automation and versioning
  skills/
    github-actions/                   # CI/CD patterns (language-agnostic)
      SKILL.md
      assets/                         # Reusable workflow templates
      references/                     # Security hardening, caching strategies
    release-engineering/              # Versioning, changelogs, publishing
      SKILL.md
      assets/                         # release.yml, changelog templates
      references/                     # SemVer guide, registry-specific patterns
    org-management/                   # Organization health and lifecycle
      SKILL.md
      assets/                         # Audit scripts, health check templates
      references/                     # Health metrics, lifecycle policies
    issue-management/                 # Triage, templates, automation
      SKILL.md
      assets/                         # Issue templates, label configs
      references/                     # Triage workflows, stale policies
    community-health/                 # Community health files and standards
      SKILL.md
      assets/                         # Template CONTRIBUTING, CoC, SECURITY, CITATION
      references/
    branch-protection/                # Protection rules, merge strategies, CODEOWNERS
      SKILL.md
      assets/
      references/
    gh-cli-advanced/                  # Power user gh CLI patterns
      SKILL.md
      assets/                         # Alias configs, scripts
      references/                     # jq patterns, API recipes
    github-projects/                  # Project boards, automation, tracking
      SKILL.md
      assets/
      references/
  commands/
    setup-ci.md                       # Scaffold CI for any project
    audit-org.md                      # Run org health audit
    plan-release.md                   # Plan and execute a release
    triage.md                         # Triage an issue or batch of issues
    setup-community-files.md          # Scaffold community health files

---

Key Requirements

1. Language-agnostic by default. All skills, agents, and commands must work for any language. Language-specific CI/release patterns should be reference material, not the primary guidance.
2. gh CLI power user orientation. Assume the user knows basic gh usage. Focus on advanced patterns, scripting, and automation — not basic commands.
3. RSE best practices. Opinionated guidance tailored to research software: CITATION.cff, reproducibility concerns, long deprecation cycles, HPC considerations, etc.
4. Adapt existing content. The current project-management plugin contains good Python-specific GitHub content that should be adapted and generalized:
   • skills/github-actions → generalize to any language
   • skills/github-org-management → preserve and expand
   • skills/release-management → generalize beyond Python/PyPI
   • skills/issue-triage → mostly language-agnostic already
   • skills/community-health-files → mostly language-agnostic already
   • skills/pre-commit-workflows → generalize to any pre-commit ecosystem
   • agents/github-workflow-specialist.md → generalize
   • agents/github-org-manager.md → preserve and expand
5. Security throughout. SHA-pinned actions, minimal permissions, OIDC tokens, secret scanning, Dependabot — security is not optional.
6. GitHub Projects coverage. Project boards, custom fields, and automation are increasingly important for RSE teams but poorly documented for this audience.
7. Advanced gh CLI patterns. The gh api + jq combination is extremely powerful for org management. Include real, tested recipes.

---

Migration Plan

Once this plugin is complete:

• The GitHub-related skills in project-management (github-actions, github-org-management, release-management, issue-triage, community-health-files, pre-commit-workflows) should be deprecated or replaced with pointers to this plugin
• The GitHub-related agents in project-management (github-workflow-specialist, github-org-manager) should be deprecated in favor of this plugin's agents
• The project-management plugin should be refactored to focus on project onboarding, handoffs, documentation validation, and other non-GitHub concerns
• Python-specific CI/release patterns from the existing skills should be included as language-specific reference material in the new plugin

---

Acceptance Criteria

• Plugin structure follows the established pattern (plugin.json, agents/, skills/, commands/)
• All skills work for projects in any language, not just Python
• GitHub Actions skill covers CI patterns for at least 4 languages beyond Python
• Release engineering skill covers publishing to at least 3 package registries beyond PyPI
• Org management skill includes health auditing scripts and lifecycle management
• Issue management covers triage, templates, and stale policies
• Community health files templates are language-agnostic
• Advanced gh CLI patterns skill includes gh api + jq recipes
• GitHub Projects coverage included
• Security hardening guidance woven throughout (SHA pinning, permissions, OIDC)
• Existing Python-specific content from project-management is preserved/adapted
• README with overview and usage instructions
• At least one command that scaffolds CI for a project in any detected language

[cdcore09]

Separation of Concerns Analysis

After a thorough review of all four existing plugins (project-management, scientific-python-development, scientific-domain-applications, ai-research-workflows), here is the overlap analysis and migration plan for this GitHub plugin.

---

What Moves Here from project-management

This plugin absorbs the majority of project-management's current content. The existing plugin is effectively a GitHub plugin wearing a project-management label.

Existing Content	Current Location	Size	Action
skills/github-actions	project-management	~1000 lines	Generalize and move. Currently Python-specific (pytest, pixi, nox, tox, PyPI trusted publishers). Keep Python CI as one language pattern; add R, Julia, Rust, Go, Node.js, C/C++ patterns.
skills/release-management	project-management	~1060 lines	Generalize and move. Deeply Python-specific (PyPI, conda-forge, towncrier, hatch, setuptools-scm). Generalize the SemVer/changelog/tag-triggered-release core; add multi-ecosystem publishing (CRAN, npm, crates.io, Maven Central).
skills/github-org-management	project-management	~835 lines	Move (mostly lift-and-shift). Already largely language-agnostic — gh CLI scripting, health metrics, archival workflows. Minor edits to remove "scientific Python" phrasing.
skills/issue-triage	project-management	—	Move (mostly lift-and-shift). Label taxonomies, priority frameworks, triage workflows — none of this depends on language.
skills/pre-commit-workflows	project-management	—	Generalize and move. pre-commit itself is language-agnostic, but the current hook list is Python-specific (ruff, mypy, nbstripout). Add hook recommendations for other ecosystems.
agents/github-workflow-specialist	project-management	—	Generalize and move. Rename to github-actions-expert. Remove "scientific Python" scoping from description.
agents/github-org-manager	project-management	—	Move (mostly lift-and-shift). Rename to github-org-strategist. Already language-agnostic in practice.
commands/ci-setup	project-management	—	Generalize and move. Currently says "Generate GitHub Actions CI/CD workflows tailored to a scientific Python project." Should detect project language and generate appropriate CI.
commands/audit-github-org	project-management	—	Move. Already language-agnostic.
commands/release-plan	project-management	—	Generalize and move. Currently Python-focused version detection. Should support any versioning scheme.
commands/triage	project-management	—	Move. Already language-agnostic.
GH Actions CI workflow templates (assets)	project-management/skills/github-actions	—	Move. ci-test-workflow.yml, ci-docs-workflow.yml, ci-publish-workflow.yml — generalize beyond Python.
Release config templates (assets)	project-management/skills/release-management	—	Move. pyproject-release-config.toml, release-checklist.md — keep Python version as reference, add others.
Issue templates (assets)	project-management/skills/issue-triage	—	Move. bug-report-template.md, feature-request-template.md — already language-agnostic.
Health metrics reference	project-management/skills/github-org-management	—	Move. references/health-metrics.md — already language-agnostic.

The community-health-files Boundary

This is the one skill that sits at the boundary between this plugin and project-management:

Aspect	This Plugin (GitHub) Should Own	project-management Should Own
The .github repository pattern	Yes — this is GitHub platform mechanics	No
Org-wide default files via .github repo	Yes — GitHub-specific feature	No
Community profile API (gh api repos/.../community/profile)	Yes — GitHub API usage	No
Template content (what goes in a CONTRIBUTING.md, CODE_OF_CONDUCT, CITATION.cff)	No — this is project lifecycle guidance	Yes
Scaffolding community files for a new project	No — this is the setup-project command's job	Yes
Checking community file completeness for handoff	No — this is the project-handoff command's job	Yes

Recommendation: community-health-files stays in project-management as the authoritative home for template content. This plugin's community-health skill focuses on the GitHub platform mechanics (the .github repo pattern, community profile API, org-wide defaults) and cross-references project-management for the actual templates.

Boundary with the Proposed Containerization Plugin (#58)

Container image CI/CD is the main overlap area. The split:

This Plugin (GitHub) Owns	Containerization Plugin (#58) Owns
GitHub Actions workflow syntax, triggers, matrix strategies	Dockerfile patterns and best practices
Workflow permissions (id-token: write, packages: write)	Multi-platform buildx build commands
OIDC token generation and secrets management	Registry authentication mechanics (GHCR, ECR, Docker Hub)
docker/metadata-action integration within workflows	Image tagging strategies (semver, SHA, latest)
Dependabot for base image digest updates	Image security scanning (Trivy, Grype)
paths-ignore and path filtering in workflows	.dockerignore patterns

In practice: This plugin provides a "container publish workflow" skeleton; the containerization plugin provides the actual build/push steps. Cross-reference, don't duplicate.

No Overlap with Other Plugins

Plugin	Overlap	Notes
scientific-python-development	Minimal. Python testing/packaging skills are referenced in current GH Actions examples. They become language-specific reference material in the generalized CI skill. No conflict.
scientific-domain-applications	None. Domain-specific science skills.
ai-research-workflows	None. Development methodology.

What Happens to project-management After Migration

After this plugin and the containerization plugin (#58) absorb their respective content, project-management becomes a focused project lifecycle plugin:

plugins/project-management/   (after refactoring)
  agents/
    project-onboarding-specialist.md
    documentation-validator.md
  skills/
    community-health-files/       # template content for community files
    documentation-validation/     # doc quality assurance tools
  commands/
    setup-project.md              # generalized, delegates to github + containerization plugins
    project-handoff.md
    validate-project-handoff.md

Removed from project-management:

• 5 skills (github-actions, release-management, github-org-management, issue-triage, pre-commit-workflows)
• 3 agents (devops-engineer, github-workflow-specialist, github-org-manager)
• 4 commands (ci-setup, audit-github-org, release-plan, triage)

Its description changes from "GitHub-based open-source scientific Python project management, CI/CD, and DevOps" to "Project lifecycle management — onboarding, documentation quality, handoff readiness, and community health for research software projects."

Content That Needs Generalization (Not Just Move)

github-actions skill

1. Caching strategies — Currently pip/conda/pixi only. Need patterns for npm, cargo, go mod, Maven, NuGet, renv, Julia Depot.
2. Matrix testing — Currently Python version matrix. Need language-agnostic matrix patterns (compiler versions, runtime versions, OS combinations).
3. CI workflow templates — Currently setup-python + pytest. Need templates for setup-node, setup-go, Rust toolchain, R r-lib/actions, Julia actions, CMake builds.
4. Trusted publishers — Currently PyPI OIDC only. Expand to npm provenance, Sigstore for general use.
5. Testing patterns — Currently scientific Python (nox, tox, pixi run pytest). Add cargo test, go test, npm test, R CMD check, julia -e 'Pkg.test()', ctest.

release-management skill

1. Version bumping tools — Currently hatch/setuptools-scm/bump2version. Add npm version, cargo release, semantic-release (JS), standard-version, release-please.
2. Changelog tools — Currently towncrier + keep-a-changelog. Add conventional-changelog, release-please, git-cliff, auto-changelog.
3. Package registry publishing — Currently PyPI/conda-forge only. Add npm, crates.io, CRAN, Maven Central, NuGet, Docker Hub/GHCR, Homebrew.
4. conda-forge section — Keep as Python-specific reference, don't make it the main pattern.

pre-commit-workflows skill

1. Hook recommendations — Currently Python-focused (ruff, mypy, nbstripout). Add eslint/prettier for JS/TS, clippy/rustfmt for Rust, golangci-lint for Go, lintr/styler for R, etc.
2. Alternatives — Mention language-native equivalents where pre-commit isn't common (e.g., Husky for Node.js, cargo's built-in checks).

Net New Content (Not in Any Existing Plugin)

• GitHub Projects (boards, custom fields, automation rules)
• Advanced gh CLI patterns (gh alias, gh extension, scripted gh api + jq recipes)
• CODEOWNERS patterns for monorepos and multi-team projects
• Branch protection as a standalone deep skill (merge strategies, rulesets)
• Multi-language CI patterns (4+ languages beyond Python)
• Multi-ecosystem release publishing (3+ registries beyond PyPI)
• GitHub Apps vs GitHub Actions vs gh CLI decision framework

[cdcore09]

Related issues:

• feat: Create language-agnostic Containerization plugin #58 — Containerization plugin (boundary partner for container CI/CD)
• refactor: Refocus project-management plugin on project lifecycle after containerization and GitHub plugin extraction #60 — project-management refactoring (depends on this plugin being built first)