feat(git-tidy): add confidence-rated git repository hygiene skill (#50)

* feat(git-tidy): add confidence-rated git repository hygiene skill

Add the git-tidy skill: a read-only-by-default audit of branches,
worktrees, stashes, tags, remotes, merge artifacts, ignored-but-tracked
files, large history blobs, and maintenance health. Every finding is
classified by confidence (safe, review, keep). Nothing is deleted, no
history is rewritten, and no protected branch is touched without an
explicit approval gate. Ported from the internal devx git-clean skill
and adapted to this repo's conventions, with a Vally capability eval,
a cross-surface registration test, and a gpt-image-2 thumbnail.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 875e3648-1626-4968-ba79-ca7e78eea43d

* fix(git-tidy): make two eval stimuli require skill invocation

The require-approval-before-cleanup and metadata-is-untrusted stimuli
were answerable without opening the skill: an open-ended "clean up my
repo" prompt in CI's non-repo working directory drew a clarifying
question, and a single-branch classification was trivial by direct
reasoning. Both failed the CI per-trial skill-invocation gate even
though the overall eval scored 90.4 percent. Rewrite both to supply
explicit multi-branch repository state so answering requires the
git-tidy confidence taxonomy, matching the four passing stimuli.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 875e3648-1626-4968-ba79-ca7e78eea43d

* fix(git-tidy): force skill invocation across all eval stimuli

The protect-default-and-release stimulus intermittently failed the CI
per-trial skill-invocation gate: git hygiene is common knowledge, so a
capable agent answered the simple protected-branch question by direct
reasoning without opening the skill. The overall eval still scored 94.4
percent. Make every stimulus request each item's git-tidy status label
(merged, orphan-tracking, stash-ancient, blob-history-only, protected
skipped, and so on). Those labels are defined only in SKILL.md, so
producing them requires opening the skill on every trial.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 875e3648-1626-4968-ba79-ca7e78eea43d

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 875e3648-1626-4968-ba79-ca7e78eea43d

Author: jongio

.github/workflows/skill-eval.yml

@@ -125,7 +125,8 @@ jobs:
             {"skill":"skills/eli5","skill_id":"eli5","eval_spec":"evals/eli5/eval.yaml"},
             {"skill":"skills/repo-ready","skill_id":"repo-ready","eval_spec":"evals/repo-ready/eval.yaml"},
             {"skill":"skills/dns-doctor","skill_id":"dns-doctor","eval_spec":"evals/dns-doctor/eval.yaml"},
-            {"skill":"skills/deps-doctor","skill_id":"deps-doctor","eval_spec":"evals/deps-doctor/eval.yaml"}
+            {"skill":"skills/deps-doctor","skill_id":"deps-doctor","eval_spec":"evals/deps-doctor/eval.yaml"},
+            {"skill":"skills/git-tidy","skill_id":"git-tidy","eval_spec":"evals/git-tidy/eval.yaml"}
           ]'
           if [ "$EVENT_NAME" = "pull_request" ]; then
             # Evaluate only the skills this PR actually touches. Keep these

README.md

@@ -19,6 +19,7 @@ general-purpose monorepo: each skill lives in its own folder under
 | [`eli5`](skills/eli5/) | Explain the code, error, design, or idea already in context using plain language, a useful analogy, the proper grown-up terms, and an honest note about where the analogy stops working. |
 | [`dns-doctor`](skills/dns-doctor/) | Audit DNS delegation, records, DNSSEC, CAA, web routing, TLS, CDN behavior, mail authentication, takeover exposure, and zone hygiene, then apply exact provider changes only after explicit user approval. |
 | [`deps-doctor`](skills/deps-doctor/) | Audit, update, and secure dependencies across npm, pnpm, Yarn, pip, Poetry, uv, Go, Cargo, Bundler, Composer, NuGet, Maven, Gradle, Swift, pub, and Hex, plus Docker base images, GitHub Actions, Terraform, and dev container features. Ranks vulnerabilities by exploitation evidence, withholds releases too new to have been vetted, fixes breaking changes forward instead of rolling back, and never opens an empty dependency pull request. |
+| [`git-tidy`](skills/git-tidy/) | Comprehensive git repo hygiene in one pass: branches, worktrees, stashes, tags, remotes, merge artifacts, ignored-but-tracked files, large history blobs, and maintenance health. Classifies every finding by confidence (safe, review, keep) and deletes nothing without explicit approval. |
 
 A skill is invoked straight from the Copilot composer — here `create-canvas-app`
 turns a one-line prompt into a working canvas:

docs/thumbnail-prompts.md

@@ -111,6 +111,7 @@ blue/green, `repo-ready` = GitHub green, `naming-is-hard` = rose pink + green,
 `eli5` = sky blue + warm amber.
 `dns-doctor` = DNS blue + health green + warning amber.
 `deps-doctor` = slate graphite + warning amber to health green.
+`git-tidy` = git orange + GitHub green + navy.
 
 ## Prompts
 
@@ -258,3 +259,25 @@ blue/green, `repo-ready` = GitHub green, `naming-is-hard` = rose pink + green,
 > duplicated stethoscope, no words, no letters, no numerals, no version strings,
 > no fake text, no checklist rows, no pause or play icons, no cartoon mascot or
 > face, no photorealism, no 3D render.
+
+### git-tidy (exact prompt used)
+
+> Flat vector illustration app thumbnail on a pure white background, 1024x1024,
+> centered composition, matching a polished GitHub developer-tools catalog.
+> Create one cohesive git repository cleanup scene, not a generic icon panel.
+> Center: a clean git branch graph as rounded nodes connected by smooth curved
+> lines growing from a strong navy trunk on the left. The top two branches are
+> tidy and kept, each ending in a small green check badge, and one carries a
+> tiny navy padlock to mean protected. Two lower stale branches are faded gray
+> and dashed, gently detaching from the trunk and being swept up by a friendly
+> rounded broom whose bristles are git orange, with a small dustpan collecting
+> three faded branch nodes and a couple of tiny sparkles for freshness. Include
+> small supporting cards near the bottom edge: a worktree folder card, a stash
+> card, and a tag card, each with a subtle status dot. Place a small GitHub
+> Octocat mark in a circular badge near the upper-right, connected to the scene
+> by a subtle dotted guide line. Palette: deep GitHub navy, git orange, and
+> health green, with soft neutral gray for the stale branches. Rich but
+> uncluttered flat vector detail, clean modern rounded geometry, consistent
+> medium-weight outlines, subtle dashed guide lines, tiny sparkles, generous
+> white space, crisp professional finish. No words, no letters, no fake text,
+> no photorealism, no 3D render.

marketplace.json

@@ -49,6 +49,12 @@
       "source": "./skills/deps-doctor",
       "description": "Audit, update, and secure dependencies across npm, pnpm, Yarn, pip, Pipenv, Poetry, uv, Go, Cargo, Bundler, Composer, NuGet, Maven, Gradle, Swift, pub, and Hex, plus Docker base images, GitHub Actions, Terraform, and dev container features. Finds outdated, unused, and undeclared packages, withholds releases too new to have been vetted, ranks vulnerabilities by exploitation evidence, screens supply-chain risk, and fixes breaking changes forward without ever opening an empty pull request.",
       "version": "1.0.0"
+    },
+    {
+      "name": "git-tidy",
+      "source": "./skills/git-tidy",
+      "description": "Comprehensive git repository hygiene in one pass across local and remote branches, worktrees, stashes, tags, remotes, merge and rebase artifacts, ignored-but-tracked files, large history blobs, and maintenance health. Classifies every finding by confidence (safe, review, keep), keeps protected branches and release tags off the deletion list, holds large-blob findings to report-only, and deletes nothing without explicit user approval.",
+      "version": "1.0.0"
     }
   ]
 }

plugin.json

@@ -7,7 +7,7 @@
     "url": "https://github.com/jongio"
   },
   "license": "MIT",
-  "keywords": ["copilot", "skills", "agent-skills", "canvas", "create-canvas-app", "github-pages", "create-gh-pages-site", "repo-ready", "gitignore", "license", "contributing", "community-health", "naming-is-hard", "naming", "domain-check", "dns-doctor", "dns-audit", "dns-management", "dnssec", "email-authentication", "trademark", "availability", "name-generator", "eli5", "explain-like-im-five", "plain-language", "learning", "deps-doctor", "dependencies", "dependency-updates", "package-manager", "supply-chain-security", "vulnerability-remediation"],
+  "keywords": ["copilot", "skills", "agent-skills", "canvas", "create-canvas-app", "github-pages", "create-gh-pages-site", "repo-ready", "gitignore", "license", "contributing", "community-health", "naming-is-hard", "naming", "domain-check", "dns-doctor", "dns-audit", "dns-management", "dnssec", "email-authentication", "trademark", "availability", "name-generator", "eli5", "explain-like-im-five", "plain-language", "learning", "deps-doctor", "dependencies", "dependency-updates", "package-manager", "supply-chain-security", "vulnerability-remediation", "git-tidy", "git-hygiene", "branch-cleanup", "worktree-cleanup", "stale-branches", "repo-maintenance"],
   "repository": "https://github.com/jongio/skills",
   "skills": "skills/"
 }

site/public/images/IMAGES.md

@@ -28,6 +28,7 @@ copy of `skills/<skill>/thumbnail.png`.
 | `thumb-create-gh-pages-site.png` | `create-gh-pages-site` card/detail | Astro site scaffold deploying to GitHub Pages. |
 | `thumb-deps-doctor.png` | `deps-doctor` card/detail | Dependency graph on a slate console, amber packages upgrading left to right into green ones, inspected by a stethoscope lens. Byte parity with the skill copy is asserted by a test. |
 | `thumb-dns-doctor.png` | `dns-doctor` card/detail | DNS diagnostic workstation, record cards, and stethoscope. |
+| `thumb-git-tidy.png` | `git-tidy` card/detail | Git branch tree being tidied, merged branches swept up while protected branches are kept. Byte parity with the skill copy is asserted by a test. |
 | `thumb-eli5.png` | `eli5` card/detail | Byte parity with the skill copy is asserted by a test. |
 | `thumb-naming-is-hard.png` | `naming-is-hard` card/detail | Candidate names screened across registries. |
 | `thumb-repo-ready.png` | `repo-ready` card/detail | Repository health checklist with gap indicators. |

site/public/images/thumb-git-tidy.png

@@ -0,0 +1,51 @@
+---
+title: git-tidy
+tagline: "Comprehensive git repo hygiene in one pass: branches, worktrees, stashes, tags, remotes, artifacts, and history bloat, each rated safe, review, or keep, with nothing deleted without approval."
+useWhen: "When merged branches pile up, worktrees and stashes go stale, tags or remotes are dead, merge artifacts linger, the repo has grown large, or you want a confidence-rated cleanup audit before deleting anything."
+repoPath: skills/git-tidy
+thumb: images/thumb-git-tidy.png
+order: 7
+install:
+  - label: Install for GitHub Copilot
+    cmd: npx skills add jongio/skills --skill git-tidy -g --agent github-copilot
+  - label: Install from the plugin marketplace
+    cmd: copilot plugin marketplace add jongio/skills && copilot plugin install git-tidy@jongio-skills
+---
+
+## What it does
+
+`git-tidy` scans a repository for everything that accumulates over time and
+rates each finding by how safe it is to remove.
+
+- Local and remote branches, classified by merge and PR status plus age.
+- Worktrees, including orphaned entries and ones with unsaved work.
+- Stashes, tags, and remotes, aged and cross-checked against GitHub.
+- Merge and rebase artifacts (`.orig` files, interrupted operations).
+- Ignored-but-tracked files that slipped in before the ignore rule.
+- Large history blobs and overall git maintenance health.
+
+Findings are grouped 🟢 safe, 🟡 review, and 🔴 keep, so the cleanup list is
+obvious at a glance.
+
+## Safety
+
+Analysis is read-only. Cleanup runs only after you choose the items and confirm
+the exact commands. The skill prefers safe branch deletion over force deletion,
+warns before every remote deletion, keeps the default, checked-out, and
+protected branches off the list, and never rewrites history. Large-blob findings
+are report-only: it points you at Git LFS or `git filter-repo` rather than
+running them.
+
+## Use it
+
+```text
+git-tidy
+git-tidy branches
+git-tidy worktrees
+git-tidy stashes
+git-tidy tags
+git-tidy maintenance
+git-tidy --dry-run
+```
+
+Use `--dry-run` to get the full audit without the approval and cleanup phase.

site/src/content/skills/git-tidy.md

@@ -0,0 +1,10 @@
+# Dependencies are not committed; the optional Vally eval pulls dev deps.
+node_modules/
+
+# Skill dev tooling writes results; its lockfile is committed for reproducible CI.
+vally-results/
+
+# OS / editor noise
+.DS_Store
+Thumbs.db
+*.log

skills/git-tidy/.gitignore

@@ -0,0 +1,4 @@
+paths:
+  skills: "."
+  evals: "evals"
+  results: "vally-results"