/commit

description: Smart conventional commit with security validation, branch flow enforcement, and auto-detection. Use for git commit, commit changes, save work, stage and commit.
argument-hint: "[message] | [type scope message] | (empty for auto-detection)"
allowed-tools: Bash(git status:*), Bash(git diff:*), Bash(git add:*), Bash(git commit:*), Bash(git log:*), Bash(git tag:*), Bash(git push:*), Bash(git pull:*), Bash(git describe:*), Bash(git branch:*), Bash(git checkout:*), Bash(git rev-parse:*), Bash(git remote:*), Bash(git merge-base:*), Bash(git fetch:*), Bash(gh pr create:*), Bash(gh pr view:*), Bash(gh pr merge:*), Bash(gh pr checks:*), Bash(gh pr edit:*), Bash(gh auth:*), Bash(command:*), Read, Edit
disable-model-invocation: false

Smart Conventional Commit

Current State

!`git status`

Staged Changes

!`git diff --staged --stat`

Recent Commits (style reference)

!`git log --oneline -5`

Current Branch

!`git branch --show-current`

Instructions

Based on the context above, create a professional commit.

Step 0: Branch Check (GitHub Flow enforcement)

Read current branch from above.

**If current branch is `main`, `master`, `develop`, or `production`:**

BLOCK direct commits and propose a feature branch:

🌿 Branch Protection
───────────────────────────────
Current: <branch>
Issue: Direct commits to protected branches discouraged (GitHub Flow)
───────────────────────────────

Pre-detect commit type/scope from staged changes (Step 2 logic) to suggest branch name:
  - feat(seo) → feat/seo
  - fix(sniper) → fix/sniper
  - chore(deps) → chore/deps

Proposed branch: <type>/<scope-or-summary>

Options:
  Y → Create branch + continue commit
  N → Abort
  C → Custom branch name

If user accepts → execute `git checkout -b <branch>` then proceed to Step 1. If user declines → STOP, do not commit.

**If current branch already a feature branch** (e.g. `feat/*`, `fix/*`, `chore/*`, `docs/*`, `refactor/*`, `perf/*`, `test/*`, `ci/*`, `build/*`, `style/*`) → skip to Step 1 directly.

**Exceptions** (allow direct commit on main):

• Repo has only `main` branch and no remote (solo prototype)
• User explicitly passes `--no-branch-check` in `$ARGUMENTS`
• Commit type is `chore` AND scope is `release` or `version` (post-commit bump commits)

Step 1: Security Check

BLOCK and output if secrets detected:

🔒 Security Alert
───────────────────────────────
Found: [file or pattern]
Action: Commit blocked
Fix: Remove sensitive data before committing

Check for:

• `.env`, `.env.*` files
• Patterns: `password=`, `secret=`, `api_key=`, `token=`
• Files: `*.pem`, `*.key`, `*credentials*`

Step 2: Analyze and Detect

Output analysis:

📊 Analysis
───────────────────────────────
Files changed: [X]
Files staged: [Y]
Pattern detected: [type]

Step 3: Generate Message

Format: `type(scope): imperative description`

**FORBIDDEN (NO AI SIGNATURE):**

• NEVER add "Co-authored-by: Claude" or any AI mention
• Commit must appear 100% human-written

Step 4: Propose Commit

Output proposal:

📝 Proposed Commit
───────────────────────────────
type(scope): description

[body if needed]
───────────────────────────────

⚡ Ready to commit? [Y/N/E]

Step 5: Execute and Confirm

On confirmation, execute and output:

✅ Committed successfully
───────────────────────────────
Hash: [short-hash]
Message: type(scope): description
Files: [X] changed

Execute with HEREDOC format:

git commit -m "$(cat <<'EOF'
type(scope): description
EOF
)"

If $ARGUMENTS provided, use as hint for the message.

Step 6: Post-Commit (universal)

After step 5 succeeds, execute the `post-commit` skill (CHANGELOG + version bump only — **no tag here**, see Step 8 for why).

This runs for ALL repos — the skill auto-detects the repo type internally.

Step 7: Auto-Release (push + PR + CI watch + merge)

After post-commit completes, if current branch is a feature branch (not main/master), run the **remote-flow decision tree** below — **no Y/N prompts** in FULL mode.

Remote-flow decision tree (run first, every time)

git remote -v

• **Empty output → LOCAL mode.**

No remote at all. STOP after Step 6 — do not push, do not open a PR, do not merge. In this mode, tag right away (see Step 8, LOCAL/DEGRADED branch): local `git tag` only, never pushed automatically. Output explicitly:

  📍 Pas de remote configuré — rituel distant sauté (push/PR/merge).
  Commandes manuelles pour plus tard :
    git remote add origin <url>
    git push -u origin <current-branch>
    gh pr create --base main --title "<subject>" --body-file - <<'EOF'
    <body>
    EOF
    (après merge) git tag vX.Y.Z && git push origin vX.Y.Z

• **Non-empty output → a remote exists.** Check tooling next:

  command -v gh        # exit 0 = gh installed
  gh auth status        # exit 0 = authenticated

• **`gh` missing OR `gh auth status` fails → DEGRADED mode.**

Still push the branch (git itself doesn't need `gh`):

    git push -u origin <current-branch>

Then STOP — skip PR creation/merge/watch entirely. Never fail silently: state exactly which check failed (`gh` not installed vs. not authenticated) and print the manual commands the user must run once `gh` is available (PR create with `--body-file -` on stdin, merge with `--merge`, then the Step 8 tag sequence). Tag locally per Step 8's LOCAL/DEGRADED branch.

• **`gh` present and authenticated → FULL mode.** Proceed with steps 1-4 below.

In both branches, the first push always uses `-u`: this transparently covers the case where the current branch has no upstream yet (first push sets it) and is a no-op if upstream already exists.

FULL mode steps (remote + `gh` OK)

1. **Push branch**:

   git push -u origin <current-branch>

2. **Create the PR if absent** (else reuse the existing one), body piped via `--body-file -` on stdin — nev