Grok Bot WikiRemnant Security · source: grokbot-docs

Home / skills/merge-a-site-pr-and-verify-it-s-live/SKILL.md

Merge a site PR and verify it's live

name: Merge a site PR and verify it's live description: >- Use only after the user has explicitly approved deploying a specific pull request on a static site served by GitHub Pages (or any host that builds from the default branch): merge pinned to the reviewed head SHA, confirm the build, curl-check the live URLs, and log the result.

Merge a site PR and verify it's live

Merging into the default branch of a Pages repo is a production deploy. Run this only when an approval ledger row names this exact repo and PR number, or the user approved it in the current conversation. "Approved edits" is not "approved deploy."

1. Pre-flight (read-only)

  1. Read the PR: state open, mergeable, base = default branch, head SHA, files changed.
  2. Confirm the files match what was described and approved. If a file outside the approved scope appears, stop and ask.
  3. Write down the expected head SHA. If the head moved since review, stop and re-review.
  4. Before merging, note the live checks you'll run: the URLs, the expected status codes, and the strings that must appear or disappear.

2. Merge

  • Use the GitHub connector's merge tool with expectedHeadSha=<sha> and a merge method that matches the repo's history (default merge). Give it a clear title.
  • Don't force-push, rebase published history, or touch other branches or PRs.
  • Record the merge commit SHA.

3. Wait for the build

  • GitHub Pages usually builds within a few minutes. Poll the live site, or the Pages build or Actions status if a connector exposes it, about every 30–60 seconds, for up to about 10 minutes.
  • If the build fails or never updates, report that with evidence and don't retry blindly.

4. Verify live (curl)

  • For each URL: curl -sS -o /dev/null -w '%{http_code} %{url_effective}\n' -L <url>. Expect 200, and an HTTP→HTTPS redirect where the site uses HTTPS.
  • Check the content: curl -sSL <url> | grep -c '<expected string>', e.g. a new link parameter, a new page title, or a removed price. Also check that strings expected to be gone are gone.
  • Check new assets (scripts, pages) return 200.
  • Add a cache-buster query string (?v=<timestamp>) if the CDN may be serving the old copy.

5. Log and report

  • Approval ledger row: merged <short sha>, live <time TZ> (<url> 200, <check> ok).
  • Delivered log: one line after telling the user.
  • Report to the user: what merged, the merge SHA, the live checks with results, and the date and time in their timezone. Note anything you deliberately didn't touch (other open PRs).