[evoskill] EvoSkill: refine developer skill with cross-trigger nullability guidance

[github-actions]

Caution

Protected files were modified in this change.
This pull request is in request_review mode and requires explicit human scrutiny before merge.

Protected files: .github/skills/developer/SKILL.md

EvoSkill Evolver: refine developer skill

Capability gap diagnosed: Go code that generates GitHub Actions if: conditions (pkg/workflow/*filter*.go and similar) can reference nested github.event.* fields (e.g. github.event.pull_request.stack.position) without guarding against the entire parent object being absent on non-matching trigger types. GitHub Actions' expression evaluator errors on arithmetic/property access against an absent object graph (not just null), causing startup_failure with zero jobs run — before any error-handling logic executes.

Training evidence:

• [aw-failures] pull_request max-stack filter crashes non-PR workflow runs — 29 workflows hit startup_failure #49445
• [aw-failures] Fix: unguarded arithmetic on github.event.pull_request.stack in applyPullRequestStackFilter #49446

A max-stack PR-stack filter condition performed arithmetic on github.event.pull_request.stack.position + N without an event_name guard. On push/workflow_dispatch/schedule triggers, github.event.pull_request doesn't exist, crashing the expression evaluator and breaking 29 workflows from a single commit — a P0-class regression.

Mutation type: Refine (existing skill), not create. Added a new subsection ("Cross-Trigger Nullability in Generated Conditional Expressions") to .github/skills/developer/SKILL.md's Security Best Practices section, right after the existing Template Injection Prevention guidance. Includes an unsafe/safe Go code contrast, actionable guidance bullets, and a verification checklist. All existing skill content is preserved unmodified — purely additive.

Validation (held-out set, 6 runs not used to design the mutation):

• [aw-failures] MCP Gateway github SSE reconnect hang + Ollama BYOK backend 503 fast-fail #49246
• [aw-failures] Design Decision Gate: 'Pre-fetch ADR gate PR context' step fails before agent starts #49144
• [aw-failures] Design Decision Gate exhausts LLM invocation cap after permission-denied retries on shell-expanded file paths #49096
• [aw-failures] Conclusion job's setup_globals.cjs MODULE_NOT_FOUND cascade has regressed (repeat of #28149) #49023
• [aw-failures] Fix Avenger: actionlint@v1.7.12 fails to compile against resolved yaml module (3/3 failures) #48971
• [aw-failures] [aw] PR Sous Chef: add_comment failing with 401 Bad credentials (AWI_MAINTENANCE_TOKEN) #48899

	Baseline	Candidate
Score	35	58
Regressions	—	none
Confidence	—	medium

None of the 6 held-out incidents are this exact bug class (they cover MCP/SSE hangs, sandbox path-expansion denials, DNS/checkout cascades, Go dependency version conflicts, and secret rotation) — the candidate was scored on precision/generality/non-interference rather than direct prevention. It scored higher because: (1) the new section is scoped precisely to Go code generating .lock.yml conditional expressions, so it cannot be misapplied to the unrelated validation failures; (2) it generalizes beyond the single training bug to "any nested event-field access must be guarded by an event_name check across all declared triggers"; (3) it leaves all existing guidance (template injection, SC2086) untouched; (4) it includes a concrete, testable verification checklist.

Accepted because candidate_score (58) > baseline_score (35), no regressions, and medium confidence that this encodes a reusable capability rather than benchmark-specific memorization.

Scope note: Underlying model and all non-skill repository files are unchanged. Only .github/skills/developer/SKILL.md was modified (1 file).

Generated by 🧬 EvoSkill Evolver · auto · 137.5 AIC · ⌖ 8.38 AIC · ⊞ 7.9K · ◷

• expires on Aug 7, 2026, 8:40 PM UTC-08:00

---

Note

This was originally intended as a pull request, but the git push operation failed.

Original error: pushSignedCommits: refusing unsigned push for branch 'evoskill/developer-cross-trigger-nullability-350f055019a70ff7': Signed-commit payload violates file-protection policy (request_review): .github/skills/developer/SKILL.md

Workflow Run: View run details and download bundle artifact

The bundle file is available in the agent artifact in the workflow run linked above.

To create a pull request with the changes:

# Download the artifact from the workflow run
gh run download 30683995702 -n agent -D /tmp/agent-30683995702

# Fetch the bundle into a temporary ref, then update the local branch
git fetch /tmp/agent-30683995702/aw-evoskill-developer-cross-trigger-nullability.bundle refs/heads/evoskill/developer-cross-trigger-nullability:refs/bundles/create-pr-evoskill-developer-cross-trigger-nullability-350f055019a70ff7-9032b8dd
git update-ref refs/heads/evoskill/developer-cross-trigger-nullability-350f055019a70ff7 refs/bundles/create-pr-evoskill-developer-cross-trigger-nullability-350f055019a70ff7-9032b8dd
git checkout evoskill/developer-cross-trigger-nullability-350f055019a70ff7
# Ensure the working tree matches the updated branch
git reset --hard
# Remove the temporary bundle ref
git update-ref -d refs/bundles/create-pr-evoskill-developer-cross-trigger-nullability-350f055019a70ff7-9032b8dd

# Push the branch to origin
git push origin evoskill/developer-cross-trigger-nullability-350f055019a70ff7

# Create the pull request
gh pr create --title '[evoskill] EvoSkill: refine developer skill with cross-trigger nullability guidance' --base main --head evoskill/developer-cross-trigger-nullability-350f055019a70ff7 --repo github/gh-aw