magpie
ListedAgent-assisted maintainership and development framework for Apache projects — Triage, Mentoring, Drafting (agent-authored fixes with human review), and Pairing (developer-side dev-cycle) skills shipping; Agentic Autonomous (auto-merge) on the roadmap.
Bundles
Everything this plugin ships — skills, agents, commands, hooks, and MCP servers it bundles.
Skills (50)
magpie-audit-finding-fix
For a batch of findings from a non-security audit tool (`<audit-tool>` — ruff / flake8 / mypy / pylint / CodeQL / Apache Verum / Apache Caer / equivalent; full list in the body) against `<upstream>`, draft the smallest fix for each finding. Re-runs the tool after each batch to confirm the findings are cleared. Produces a commit and a hand-back artefact; never opens a PR on autopilot or merges.
magpie-ci-runner-audit
Read-only audit of GitHub Actions workflow runner compatibility for one repository, an explicit repository set, one Apache project with multiple repositories, or the full Apache GitHub org. Finds obsolete GitHub-hosted runner labels and macOS runner/tool architecture mismatches. Produces TSV evidence files; never edits workflows, opens PRs, or posts comments.
magpie-committer-onboarding
Post-vote committer and PMC onboarding for Apache projects. Walks the nominator through every step from ICLA check to welcome announcement for both incubating podlings and graduated top-level projects.
magpie-contributor-activity-sweep
Read-only GitHub activity card for a named contributor on <upstream>. Fetches PR authorship, code-review activity, issues, and PR/issue comments over a configurable window. Limited to GitHub-visible activity — the body documents the off-GitHub tracks the nominator must supply separately. No readiness verdict is produced; use contributor-nomination for a full nomination brief.
magpie-contributor-nomination
Read-only nomination brief for a named GitHub contributor on <upstream>. Aggregates GitHub activity across all contribution tracks plus maintainer-supplied off-GitHub signal, and flags vendor-neutrality context — the evidence a PMC needs to open a committer or PMC nomination thread.
magpie-contributor-sentiment
Measures contributor-sentiment signals on <upstream> over a configurable window: thread tone (first-response classification), time-to-first-reply (median hours), first-PR retention (second-PR rate), and reviewer load (Gini coefficient). Compares each signal against a pre-adoption baseline and produces a structured gate report used to decide whether a skill family is ready to advance from experimental to stable.
magpie-contributor-to-committer
Read-only readiness tracker that maps a contributor's GitHub activity against the adopter's PMC-declared committer or PMC thresholds and surfaces a traffic-light brief (Not yet / Approaching / Ready to nominate) plus the specific evidence gaps that remain.
magpie-dependency-audit
Read-only dependency vulnerability audit for one repository or a local checkout. Detects the project's dependency manager(s), runs the appropriate audit tool, surfaces patchable findings grouped by severity, and proposes upgrades for maintainer review. Never modifies manifests or lock files and never opens update PRs.
magpie-dependency-license-audit
Read-only license audit of a project's direct and transitive dependency tree. Detects the dependency manager(s), resolves each dependency's declared license from ecosystem metadata, classifies each against a configured policy (ASF three-category A/B/X model or a custom allowlist), and surfaces incompatible, forbidden, and unknown-license dependencies for maintainer review. Never modifies manifests or lock files.
magpie-flaky-test-triage
Read-only flaky-test detection from GitHub Actions CI run history for one repository. Parses workflow run outcomes over a configurable window, computes per-job failure rates, and distinguishes intermittent failures (flaky) from consistent failures (deterministically broken). Produces a prioritised triage list without modifying any test code, workflow file, or tracker state.
magpie-good-first-issue-author
Draft a single net-new *good first issue* on the configured `<upstream>` repo from one supplied candidate such as a known gap or a small maintainer-named task. The skill first runs a suitability gate to confirm the candidate is small and newcomer-safe. If it passes the skill drafts one issue. The draft carries scope, code pointers, contributing-doc links, acceptance criteria, and an effort estimate. A readiness checklist gates the draft before it is shown. Nothing is filed via `gh` until the maintainer explicitly confirms. The skill never curates or relabels the existing backlog.
magpie-good-first-issue-sweep
Sweep the open `<issue-tracker>` backlog for existing issues that could be labelled as good first issues. Classifies each candidate as READY (propose the GFI label), NEAR-MISS (surface edits to make it GFI-ready), or SKIP using the G1–G7 suitability rubric. Applies labels only after explicit maintainer confirmation; never edits issue bodies without the maintainer's direction.
Show all 50 bundled skills Showing all 50 bundled skills
magpie-issue-backlog-stats
Read-only maintainer dashboard for the open general-issue backlog of <issue-tracker>. Surfaces a health rating, prioritised recommendations, age and staleness breakdowns, area pressure ranking, and a triage-funnel summary. Output is HTML by default; markdown fallback available.
magpie-issue-deduplicate
Merge two open `<issue-tracker>` issues that describe the same root cause, preserving both reporters' context. Proposes a closing comment on the duplicate and a cross-reference comment on the kept issue. Waits for maintainer confirmation before posting anything or closing anything.
magpie-issue-fix-workflow
For a single triaged `<issue-tracker>` issue confirmed as a bug or feature, draft a fix against `<upstream>` on `<default-branch>`. Produces the failing test, the smallest production change, the targeted+module test runs, and the commit. The PR is NOT opened on autopilot; the human committer reviews, signs, and pushes. Hand-back artefact summarises branch, commits, test results, and scope.
magpie-issue-reassess-stats
Read-only dashboard over a directory of `verdict.json` files produced by `issue-reassess` campaigns. Surfaces a health rating, classification distribution, partial-fix surfaces, oldest-unresolved buckets, and per-component breakdowns. Output is HTML by default; markdown fallback available. Read-only on tracker state; consumes campaign artefacts.
magpie-issue-reassess
Sweep a configured pool of resolved or end-of-life `<issue-tracker>` issues and re-assess each against the current `<default-branch>`. Per-issue: invoke `issue-reproducer` to extract and run the reporter's code, classify the runtime outcome, attach a nature analysis, compose a `verdict.json`. Hand-back-on-completion contract: no comments posted, no transitions, no closures.
magpie-issue-reproducer
For a single `<issue-tracker>` issue identifying a code-level bug, extract the reporter's example code from the issue body, adapt it to run on the current `<default-branch>`, execute via `<runtime>`, and compose a `verdict.json` describing the observed behaviour vs the expected failure. Read-only on the tracker — produces evidence, never posts. Invoked by `issue-triage` and `issue-reassess`; can also be run standalone.
magpie-issue-stale-sweep
Sweep open `<issue-tracker>` issues for inactivity past a configurable threshold and propose either a closure (when the issue has been unresponsive long enough to presume abandonment) or an update request (nudge the reporter to confirm the issue is still relevant). Waits for maintainer confirmation before posting any comment or closing anything.
magpie-issue-triage
For each open `<issue-tracker>` issue in the configured candidate pool, read the issue body and comments and classify the candidate disposition. On user confirmation, posts a triage-proposal comment that invites the project team to react. Read-only on tracker state — no workflow transitions, closures, or label changes. Six classes in the body.
magpie-license-compliance-audit
Read-only license compliance audit for one repository or a local checkout. Checks that a LICENSE file exists, that a NOTICE file is present and complete when required by the declared license, and that source files carry SPDX-License-Identifier headers consistent with the project's declared license. Produces a grouped compliance report and proposes remedies for maintainer review. Never modifies any file.
magpie-list-skills
Print a human-readable index of every skill in this repository, grouped by family prefix (`pr-management`, `security`, `setup`, …) with each skill's name and the first sentence of its `description`. The listing is generated on every run from the live `.claude/skills/*/SKILL.md` files, so it never goes stale when skills are added, removed, or rewritten.
magpie-mentoring-welcome
Draft a first-contact orientation comment for a first-time contributor on a newly opened issue or PR on the configured `<upstream>` repo. Detects first-time authorship via the GitHub `author_association` field and drafts a welcome with contributing-guide link, community-norm pointers, and expected next steps. Waits for explicit maintainer confirmation before posting. Does not post for repeat contributors.
magpie-newcomer-issue-explainer
Given an open good-first-issue on the configured `<upstream>` repo, explain it in beginner terms and sketch a concrete approach: which files to read first, what "done" looks like, and where to ask follow-up questions — without writing any code or fix. First runs an issue assessment to confirm the issue is open, non-security, and scope-clear. Then drafts the explanation for maintainer review. Read-only; nothing is posted without explicit maintainer confirmation.
magpie-onboarding-concierge
Answer a newcomer's "how do I contribute here" question by grounding the response in `CONTRIBUTING.md` and the project's own docs. Classifies the question (setup / workflow / first-issue / out-of-scope), retrieves the relevant guide excerpt, and drafts a concise answer in the Agentic Mentoring teaching register. Routes out-of-scope questions (design, security, deprecation, architectural taste) to a human maintainer. Read-only; produces a draft answer text — no files are written and no comments are posted without the maintainer's explicit action.
magpie-optimize-skill
Optimize an existing framework skill (or sweep a set of them) by applying the restructuring patterns proven on the security-skill suite: split an oversized `SKILL.md` into linked sibling docs, lift concrete/project-specific values out of the body into `<project-config>` placeholders, replace in-agent-context body reads with out-of-context tool calls, batch per-item fetches into a single upfront pass, and add a deterministic pre-flight no-op classifier ahead of LLM passes. Every change is a behavior- preserving proposal the maintainer signs off on; the skill validator must stay green before and after. The refactoring sibling of `write-skill` (which authors net-new skills).
magpie-pairing-multi-agent-review
Fan a local diff through three independent, axis-focused review passes (correctness, security, conventions), then merge the findings into a single structured report. Each pass is isolated so findings from one axis cannot suppress or bias the others. The merged report uses the same format as pairing-self-review so the developer gets a consistent signal regardless of which Agentic Pairing skill they invoke.
magpie-pairing-self-review
Run a structured pre-flight self-review on local changes before opening a PR. Reads the diff against a configurable base (default: the merge base of HEAD and the upstream default branch), checks correctness, security, and project conventions, and returns a structured report to the developer. No state changes, no PR, no external writes — the report is the output.
magpie-pr-management-code-review
Walk a maintainer through deep, sequential code review of open pull requests on the configured `<upstream>` repo. Defaults to the **"my reviews"** queue (the union of five maintainer signals — see the Inputs table); selectors can narrow to a single PR, an area label, or a collaborator subset. Drafts an `approve` / `request-changes` / `comment` review per PR and posts on the maintainer's confirmation.
magpie-pr-management-mentor
Draft a teaching-register comment on a single GitHub issue or PR thread on the configured `<upstream>` repo, aimed at a contributor who is missing repo context the maintainer would otherwise have to spell out. The skill reads the thread, decides whether a mentoring intervention is warranted, drafts one comment per the project's tone guide and convention pointers, and waits for explicit maintainer confirmation before posting via `gh`. Escalates to the configured maintainer team on the four hand-off triggers.
magpie-pr-management-quick-merge
Identify trivial, low-risk pull requests in the `ready for maintainer review` queue of <upstream> that pass every quality gate and touch only supplementary areas (docs, changelog, translations, tests) — the "express lane" a maintainer can review and merge in seconds. Surfaces and ranks candidates with per-PR diff summaries, an all-gates-green attestation, and the exact merge command. On the maintainer's explicit per-PR confirmation it can submit an APPROVE review (the maintainer's own review of the trivial diff — useful when the PR has no approvals yet and branch protection needs one), exactly as pr-management-code-review does. It never merges itself — automated merge is the framework's deliberately-deferred Agentic Autonomous mode; the maintainer runs the printed merge command in their own session.
magpie-pr-management-stats
Read-only maintainer dashboard for the open-PR backlog of <upstream>. Surfaces a health rating, prioritised action recommendations, weekly closure velocity trends, area pressure ranking, and a triage-funnel breakdown — with the underlying area-grouped tables as a collapsible details section.
magpie-pr-management-triage
Sweep open pull requests on the configured `<upstream>` repo, classify each one against the project's quality criteria, propose a disposition, and — on the maintainer's confirmation — carry out the action via `gh`. Disposition options per PR: draft / comment / close / rebase / CI-rerun / workflow-approve / ping-stale-reviewer / request author confirmation of readiness / mark `ready for maintainer review` / promote bot-authored draft. Does **not** perform code review — that lives in `pr-management-code-review`.
magpie-pr-stale-sweep
Sweep open pull requests on the configured `<upstream>` repo for inactivity past a configurable threshold and propose either a conversion to draft (when the PR is open but has gone quiet) or a closure (when the PR has been abandoned long enough to presume the author has moved on). Waits for maintainer confirmation before converting or closing anything.
magpie-pre-first-pr-check
Run a newcomer-focused pre-flight checklist on a local branch before opening a pull request. Checks CONTRIBUTING conventions, SPDX headers on new files, commit-message shape (including the Generated-by: trailer for AI-assisted work), and the placeholder convention — then returns a structured checklist report. Read-only; no state changes, no PR, no external writes.
magpie-release-announce-draft
Draft the `[ANNOUNCE]` email body and open (not merge) the site-bump PR for a promoted release of `<upstream>`. Reads release metadata from the planning issue and `<project-config>/release-management-config.md`; produces a ready-to-copy `[ANNOUNCE]` subject + body and proposes the site-bump PR. Never sends mail and never merges the PR without explicit RM confirmation.
magpie-release-archive-sweep
Scan the release distribution area (`dist/release/<project>/` when `release_dist_backend = svnpubsub`, or the configured distribution location), identify releases past the project's retention rule, and propose the backend-shaped command set to move them to the archive area. Read-only on the distribution surface; the RM executes every archival command as themselves.
magpie-release-audit-report
Assemble a per-release audit record from lifecycle artefacts (planning issue, vote thread, artefact list, promote revision, and announcement URL) and propose a PR appending it to the project's audit log. Read-only on every release surface; the only write is a PR the RM reviews and a committer merges.
magpie-release-keys-sync
Draft the diff that adds the Release Manager's public key to the project's KEYS file (`<keys-file-url>`), emit a paste-ready `svn` (or backend-equivalent) command sequence, remind the RM to upload to the configured keyserver, and validate the key meets the ASF strength floor. Never commits, never holds or reads the private key. Runs during release preparation, before RC signing begins.
magpie-release-prepare
Draft release preparation artefacts for `<upstream>`: the planning issue, the version-bump and changelog prep PR, or the post-release development-version bump PR. Reads release metadata from `<project-config>/release-trains.md` and `<project-config>/release-management-config.md`. Every output is a draft confirmed by the Release Manager before filing; the agent never marks a PR ready, never merges, and never closes any artefact.
magpie-release-promote
Emit the backend-shaped promotion command set for a release that has passed its vote. Reads the planning issue (must carry `vote-passed`), constructs the staging → release move for the configured distribution backend, checks PMC membership of the Release Manager, and proposes the `promoted` label. Never runs the promotion command itself and never publishes the release.
magpie-release-rc-cut
Emit the paste-ready command sequence to tag an RC, build artefacts, sign each artefact, generate checksums, and stage them to the adopter's distribution backend. Covers Steps 4–5 of the release-management lifecycle. Never runs any command locally — all sequences are emitted for the Release Manager to execute on their own machine with their own key and ASF credentials.
magpie-release-verify-rc
Read-only pre-flight verification of a staged release candidate (RC) for `<upstream>`. Checks artefact integrity (GPG signatures and checksums), Apache RAT licence headers, NOTICE/LICENSE completeness, prohibited-binary absence (including `.pyc` / `__pycache__`), source-tree integrity (no dangling symlinks or broken internal references), and version-string consistency. Emits a structured PASS / PASS-WITH-WARNINGS / FAIL report. Makes no state change; a `--post-to <planning-issue>` flag proposes a comment for explicit RM confirmation before any posting.
magpie-release-vote-draft
Draft the `[VOTE]` email body and planning-issue comment for an RC of `<upstream>`. Reads RC metadata from the planning issue and `<project-config>/release-management-config.md`; produces a ready-to-copy `[VOTE]` subject + body and a proposed planning-issue comment. Never sends mail and never posts without explicit RM confirmation.
magpie-release-vote-tally
After the approval window closes, fetch the approval signal for an RC of `<upstream>`, classify each reply as +1 / 0 / -1 and binding or non-binding against the configured roster, produce the tally summary, and draft the `[RESULT] [VOTE]` email. Never sends mail and never applies a label without explicit RM confirmation.
magpie-reviewer-routing
Given an open issue or PR, scores the project's configured reviewer roster across three signals — touched-area eligibility, git-history familiarity with the changed paths, and current open-review load — and proposes a primary reviewer (plus an optional backup). Read-only and propose-then-confirm: nothing is assigned, labelled, or requested without the maintainer's explicit confirmation. An unresolved roster produces an explicit NO ELIGIBLE REVIEWER signal, never a fabricated handle.
magpie-security-cve-allocate
Walk a security team member through allocating a CVE for an `<tracker>` tracking issue (governance-gated per `governance.cve_allocation_gate`). Prints the configured `<cve-tool>` allocation URL, waits for the allocated CVE ID, then updates the tracker in place. Tracker updates: CVE tool link field, cve allocated label, status-change comment, CVE JSON. Chains into `security-issue-sync` afterwards to reconcile the rest of the tracker.
magpie-security-issue-deduplicate
Merge two <tracker> tracking issues that describe the same root-cause vulnerability, preserving every reporter's credit, every mailing-list thread reference, and every independent attack-vector description. Updates the kept issue's body in place, closes the duplicate with the `duplicate` label, and regenerates the CVE JSON attachment so both finders land in `credits[]`.
magpie-security-issue-fix
Attempt to fix a security issue tracked in `<tracker>` by implementing the change in a public `<upstream>` PR. Runs `security-issue-sync` first to reconcile the issue's state, proposes an implementation plan, and on explicit user confirmation writes the change, opens a PR from the user's fork, and updates the `<tracker>` tracking issue. Public PR content is scrubbed so it does **not** reveal the CVE, the security nature of the change, or any link back to `<tracker>`.
magpie-security-issue-import-from-md
Open one or more `<tracker>` tracking issues from a markdown file containing a batch of security findings. Each finding becomes one tracker landing in the `Needs triage` board column. The file itself is the full report — there is no inbound reporter to reply to and no PR to inspect.
Hooks (1)
Quality Score: 57/100
Details
- Author
- apache
- Repository
- apache/magpie
- Created
- 3 months ago
- Last Updated
- yesterday
- Language
- Python
- License
- Apache-2.0