[theCodeDrift]

Two changes to the primary-checkout guard from #599, so taskless/taskless can use it from the worktrees-pnpm skill (which it installs from here through dotagents) instead of keeping its own copy.

• The guard skips only on GITHUB_ACTIONS=true, not whenever CI is set. Any shell can export CI=1, and no instruction named it, so it was a quieter bypass than --no-verify. The Actions runner sets GITHUB_ACTIONS=true itself. taskless/marketing#87 made the same change after its review flagged it.
• AGENTS.md and the skill name every bypass: an agent never gets past the guard, whether by --no-verify, setting GITHUB_ACTIONS, or any other means; a refusal means it is in the wrong checkout.
• --no-track in the refusal message and in the documented git worktree add commands keeps the new branch from tracking origin/main, so a bare git push cannot target main. The WorktreeCreate hook already passed it.

Measured through the real Husky runner in a scratch repo:

Case	Result
Primary checkout	refused
Primary, CI=1	refused (was: commits)
Primary, GITHUB_ACTIONS=1	refused
Primary, GITHUB_ACTIONS=true	commits
Worktree	commits
Branch from the printed --no-track command	no upstream

No changeset: repo tooling, nothing ships.

[theCodeDrift]

@claude /review

[github-actions]

Claude finished @theCodeDrift's task in 1m 5s —— View job

---

Review mode: incremental — read 0 prior review thread(s) before reviewing.

.prior-review.json contains no reviewThreads, no reviews, and only the triggering @claude /review comment — this is the first review of this PR, so the whole diff was assessed fresh.

Summary

This is a tight, well-scoped doc/script fix. I checked the three changed files together (refuse-main-checkout.sh, SKILL.md, AGENTS.md) plus the full worktrees-pnpm skill and worktree-create.sh for consistency, and verified against this repo's actual CI setup.

Correctness

• refuse-main-checkout.sh:24 — [ "${GITHUB_ACTIONS:-}" = "true" ] correctly matches only the value GitHub Actions itself sets, closing the CI=1/CI=true bypass any shell could previously trip. Matches the PR's own test table (GITHUB_ACTIONS=1 still refused, only =true skips).
• Checked every workflow in .github/workflows/ (changeset.yml, release-cli*.yml, etc.) that could plausibly commit from a plain clone — all run on GitHub Actions, so GITHUB_ACTIONS=true is set for all of them. This change doesn't silently break any existing automated commit path in this repo.
• --no-track is already what worktree-create.sh:120 passes (-B + --no-track), so the doc updates in SKILL.md/AGENTS.md now match the hook's actual behavior instead of lagging it.
• No stale CI-only wording left behind — grepped all three files plus the rest of AGENTS.md/SKILL.md for CI/GITHUB_ACTIONS and every remaining mention is consistent with the new skip condition.

Portability note (not a bug, worth being aware of): narrowing the skip to GITHUB_ACTIONS=true means a repo that installs this skill and runs its commit-producing automation on a non-GitHub-Actions CI system (CircleCI, GitLab CI, etc.) would now get refused where CI=1 previously let it through. SKILL.md:154-155 already calls this out ("A repo on another CI system adds that system's own marker"), so this is a documented, intentional tradeoff rather than an oversight — just flagging that it's a real behavior change for any downstream consumer of the skill, not only taskless/cli.

Minor, non-blocking nit: SKILL.md:242 (the prettier/eslint ignore-verification snippet, untouched by this diff) still does git worktree add .agents/.worktrees/probe -b throwaway-probe without --no-track. Since this PR is now making --no-track the documented standard everywhere else, that one leftover example could be updated for full consistency — but it's a disposable probe branch in a verification snippet, not something that affects correctness, so I'd leave it to the author's discretion.

No security, test-adequacy, or clarity issues found. The rationale comments added to the script and docs are clear and the three files tell a consistent story.

[theCodeDrift]

Re: @github-actions — "Claude finished @theCodeDrift's task in 1m 5s … Review mode: incremental"
#602 (comment)

Leaving the probe snippet as it is: git worktree add .agents/.worktrees/probe -b throwaway-probe starts from HEAD, a local commit, and git only sets an upstream when the start point is a remote-tracking branch, so --no-track would change nothing there. The non-GitHub-Actions tradeoff is intended and documented, as you noted.

— AI Coding Agent