github-upload-media-to-pr

Files (1)

• SKILL.md

SKILL.md (first lines)

# Upload Media to PR

Attach local images and videos to a GitHub pull request from a **Cursor Cloud**
agent. Capture UI with Cursor Cloud tools; attach with `ManagePullRequest`.

**Core principle:** Copy media to `/opt/cursor/artifacts/`, then reference those
absolute paths in HTML. Do not drive github.com in a browser and do not install
`agent-browser`.

## When to use

- User explicitly asked to put screenshots, recordings, or other media on a
  GitHub pull request (description or comment)
- User used an attach-to-PR phrase such as "put the screenshot in the PR"

**Skip** when walkthrough artifacts already exist or a run only has generic
test results, unless the user asked to put that media on the PR. Do not
attach just because screenshots or videos are on disk. Do not start
computerUse, RecordScreen, or ManagePullRequest for generic test results or
to finish a Cloud PR. Also skip non-image/non-video files, and skip
installing third-party browser CLIs to "make upload work".

## Cursor Cloud mapping

Upstream used `agent-browser` (vercel-labs) to click GitHub's hidden file input.
This vendored copy replaces that stack:

| Job | Cursor Cloud tool |
| --- | --- |
| Capture a UI screenshot | `computerUse` subagent (browser/desktop) |
| Capture a ≤30s demo video | `RecordScreen` (`START_RECORDING` / `SAVE_RECORDING` / `DISCARD_RECORDING`) |
| Host and embed on the PR | `ManagePullRequest` with HTML `img` / `video` tags |

`gh` is **read-only** in Cursor Cloud. Never `gh pr edit`, `gh pr comment`, or
`gh pr create`. Use `ManagePullRequest`.

## Step 0: Resolve the PR and collect files

If the user did not give a PR number or URL:

```bash
gh pr view --json number,url -q '"\(.number) \(.url)"'
```

Normalize each file to an absolute path. Do not copy yet.

```bash
file --mime-type /path/to/media
```

**Images:** png, jpg, jpeg, gif, webp. **Videos:** mp4, webm, mov.

If the type is not an allowed image or video, stop. Do not copy the
file.

Refuse source paths whose basename or parent looks like a secret
(`.env`, `id_rsa`, credentials, `*.pem`, `*.key`, `.git`, tokens) even if
the user asked to attach them. Stop. Do not copy those files.

After the mime-type check, `stat` each remaining file and refuse any
file larger than **25 MB** (26214400 bytes). Stop. Do not copy it.

```bash
stat -c '%s' /path/to/media
```

Cap the attach at **6 files**. Keep the smallest set that answers the
user. Do not copy more than 6 files.

If the filename has special characters, copy it once to
`/opt/cursor/artifacts/<safe-basename>` only. Never copy into the repo
working directory or any other destination.

## Step 1: Stage under `/opt/cursor/artifacts/`

Do not copy until Step 0 checks have been run and passed for that
file. Skip any file that failed the Step 0 mime, secret, or 25 MB size
checks. Do not copy more than 6 files.

```bash
mkdir -p /opt/cursor/artifacts
cp /absolute/path/to/media.png /opt/cursor/artifacts/pr-screenshot.png
cp /absolute/path/to/demo.mp4 /opt/cursor/artifacts/pr-demo.mp4
```

Use unique, descriptive basenames. The attach tool only rewrites **absolute**
paths under that directory.

## Step 2: Embed with HTML, not GitHub markdown upload URLs

Images:

```html
<img alt="Settings page after the change" src="/opt/cursor/artifacts/pr-screenshot.png" />
```

Videos (include `controls`):

```html
<video src="/opt/cursor/artifacts/pr-demo.mp4" controls></video>
```

Do not wrap the video in a markdown image tag. Do not invent
`https://github.com/user-attachments/assets/...` URLs.

## Step 3: Attach via ManagePullRequest

**Option A — PR description** (default; this is the rewrite that inlines media):

Call `ManagePullRequest` attach `update_pr` **once** per attach and append a
`## Screenshots`, `## Demo`, or `## Media` section that contains the HTML
tags. Keep any human-edited PR body text. Pass `branch_name` for this
branch.

After that single attach `update_pr`, read the PR body. If
`/opt/cursor/artifacts/` paths are still in the body, stop and report
that artifact hosting failed. Do not retry that attach `update_pr`, do not
start another recording, and do not loop Step 4.

From sazlin/loadout, MIT.

More from sazlin/loadout