docs(references): trim gh-CLI basics and dependency-config boilerplate

[CybotTM]

What

Trims the generic reference layer from two github-project skill references, per the audit item "github-project (gh-cli basics, Dependabot public-docs sections)".

Rubric: netresearch/skill-repo-skill skills/skill-repo/references/skill-quality.md — "Content value rubric". Cut only content a one-line prompt regenerates; hard-protect retro-born failure patterns, inference-suppression rules, version/tool-flag facts, org specifics, and executable scripts.

Cut (generic — a one-line prompt regenerates it)

references/gh-cli-reference.md (353 → 192 lines):

• ## Repository Information — basic gh repo view/gh api branches lookups
• ## Pull Requests — gh pr list/view/review/merge/comment basics (the one non-obvious bit, "wait for CI with the native watcher," already had its full retro-pattern treatment in ## Common Troubleshooting Patterns, kept)
• ## Branch Protection — plain gh api .../protection gets/patches, duplicated in dependency-management.md's Branch Protection Configuration (kept there)
• ## GitHub Actions — gh run list/view/rerun/watch, gh workflow run/list basics
• ## Releases and Tags — gh release list/create/view/download (also github-release skill's territory)
• ## Files and Content — gh api .../contents get/update basics
• ## Repository Settings — gh repo edit flag basics

references/dependency-management.md (789 → 511 lines):

• Dependabot ### Basic Configuration, ### Package Ecosystems table, ### Commit Message Prefixes, ### Multiple Ecosystems, ### Ignoring Dependencies, ### Reviewers and Assignees — restated dependabot.yml syntax straight from GitHub's public docs
• Renovate ### Basic Configuration, ### Extended Configuration, ### Grouping Rules, ### Security Updates, ### PHP/Composer Configuration, ### Go Configuration — restated Renovate config-preset JSON
• ### Lock File Maintenance (under Renovate) — byte-identical JSON block and rationale already fully present under ### CI Cannot Push to Protected Branch in Troubleshooting (kept); cutting the docs-style duplicate, not the retro-pattern original
• ## Comparison: Dependabot vs Renovate (feature table + "When to Use" bullets) — generic tool comparison; the one real technical distinction (bypass-permission behavior) survives in the kept ### Renovate vs Dependabot Auto-merge "Critical difference" callout
• ## Best Practices (13-item listicle) — restates points already covered elsewhere in concrete form (check-name matching, code-owner-review avoidance, etc.)

Kept (retro-born, tool-flag-specific, or org-specific)

• gh-cli-reference.md ## Packages (GHCR) — the read:packages+delete:packages scope gotcha and the "verify scopes from the response header, not gh auth status" fact
• gh-cli-reference.md ## Common Troubleshooting Patterns (untouched) — CI-watcher gotchas, gh run rerun old-state trap, transient 401s, PR-body line-break rule, image-embedding via raw.githubusercontent.com, Debug Auto-merge Pipeline script, stale fork merge-base fix, GraphQL --input pattern, github.actor/bot-detection trap
• gh-cli-reference.md ## Rate Limits — GITHUB_TOKEN in Actions (untouched) — the workflow-repo-budget behavior, misleading deploy-pages 403 symptom, one-tree-call fix
• dependency-management.md Ecosystem Hygiene (hard-fail vs silent-no-op per ecosystem) and target-branch release-branch gotchas
• dependency-management.md ### Grouping Dependencies — kept narrowly: security-config.md:352 points readers here for "per-repo grouped security updates use dependabot.yml groups"; cutting it would leave that pointer serving nothing
• dependency-management.md ### Auto-merge Configuration (Recommended) under Renovate — the platformAutomerge bypass-permission rationale is the skill's core auto-merge mechanic, not generic config
• All of ## Auto-merge Workflow, ## Branch Protection Configuration, and ## Troubleshooting Auto-merge — the BLOCKED-PR diagnosis, signed-commit/merge-strategy compat, matrix-job check-name mismatch, enabledBy actor gotcha, gitleaks-on-bot-PRs, GITHUB_TOKEN can't touch workflow files, and the git-worktree package-lock.json name-pollution gotcha

Kept, borderline

None — every retained section either matched a hard-protection category directly or (Grouping Dependencies) had a live inbound pointer from another reference file.

Verification

Orphan/reachability check (skill-repo-skill audit-skills.sh, run against this repo dir):

SKILL: github-project
REFERENCES: 24 total -> 24/P1 + 0/P2 + 0/P3 = 24 reachable, 0 ORPHAN
SUMMARY: 1 skills, 0 FAIL, 1 WARN, 0 INFO, 0 ORPHAN refs across 0 skills

(The 1 WARN is the pre-existing SKILL.md description length, untouched by this PR.)

SKILL.md word cap — untouched by this PR, still under cap:

$ wc -w skills/github-project/SKILL.md
497 skills/github-project/SKILL.md

Repo-wide grep for dangling refs to deleted headings/sections: none found. Confirmed security-config.md:352, multi-repo-operations.md:226, auto-merge-guide.md:189, and reusable-workflow-pitfalls.md:48 all point at sections that survive.

markdownlint-cli2 on the two changed files: 0 error(s). pre-commit run --files <changed>: all hooks Passed. (A full-repo pre-commit run --all-files shows one pre-existing markdownlint failure in security-config.md:362 and pre-existing shellcheck SC2015 info-notes in verify-github-project.sh — both in files untouched by this PR.)

Stats

• gh-cli-reference.md: 353 → 192 lines
• dependency-management.md: 789 → 511 lines
• Net: 440 deletions, 1 insertion (intro line rewrite)

---

Part of netresearch/skill-repo-skill#157. Ticks the github-project checkbox.

DO NOT MERGE. Ignore later bot reviews.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[gemini-code-assist]

Code Review

This pull request streamlines the documentation by removing basic configuration examples, tables, and standard command references from dependency-management.md and gh-cli-reference.md. The focus is shifted toward non-obvious gotchas, troubleshooting patterns, and advanced configurations, leaving basic usage to the tools' built-in help. There are no review comments, and I have no additional feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.