diff --git a/.agents/skills/bepinex-mono-mod-quality-check/SKILL.md b/.agents/skills/bepinex-mono-mod-quality-check/SKILL.md index b0b8f99..3dcc275 100644 --- a/.agents/skills/bepinex-mono-mod-quality-check/SKILL.md +++ b/.agents/skills/bepinex-mono-mod-quality-check/SKILL.md @@ -36,6 +36,10 @@ Apply `prose-quality-check` only after ownership and technical evidence are sett into reusable domain knowledge, and do not treat a well-structured document as proof that its game or release claim is correct. +Use `github-actions-quality-check` for the shared event, trust, permission, concurrency, runner, action-pin, +artifact-lineage, and repository-enforcement baseline. This Skill owns only the BepInEx/.NET/Thunderstore commands, +release identity, package contract, and domain-specific templates layered on that baseline. + Use `unity-game-analyze` to establish version-specific game-code and serialized-asset evidence: the concrete call path, effective prefab/scene values, object/load reachability, lifecycle timing, authority, and unresolved runtime inputs. This Skill consumes that evidence to select and verify hooks, adapters, identity mappings, compatibility claims, and @@ -59,15 +63,9 @@ namespace; they do not replace this Skill's quality bar. - For C# changes, require locked restore, format verification without restore, and a no-restore build. For Markdown, workflow, shell, APM, package, or release changes, apply the corresponding checks in [repository-quality-template.md](references/repository-quality-template.md). -- Use event-owned CI entry workflows: pull requests (and merge queues when used) validate proposed source with a `lint` - job (and a `test` job when the repository has tests), while the integration branch re-runs those jobs on its exact - commit and directly gates `build`, retained edge artifacts, and `release` through `needs`. Keep `lint-source` as a - Composite Action name, not a catch-all job name. When version or publication state must be resolved, use a read-only - `plan` job and make `build` depend directly on `lint`, optional `test`, and `plan`; have `release` consume the - verified build artifact and any needed plan output. Here, read-only means that planning does not modify tracked - source/package files, tags, releases, or other GitHub state and has no write-capable token. It may fetch remote refs - needed to classify the current version. Do not add manual dispatch or polling jobs without a documented - operator/recovery need. +- Apply the event-owned workflow, direct-job-graph, read-only planning, permission, concurrency, and artifact-lineage + rules from `github-actions-quality-check`. This Skill supplies the BepInEx-specific source gate, release identity, + archive, edge-build, and Thunderstore extensions. - When the target adopts a bundled CI or publishing contract, copy its files exactly from this Skill's canonical `assets/` and verify them from the installed Skill during authoring and review. Consumer CI must run only committed repository-owned actions and scripts; it must not execute `.agents/skills/` or require this Skill at workflow @@ -282,20 +280,10 @@ conditional branches, verification matrix, and report format. Do not replace tha or result. A generic exception or nonzero exit does not prove the advertised rejection branch. - When the project derives manifest or package versions in CI, verify that the project version, generated version, and loader-compatible version are deliberately handled for stable, prerelease, and edge builds. -6. Check GitHub repository settings, CI, and release automation when the repository uses GitHub Actions or GitHub - Releases. - - Require the repository or organization Actions setting that enforces full-length commit-SHA pins. Independently - verify every third-party `uses:` reference has a full commit SHA and an accurate version comment; inspect reusable - workflows, container digests, and downloaded-tool checksums too. - - When the repository publishes GitHub Releases, require repository-level immutable releases where GitHub makes the - setting available. Automation must attach every asset before publishing the release and must fail rather than - replace an existing tag, release, or asset. If the setting is unavailable, record the residual risk and require an - explicit fail-on-existing-release/tag/asset path instead of silently treating releases as immutable. +6. Check BepInEx release automation when the repository uses GitHub Actions or GitHub Releases. Apply + `github-actions-quality-check` for the shared workflow and repository-enforcement baseline. - Keep checksum material used to verify the build-to-release handoff inside the workflow artifact by default. Publish only the package archive unless the repository has an explicit user-facing checksum-asset contract. - - Trace one release from its source commit through locked restore, build, archived artifact, and release asset. - Publish only the artifact produced by that build; do not rebuild a separately checked-out revision in the release - job. Create and verify an artifact digest across the build and release jobs. - Install the exact SDK selected by `global.json` in CI with a full-SHA-pinned setup action or another pinned, verified mechanism before restore. Do not assume a hosted runner already contains the release-critical SDK. - Separate validation artifacts, prereleases, and stable publishing according to the repository's version rules. Gate @@ -310,16 +298,13 @@ conditional branches, verification matrix, and report format. Do not replace tha - Keep archive creation CI-owned. A locally callable validator is useful, but a second repository-local production packager, `release/` helper tree, or custom approval schema needs a distinct consumer and lifecycle. Never remove the stable release path while consolidating packaging ownership. - - Default workflow permissions to read-only. Scope `contents: write` and publishing secrets to the release job that - needs them, and never expose a publish credential to pull-request validation. 7. Run the narrowest relevant checks, then widen for the changed surface. - For C# or project changes, run locked restore, format verification, and no-restore build. Run the documented tests when automated tests are present or changed. Use the solution or project path required by the repository layout. - For documentation or package text, run Markdown lint over every committed Markdown file using the checked-in configuration. - - For workflows, composite actions, or shell scripts, run ShellCheck, `actionlint`, and - `pinact run --check --min-age 7`; check full-SHA action pins, container digests, downloaded-tool checksums, - permissions, concurrency, and secret scope. + - For workflows, composite actions, or shell scripts, apply the automated and AI-assisted validation scopes from + `github-actions-quality-check`, then run the BepInEx/.NET/package checks enabled by this Skill. - Reconcile declared tooling with execution. Every committed lint/check configuration and every command promised in README or CONTRIBUTING must have a runnable documented command and an enabled CI invocation, or be removed with the documented reason. diff --git a/.agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/generate-version/action.yml b/.agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/generate-version/action.yml index 8489666..2854820 100644 --- a/.agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/generate-version/action.yml +++ b/.agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/generate-version/action.yml @@ -1,4 +1,4 @@ -name: Generate Version +name: Generate BepInEx version description: "Generate application and git version based on csproj version and git tags." inputs: diff --git a/.agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/lint-source/action.yml.template b/.agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/lint-source/action.yml.template index c27632d..70db1a2 100644 --- a/.agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/lint-source/action.yml.template +++ b/.agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/lint-source/action.yml.template @@ -1,4 +1,4 @@ -name: Lint source +name: Lint BepInEx source description: Run the repository's workflow, C#, and Markdown source checks. runs: diff --git a/.agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/publish-thunderstore/action.yml b/.agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/publish-thunderstore/action.yml index 18dbef7..371682f 100644 --- a/.agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/publish-thunderstore/action.yml +++ b/.agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/publish-thunderstore/action.yml @@ -1,4 +1,4 @@ -name: Publish Thunderstore Package +name: Publish Thunderstore package description: Upload and submit a prebuilt Thunderstore package zip. inputs: diff --git a/.agents/skills/bepinex-mono-mod-quality-check/assets/github/workflows/main.yml.template b/.agents/skills/bepinex-mono-mod-quality-check/assets/github/workflows/main.yml.template index 9b67731..82d9135 100644 --- a/.agents/skills/bepinex-mono-mod-quality-check/assets/github/workflows/main.yml.template +++ b/.agents/skills/bepinex-mono-mod-quality-check/assets/github/workflows/main.yml.template @@ -17,21 +17,25 @@ defaults: shell: bash jobs: - lint: - # A merged commit is validated again in this workflow. This direct - # dependency is the release gate; do not replace it with workflow polling. + # A merged commit is validated again in this workflow. This direct + # dependency is the release gate; do not replace it with workflow polling. + checks: + name: Checks runs-on: ubuntu-slim steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Check out integrated source + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - uses: ./.github/actions/lint-source + - name: Run BepInEx source gate + uses: ./.github/actions/lint-source + # Resolve one release identity before build mutates package source files. + # Keep planning read-only so edge metadata remains reusable by its consumers. plan: - # Resolve one release identity before build mutates package source files. - # Keep planning read-only so edge metadata remains reusable by its consumers. + name: Plan runs-on: ubuntu-slim outputs: @@ -41,7 +45,8 @@ jobs: manifest_version: ${{ steps.generate-version.outputs.manifest_version }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Check out integrated source with tags + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 persist-credentials: false @@ -54,8 +59,9 @@ jobs: write_files: false build: + name: Build needs: - - lint + - checks - plan # Build keeps ubuntu-latest because packaging currently relies on # runner-provided shell tools such as jq and 7z. @@ -70,7 +76,8 @@ jobs: steps: # Checkout is required before generating versions because the local # composite action reads project files and fetches tags from this clone. - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Check out integrated source + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Generate version uses: ./.github/actions/generate-version @@ -80,7 +87,7 @@ jobs: app_version: ${{ needs.plan.outputs.app_version }} manifest_version: ${{ needs.plan.outputs.manifest_version }} - - name: Setup .NET + - name: Set up .NET # This shared action pins the SDK and restores the same locked graph # used by source validation. uses: ./.github/actions/setup-dotnet @@ -182,6 +189,7 @@ jobs: } >> "${GITHUB_STEP_SUMMARY}" release: + name: Release needs: - build - plan @@ -201,7 +209,8 @@ jobs: steps: # Checkout is needed even though the package is downloaded, because the # Thunderstore publisher is a repository-local composite action. - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Check out release automation + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Download build artifact uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 diff --git a/.agents/skills/bepinex-mono-mod-quality-check/assets/github/workflows/pull-request.yml.template b/.agents/skills/bepinex-mono-mod-quality-check/assets/github/workflows/pull-request.yml.template index 49718ed..03387f2 100644 --- a/.agents/skills/bepinex-mono-mod-quality-check/assets/github/workflows/pull-request.yml.template +++ b/.agents/skills/bepinex-mono-mod-quality-check/assets/github/workflows/pull-request.yml.template @@ -16,13 +16,16 @@ permissions: contents: read jobs: - lint: - # Keep proposed source validation separate from publishing privileges. + # Keep proposed source validation separate from publishing privileges. + checks: + name: Checks runs-on: ubuntu-slim steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Check out proposed source + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - uses: ./.github/actions/lint-source + - name: Run BepInEx source gate + uses: ./.github/actions/lint-source diff --git a/.agents/skills/bepinex-mono-mod-quality-check/references/implementation-runbook.md b/.agents/skills/bepinex-mono-mod-quality-check/references/implementation-runbook.md index 3e88c04..096e7ea 100644 --- a/.agents/skills/bepinex-mono-mod-quality-check/references/implementation-runbook.md +++ b/.agents/skills/bepinex-mono-mod-quality-check/references/implementation-runbook.md @@ -289,19 +289,10 @@ independent stages. 1. If APM is `yes`, preserve/create `apm.yml`, pin remote sources to full SHAs, check provenance/license/last-changed-subdirectory cooldown, record third party notices, then commit manifest, lockfile, and generated output together. -2. If GitHub Actions is `yes`, create/align event-owned entry workflows: `Pull - Request` for `pull_request` and `merge_group` when used; `Main` for the - protected integration-branch push. Both run the same lint gate on - their checked-out commit. `Main` uses direct `needs` dependencies to gate - read-only `plan`, build, artifact upload, and publication; never substitute - API polling or an `await-quality` job. `plan` owns the resolved version and - release state; build and release consume its outputs rather than resolving a - second identity. Run lint in this order: checkout; external-tool - setup and verification; ShellCheck; actionlint; pinact; SDK setup; locked - restore; format; no-restore build; tests; Markdown lint; archive validation - when relevant. Use read-only permissions, explicit Bash, and PR-only - cancellation concurrency. Add manual dispatch only for a documented - diagnostic or recovery operation. +2. If GitHub Actions is `yes`, apply `github-actions-quality-check` for entry + workflows, the direct job graph, planning, permissions, concurrency, + executable inputs, and validation tools. Extend that graph with this + repository's BepInEx/.NET source, archive, and publication contracts. Read the SDK version from `global.json` and install it explicitly using a full-SHA-pinned setup action or pinned verified equivalent before restore; verify `dotnet --version` matches. Do not depend on runner inventory. @@ -314,9 +305,8 @@ independent stages. directory, or a repository-specific approval/evidence schema unless a named consumer and distinct lifecycle require it. Consolidation must preserve the stable release job and its verified artifact handoff. -3. Pin third-party actions by full SHA plus accurate version comment, containers - by digest, and downloaded executable tools by adjacent version and checksum. - Cache only verified archives and use committed lockfiles as NuGet cache keys. +3. Use committed lockfiles as NuGet cache keys. Do not cache restored package + directories or depend on ambient runner SDK state. 4. If GitHub Releases is `yes`, create a build job that creates one archive and digest from the integration-branch commit, then uploads it for every build including unpublished edge builds; publish only a downloaded-and-verified copy. @@ -374,7 +364,7 @@ not passed; record the command, reason, and resulting risk. | Identifier-dependent behavior | fixture where catalog/protocol index differs from stable domain ID | hash/persist/log/serialize result follows the contractually named identity | | Lifecycle predicate change | positive-and-adjacent-negative truth table | every named positive passes; loading/departing/travelling/reset/unavailable negatives fail unless explicitly included | | NuGet source/package/lock change | source/publisher/version/hash/license/transitive/age review | ledger records approval; mapping/locks cover every resolver | -| Workflow/action/shell change | ShellCheck, `actionlint`, `pinact run --check --min-age 7`, manual pin/permission/concurrency/secret review | all pass; every executable input is pinned/verified | +| Workflow/action/shell change | Complete `github-actions-quality-check` verification | shared automated and inspection checks pass; every executable input is verified | | Bundled template adopted or changed | run `sync_templates.ps1 -Check` from the installed Skill during authoring with the repository's selected IDs in the canonical Skill and every opted-in consumer | every selected destination exists and satisfies its manifest comparison mode; exclusions and local variants are documented; consumer CI has no `.agents/skills/` runtime dependency | | Lint/check config or contributor command | trace config to local command and enabled CI step | each retained config is consumed and every promised command is runnable in both documented and CI contexts | | APM change | `apm lock`; lock review; `apm install --frozen`; `apm audit --ci` | expected refs/hashes and no drift | diff --git a/.agents/skills/bepinex-mono-mod-quality-check/references/repository-derived-baseline.md b/.agents/skills/bepinex-mono-mod-quality-check/references/repository-derived-baseline.md index 8db8c1d..87ce4cb 100644 --- a/.agents/skills/bepinex-mono-mod-quality-check/references/repository-derived-baseline.md +++ b/.agents/skills/bepinex-mono-mod-quality-check/references/repository-derived-baseline.md @@ -89,31 +89,16 @@ not automatic quality improvements. ## GitHub CI and release automation For repositories that use GitHub Actions to build an archive and publish -releases, apply the following review baseline: - -- Enable the repository or organization policy requiring GitHub Actions to use - full-length commit-SHA pins. Keep the exact SHA in each `uses:` reference and - retain a version comment that a reviewer can verify. Pin containers by digest - and verify checksums for downloaded executables. -- Keep ordinary CI read-only. Give the release job only the write permission it - needs, and pass package-host tokens only to that publishing step. -- Build once from the release commit, upload the completed archive and its - digest, then download and verify that exact artifact before publishing it. - Do not publish a separately rebuilt archive or accept zero or multiple - package artifacts. -- Enable GitHub immutable releases when available. Create the release as a - draft, attach all assets, then publish it so its tag and assets cannot be - changed afterward. If that setting is unavailable, record the residual risk; - still keep automation fail-closed if the intended release, tag, or asset - already exists. +releases, apply the shared workflow, artifact, permission, executable-input, +release, and repository-enforcement baseline from +`github-actions-quality-check`. + +Extend that baseline with the BepInEx release modes: + - Distinguish edge validation artifacts, prereleases, and stable releases. Publish to external package hosts only for the repository's intended stable mode, after package inspection and runtime evidence are available. -GitHub documents the repository Actions setting for -[full-length commit-SHA pins](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository) -and [immutable releases](https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases). - ## Transferable verification shape Start with the repository's documented commands. Common categories include: @@ -124,9 +109,9 @@ dotnet format --no-restore --verify-no-changes DOTNET_CLI_UI_LANGUAGE=en dotnet build ``` -They also lint Markdown, and run shell, GitHub Actions, and action-pin checks -when those surfaces change. These are examples, not commands to invent in a -repository that has not adopted the corresponding tools. +They also lint Markdown and apply `github-actions-quality-check` when automation +surfaces change. These are examples, not commands to invent in a repository +that has not adopted the corresponding tools. For runtime validation, record the exact game build, BepInEx version, mod set, and reproduction path. Build success alone does not establish patch timing, diff --git a/.agents/skills/bepinex-mono-mod-quality-check/references/repository-quality-template.md b/.agents/skills/bepinex-mono-mod-quality-check/references/repository-quality-template.md index 3a6cc5d..6cd4fc1 100644 --- a/.agents/skills/bepinex-mono-mod-quality-check/references/repository-quality-template.md +++ b/.agents/skills/bepinex-mono-mod-quality-check/references/repository-quality-template.md @@ -159,30 +159,12 @@ See `$apm-usage` for installation, cooldown, license, and update details. ## GitHub repository and CI -- Configure GitHub Actions to require full-length commit-SHA pins when the - repository or organization setting is available. Keep a verified version - comment next to every third-party action reference. Pin container images by - digest and verify checksums before executing downloaded tools. -- Use event-owned entry workflows. `Pull Request` handles `pull_request` and - `merge_group` when a merge queue uses required checks; it validates proposed - source only. `Main` handles protected integration-branch pushes, re-runs the - lint gate on the exact pushed commit, and uses direct `needs` - dependencies to gate build and publication. Do not add `workflow_dispatch`, - polling, or a cross-workflow wait job without a documented diagnostic, - recovery, or trust-boundary need. Set read-only workflow permissions, - explicit Bash defaults, and a concurrency group that cancels obsolete - pull-request runs but never cancels an active release. -- Keep CI stages ordered and reproducible: checkout; install/check external - linters; actionlint and ShellCheck; action-pin verification; .NET setup; - locked restore; `dotnet format --no-restore --verify-no-changes`; build; and - Markdown lint. Run ShellCheck before actionlint when actionlint can use it - for inline shell validation. -- Extract a same-runner repeated setup/check sequence into a local Composite - Action when it materially reduces duplication, including this shared - lint sequence. Keep runner choice, job permissions, artifact - upload, and release dependencies visible in entry workflows. Introduce a - reusable workflow only when job-level matrix, outputs, or permission - boundaries make a Composite Action insufficient; document that reason. +- Apply `github-actions-quality-check` for event ownership, job dependencies, + permissions, concurrency, runners, executable inputs, validation tools, + artifacts, releases, and repository enforcement. +- Keep the BepInEx/.NET source gate ordered and reproducible: explicit SDK + setup; locked restore; `dotnet format --no-restore --verify-no-changes`; + no-restore build; applicable tests; package checks; and Markdown lint. - Keep documentation, checked-in lint/check configuration, and CI in one executable contract. Every retained configuration must be consumed by a documented local command and an enabled CI step; remove stale configuration @@ -191,20 +173,12 @@ See `$apm-usage` for installation, cooldown, license, and update details. may run committed repository-owned actions and scripts copied or rendered by a Skill, but must not execute `.agents/skills/` or require APM installation to build, lint, package, or release the product. -- Use `pinact run --check --min-age 7`, `actionlint`, and ShellCheck for - workflow or composite-action changes. Cache downloaded tool archives only; - verify their checksum on every extraction. Keep the tool version and checksum - adjacent and update them as one supply-chain-reviewed change. - Cache NuGet using the committed lockfile path. Keep the .NET SDK version, target framework, and CI documentation aligned. Do not rely on the ambient runner toolchain for release-critical behavior. - Install the `global.json` SDK explicitly in CI with a full-SHA-pinned setup action or pinned verified equivalent, then assert `dotnet --version` before locked restore. -- Review GitHub repository settings in addition to workflow YAML: Actions - source restrictions and SHA-pin enforcement, default token permissions, - branch protection/required checks, immutable releases, and release secrets. - Record settings that cannot be inspected as verification gaps. ## Composite actions @@ -225,8 +199,8 @@ See `$apm-usage` for installation, cooldown, license, and update details. logging them, and return only non-sensitive URLs or identifiers. - Keep composite actions small. Put reusable game/framework behavior in C#; keep only CI orchestration and deterministic repository tasks in YAML or - shell. Test changed action scripts with ShellCheck and their calling workflow - with actionlint and pinact. + shell. Apply `github-actions-quality-check` when validating changed actions + and their calling workflows. - Add the selected template IDs and `sync_templates.ps1 -Check` command to contributor documentation for authoring-time review. Do not add it to consumer CI. A repository that needs a different contract must stop selecting diff --git a/.agents/skills/github-actions-quality-check/README.md b/.agents/skills/github-actions-quality-check/README.md new file mode 100644 index 0000000..a90b4e7 --- /dev/null +++ b/.agents/skills/github-actions-quality-check/README.md @@ -0,0 +1,12 @@ +# github-actions-quality-check + +## Overview + +Review and design secure, deterministic, and evidence-backed GitHub Actions +workflows, local actions, CI templates, and repository enforcement. + +## Install + +```shell +apm install aoirint/skills/.apm/skills/github-actions-quality-check +``` diff --git a/.agents/skills/github-actions-quality-check/SKILL.md b/.agents/skills/github-actions-quality-check/SKILL.md new file mode 100644 index 0000000..e1a1e43 --- /dev/null +++ b/.agents/skills/github-actions-quality-check/SKILL.md @@ -0,0 +1,142 @@ +--- +name: github-actions-quality-check +description: >- + Review, design, create, or repair GitHub Actions workflows and local actions + for event boundaries, dependency structure, permissions, concurrency, + immutable pins, runner selection, validation, artifacts, releases, and + repository enforcement. Use for .github/workflows, .github/actions, Actions + policy, required-check design, or CI template changes; use github-workflow + for issue, pull-request, comment, and squash-merge text or operations. +--- + +# GitHub Actions Quality Check + +## When to Use + +Use this Skill for GitHub Actions workflow files, local Composite Actions, +reusable workflows, Actions repository settings, required-check contexts, and +CI templates. Pair it with the ecosystem Skill that owns the commands being +automated and with `security-check` for third-party executable inputs, +permissions, secrets, publishing credentials, and artifacts. + +Use `github-workflow` for issue and pull-request artifacts, comments, reviews, +and squash merges. Do not use this Skill to infer application test commands, +release identity, package layout, or deployment policy that the repository and +its ecosystem Skill do not establish. + +## Goals + +- Make event, trust, privilege, and lifecycle boundaries explicit. +- Re-run required validation on the exact proposed and integrated commits. +- Keep job dependencies direct, artifacts traceable, and publication + idempotent. +- Keep Actions and downloaded tools immutable, provenance-reviewed, and + least-privilege. +- Produce evidence-calibrated findings and verification records. + +## Workflow + +1. Inventory before editing. + - Read repository guidance, every entry workflow, every reachable local + action or reusable workflow, release scripts, required-check settings, and + the ecosystem's local validation contract. + - Record each event, job name, runner, `needs` edge, permission, concurrency + rule, external `uses:`, download, secret, cache, artifact, and publication + side effect. + - Distinguish observed facts, requested changes, unavailable evidence, and + proposed policy. Never infer compliance from a related setting or a prior + run. +2. Design event-owned entry workflows. + - Validate untrusted proposed source on `pull_request`; include + `merge_group` when merge-queue required checks use that job. + - Re-run required validation on the protected integration branch's exact + pushed commit. Keep this run uncancelled. + - Keep pull-request and integration-push entry workflows separate because + their cancellation, source trust, and lifecycle differ. + - Add `workflow_dispatch` only for a documented operator or recovery need. + Use `workflow_run` only for a separately reviewed trust boundary. Never + emulate a direct dependency with polling or an `await-quality` job. +3. Build a direct job graph. + - Read [naming-and-readability.md](references/naming-and-readability.md) + before naming or renaming workflow files, workflows, jobs, steps, or local + actions. Use `checks`, `tests`, `builds`, and `deploys` as a small + conceptual vocabulary when it fits, but split jobs and workflows only + when their operational boundaries justify the cost. + - Make build depend directly on every required validation and plan job. + Make release consume the verified build artifact and required plan output. + - Keep planning read-only: it may resolve canonical release state, but must + not mutate tracked files, tags, releases, or other GitHub state. + - Reuse a local Composite Action for a stable same-runner sequence. Use a + reusable workflow only when job-level matrices, outputs, runners, or + permission boundaries require one, and document that reason. + - Keep one blank line between sibling jobs and between sibling steps. Add a + concise adjacent comment only when it preserves non-obvious design intent, + such as a trust boundary, cancellation exception, or artifact handoff. +4. Minimize authority and cancellation. + - Start workflow permissions at `contents: read`. Grant writes only on the + job that demonstrably needs them; document every unusual permission. + - In read-only checkout steps, set `persist-credentials: false` unless a + later step demonstrably needs repository credentials. + - Cancel only superseded pull-request and merge-queue runs, keyed by pull + request number or ref. Do not cancel default-branch validation or an + in-progress immutable publication. + - Do not execute untrusted proposed source with `pull_request_target` or a + write-capable token. +5. Review runners and executable inputs. + - Read [runner-selection.md](references/runner-selection.md) before selecting + or changing a GitHub-hosted runner. + - Give every `uses:` step a responsibility-revealing `name`. Pin every + external action and reusable workflow to a full 40-character commit SHA + with an accurate same-line release comment. + - For each changed external action, downloaded tool, or container, use + `security-check` to verify publisher and source, immutable identity, + release age, checksum or digest where applicable, runtime behavior, and + requested permissions. A seven-day cooldown is a minimum gate, not proof + of trust. + - Before restricting an Actions allowlist, recursively inventory every + reachable `uses:`. Allow only required names; with SHA enforcement, an + individual `owner/action@*` allowlist entry permits future reviewed pins + without wildcarding an owner. +6. Preserve exact-source artifact and release gates. + - Build once from the validated commit, validate the final packaged artifact, + record its digest and source identity, and pass that artifact forward. + - Do not rebuild in the release job. Verify the downloaded artifact before + publishing it. + - Derive release identity from one canonical source in a read-only plan. + Make retries idempotent and verify an existing immutable release and its + assets instead of silently replacing them. + - Isolate write permissions and credentials in the publication job or + protected environment. Use the artifact-specific ecosystem Skill and + `security-check` for final-container inspection. +7. Validate source and embedded shell. + - Run the repository-documented `actionlint`, applicable standalone + ShellCheck, and `pinact run --check --min-age 7`. Supply `GITHUB_TOKEN` to + pinact when available. + - Validate action inputs against metadata or documentation for the exact + pinned revision. Treat unknown inputs, stale version comments, mutable + pins, lint failures, and unreviewed suppressions as findings. + - Use [validation-and-reporting.md](references/validation-and-reporting.md) + for evidence categories, tool scope, and the completion report. +8. Review repository enforcement when it is in scope. + - Read [repository-enforcement.md](references/repository-enforcement.md) + before auditing or changing Actions policy, required checks, merge rules, + environments, or the default-branch ruleset. + - Verify every required status context is a current pull-request job name + and also runs on `merge_group` when a merge queue uses it. Never create a + ruleset that can block every merge because its check cannot run. + - For apply requests, record the requested payload and perform post-change + read-back. For audit-only requests, leave inaccessible values unverified. +9. Summarize separately: + - automated checks and exact scope; + - AI-assisted structural and security inspection; + - observed facts, applied changes, and post-change verification; + - blockers, unavailable evidence, approved exceptions, and skipped checks. + +## Templates + +Read [template-contract.md](references/template-contract.md) before creating or +repairing event-owned validation. The bundled files under `assets/github/` +provide a minimal entry-workflow and tool-installation baseline. Copy them into +the consumer repository, then make only repository-evidenced substitutions. +Consumer CI must run committed repository-owned files and must not execute the +installed Skill at workflow runtime. diff --git a/.agents/skills/github-actions-quality-check/agents/openai.yaml b/.agents/skills/github-actions-quality-check/agents/openai.yaml new file mode 100644 index 0000000..4be0ce7 --- /dev/null +++ b/.agents/skills/github-actions-quality-check/agents/openai.yaml @@ -0,0 +1,4 @@ +interface: + display_name: "GitHub Actions Quality Check" + short_description: "Review secure and reliable GitHub Actions automation" + default_prompt: "Use $github-actions-quality-check to review GitHub Actions workflows." diff --git a/.agents/skills/github-actions-quality-check/assets/github/actions/install-workflow-tools/action.yml b/.agents/skills/github-actions-quality-check/assets/github/actions/install-workflow-tools/action.yml new file mode 100644 index 0000000..4046fad --- /dev/null +++ b/.agents/skills/github-actions-quality-check/assets/github/actions/install-workflow-tools/action.yml @@ -0,0 +1,50 @@ +name: Install workflow lint tools +description: Install checksum-verified ShellCheck, actionlint, and pinact binaries. + +runs: + using: composite + steps: + - name: Install ShellCheck + shell: bash + run: | + version="0.11.0" + sha256="b7af85e41cc99489dcc21d66c6d5f3685138f06d34651e6d34b42ec6d54fe6f6" + archive="shellcheck-v${version}.linux.x86_64.tar.gz" + url="https://github.com/koalaman/shellcheck/releases/download/v${version}/${archive}" + archive_path="${RUNNER_TEMP}/${archive}" + tool_dir="${RUNNER_TEMP}/shellcheck" + curl --fail --silent --show-error --location --retry 3 --retry-delay 2 --retry-connrefused --output "${archive_path}" "${url}" + echo "${sha256} ${archive_path}" | sha256sum --check --strict - + mkdir -p "${tool_dir}" + tar -xzf "${archive_path}" -C "${tool_dir}" --strip-components=1 "shellcheck-v${version}/shellcheck" + echo "${tool_dir}" >> "${GITHUB_PATH}" + + - name: Install actionlint + shell: bash + run: | + version="1.7.12" + sha256="8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8" + archive="actionlint_${version}_linux_amd64.tar.gz" + url="https://github.com/rhysd/actionlint/releases/download/v${version}/${archive}" + archive_path="${RUNNER_TEMP}/${archive}" + tool_dir="${RUNNER_TEMP}/actionlint" + curl --fail --silent --show-error --location --retry 3 --retry-delay 2 --retry-connrefused --output "${archive_path}" "${url}" + echo "${sha256} ${archive_path}" | sha256sum --check --strict - + mkdir -p "${tool_dir}" + tar -xzf "${archive_path}" -C "${tool_dir}" actionlint + echo "${tool_dir}" >> "${GITHUB_PATH}" + + - name: Install pinact + shell: bash + run: | + version="3.9.2" + sha256="6adcc8a2217e4114e0841f8bca0cddf9958a9c52e3e89760c35b791cdba1a916" + archive="pinact_linux_amd64.tar.gz" + url="https://github.com/suzuki-shunsuke/pinact/releases/download/v${version}/${archive}" + archive_path="${RUNNER_TEMP}/${archive}" + tool_dir="${RUNNER_TEMP}/pinact" + curl --fail --silent --show-error --location --retry 3 --retry-delay 2 --retry-connrefused --output "${archive_path}" "${url}" + echo "${sha256} ${archive_path}" | sha256sum --check --strict - + mkdir -p "${tool_dir}" + tar -xzf "${archive_path}" -C "${tool_dir}" pinact + echo "${tool_dir}" >> "${GITHUB_PATH}" diff --git a/.agents/skills/github-actions-quality-check/assets/github/workflows/main.yml b/.agents/skills/github-actions-quality-check/assets/github/workflows/main.yml new file mode 100644 index 0000000..8c3e2d5 --- /dev/null +++ b/.agents/skills/github-actions-quality-check/assets/github/workflows/main.yml @@ -0,0 +1,32 @@ +name: Main + +on: + push: + branches: + - main + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: false + +defaults: + run: + shell: bash + +jobs: + # Re-run the required source checks on the exact integrated commit. + checks: + name: Checks + runs-on: ubuntu-slim + + steps: + - name: Check out integrated source + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Run shared source gate + uses: ./.github/actions/lint-source diff --git a/.agents/skills/github-actions-quality-check/assets/github/workflows/pull-request.yml b/.agents/skills/github-actions-quality-check/assets/github/workflows/pull-request.yml new file mode 100644 index 0000000..ee01567 --- /dev/null +++ b/.agents/skills/github-actions-quality-check/assets/github/workflows/pull-request.yml @@ -0,0 +1,35 @@ +name: Pull Request + +on: + pull_request: + branches: + - main + merge_group: + types: + - checks_requested + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +defaults: + run: + shell: bash + +jobs: + # Keep proposed source validation separate from publishing privileges. + checks: + name: Checks + runs-on: ubuntu-slim + + steps: + - name: Check out proposed source + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Run shared source gate + uses: ./.github/actions/lint-source diff --git a/.agents/skills/github-actions-quality-check/references/naming-and-readability.md b/.agents/skills/github-actions-quality-check/references/naming-and-readability.md new file mode 100644 index 0000000..6a6dfdc --- /dev/null +++ b/.agents/skills/github-actions-quality-check/references/naming-and-readability.md @@ -0,0 +1,96 @@ +# GitHub Actions Naming and Readability + +## Purpose + +Make workflow topology understandable without opening every implementation. Apply these rules to +new or materially restructured workflows and local actions. Preserve an established public status +context or integration path until its consumers and repository rules are migrated deliberately. + +## Naming layers + +| Layer | Rule | Examples | +| --- | --- | --- | +| Workflow file | Use lowercase kebab-case for the event or lifecycle responsibility. Avoid implementation-only names when the workflow owns more than that implementation. | `pull-request.yml`, `main.yml`, `release.yml` | +| Workflow `name` | Use concise Title Case that identifies the lifecycle responsibility and is unique in the repository. Add a domain qualifier only when multiple workflows would otherwise collide. | `Pull Request`, `Main`, `Docker Release` | +| Job ID | Use lowercase kebab-case for one visible responsibility. Prefer stable outcome names over tool names. Qualify only to distinguish parallel responsibilities. | `checks`, `unit-tests`, `build-container` | +| Job `name` | Set an explicit concise Title Case display name. Keep a required-check name stable; for a matrix, include only the dimension needed to distinguish instances. | `Checks`, `Unit Tests`, `Tests (${{ matrix.python-version }})` | +| Composite Action path | Put each action at `.github/actions//action.yml`. Use `action.yml`, not an arbitrary filename; let the directory carry the responsibility. | `.github/actions/lint-docker/action.yml` | +| Composite Action `name` | Use a concise responsibility phrase that distinguishes the domain and result. Avoid `CI`, `Checks`, `Setup`, or `Build` alone. | `Lint Docker source`, `Set up locked Python` | +| Step `name` | Use a responsibility-revealing verb phrase. Distinguish repeated checkout, upload, download, login, and publication steps by source or destination. | `Check out proposed source`, `Upload Linux package` | + +Keep names aligned across layers without forcing identical text. A `pull-request.yml` workflow may +be named `Pull Request`, contain a `checks` job named `Checks`, and call +`.github/actions/lint-docker/action.yml` named `Lint Docker source`: each layer answers a different +question. + +Before renaming a workflow or job, inventory branch rules, merge queues, badges, API consumers, +documentation, and reusable-workflow callers. Treat a required job display-name change as a +repository-enforcement migration, not a cosmetic edit. + +## Responsibility vocabulary and topology + +Start with four broad capability categories when they fit the repository: + +- **Checks** validate repository contents and constraints, including formatting, lint, types, + documentation, schemas, generated files, licenses, and policy. +- **Tests** exercise software behavior, including unit, integration, end-to-end, smoke, + compatibility, and release-artifact tests. +- **Builds** produce an executable, distributable, or later-stage artifact. +- **Deploys** deliver or publish an already produced artifact. + +Classify by the primary outcome. Compilation performed only to run tests remains part of Tests. +Version detection and version locking are workflow release policy, not generic Build or Deploy +capabilities. + +Do not turn the vocabulary into a fixed pipeline or four mandatory jobs. Classification describes +responsibility; `needs` describes execution order; jobs and workflows describe operational +boundaries. Combine related checks or tests when separation adds little value. Split a job when +parallel feedback, an independent retry, a different runner, permissions, environment, selective +execution, required-check visibility, or an artifact boundary justifies its startup and maintenance +cost. Add a workflow only when its trigger, trust, permissions, concurrency, environment, +ownership, or operational lifecycle warrants a separate boundary. + +Place tests by measured cost, determinism, infrastructure, credentials, security exposure, and +feedback value rather than by the labels `unit`, `integration`, or `end-to-end`. Cheap deterministic +integration tests can belong on pull requests; expensive or credentialed tests may not. +Use `test-quality-check` to classify test evidence and judge its behavioral +value. This reference owns only the operational workflow/job boundary implied +by cost, permissions, runners, credentials, and artifact lineage. + +Keep Composite Actions policy-neutral. Name them for reusable capabilities such as +`check-python`, `test-package`, `build-container`, or `deploy-package`; do not encode `pull-request`, +`main`, or `release` policy in the action. Workflows own lifecycle policy and jobs own concrete +execution units. + +For releases, build once after release identity is locked, test that exact artifact, and deploy the +same artifact. A distinct Release concept does not require a distinct workflow: use a dedicated +workflow only when its operational boundary earns the added complexity; otherwise a conditional +release path in the integration workflow is valid. + +## Comments + +Add a short comment next to a decision whose reason is not recoverable from the keys themselves: + +- why proposed-source and integration-source workflows differ; +- why a run is or is not cancellable; +- why a job needs broader permissions, credentials, a full runner, or an unusual timeout; +- why an artifact is built once, retained, verified, or handed to publication; +- why a suppression, compatibility constraint, or non-obvious expression is necessary. + +Explain **why**, not **what**. Do not restate a step name, pin comment, YAML key, or obvious command. +Put a job-wide or step-wide comment immediately above that job or step. Put a property-specific +comment inside the mapping immediately above the affected property. Update or remove the comment +when the design changes. + +## Vertical spacing + +Use one blank line between sibling job mappings and between sibling step list items. When a leading +comment explains the next sibling job or step, put the sibling-separating blank line before that +comment and keep the comment attached to the item. This blank-before-comment rule does not apply to +a property-specific comment inside one mapping: for example, a runner rationale may follow the job +`name` and sit immediately above `runs-on`. Within a job, separate `runs-on`, `permissions`, `needs`, +`if`, `outputs`, and `steps` into readable logical groups when more than one group is present. Do not +add blank lines that split a single mapping from its properties or a comment from its target. + +Review spacing in the rendered or copied consumer file as well as in a template source. YAML parsing +and actionlint do not enforce this readability contract. diff --git a/.agents/skills/github-actions-quality-check/references/repository-enforcement.md b/.agents/skills/github-actions-quality-check/references/repository-enforcement.md new file mode 100644 index 0000000..db5653a --- /dev/null +++ b/.agents/skills/github-actions-quality-check/references/repository-enforcement.md @@ -0,0 +1,158 @@ +# Repository Enforcement Recovery + +Use this flow when a default-branch ruleset is missing or lacks required +pull-request or status-check rules. Run the commands from the target +repository with authenticated `gh`; replace `OWNER/REPO`, check contexts, and +full commit SHAs with observed values. + +## Contents + +- [Inventory before changing policy](#1-inventory-before-changing-policy) +- [Apply the safe fallback ruleset](#2-apply-the-safe-fallback-ruleset) +- [Make a required-check context safe to require](#3-make-a-required-check-context-safe-to-require) +- [Restrict Actions without breaking composites](#4-restrict-actions-without-breaking-composites) +- [Create or complete the default ruleset](#5-create-or-complete-the-default-ruleset) +- [Verify the stored policy](#6-verify-the-stored-policy) + +## 1. Inventory before changing policy + +```powershell +$repo = 'OWNER/REPO' +gh api "repos/$repo" --jq '{default_branch,allow_squash_merge,allow_merge_commit,allow_rebase_merge,allow_auto_merge,allow_update_branch,delete_branch_on_merge,squash_merge_commit_title,squash_merge_commit_message}' +gh api "repos/$repo/immutable-releases" +gh api "repos/$repo/actions/permissions" +gh api "repos/$repo/actions/permissions/selected-actions" +gh api "repos/$repo/actions/permissions/workflow" +gh api "repos/$repo/rulesets" +``` + +Build a per-setting evidence map from these responses and from the read-back +after every mutation. Record the endpoint, observed value, and result as +`verified`, `unverified`, or an approved exception. Treat an unavailable +setting as unverified; do not infer a fork-workflow approval policy, merge +method, or ruleset bypass from another repository or a related setting. +For an apply request, set every requested baseline value explicitly even if +the pre-change response omitted it; for an audit-only request, retain that +omission as unverified. + +The fork-contributor approval endpoint can return `404` for personal-owner +repositories. Do not report that policy as applied in that case; record it as +unverified and use the repository settings UI or a supported API when one is +available. + +## 2. Apply the safe fallback ruleset + +When no check context has been observed on a pull request, create or update +the `default` ruleset with every other baseline rule: target the default +branch, restrict deletions and force pushes, require pull requests, allow only +squash merging, and allow repository-admin bypass only on pull requests. +Omit only `required_status_checks`; record the ruleset as incomplete and do +not claim status-check enforcement. + +Use the template in section 5 after removing its +`required_status_checks` object. For an existing ruleset, preserve unrelated +rules and send the complete reviewed replacement with `PUT`. + +## 3. Make a required-check context safe to require + +1. Add or adapt a validation workflow that runs the intended job on + `pull_request`. Add `merge_group` when the repository uses a merge queue. +2. Give the job a stable visible name, such as `Checks` or `Tests`. +3. Merge that workflow change to the default branch. +4. Open a pull request and wait for a successful run. Confirm the exact + context before adding it to the ruleset: + + ```powershell + gh pr checks --required + ``` + +Do not require a job that runs only on `push`, a release job, or a context +whose current name was not observed on a pull request. + +## 4. Restrict Actions without breaking composites + +Inventory `uses:` in workflow files and all reachable local composite actions +or reusable workflows. Preserve local actions and GitHub-owned actions; allow +only the external action or reusable-workflow names that the inventory finds. +Keep full-SHA pinning required for workflow execution, but allow each selected +name with `@*` so updating a pinned version does not require a settings change. +Do not wildcard an owner or all actions. + +Set `allowed_actions=selected`, `sha_pinning_required=true`, +`github_owned_allowed=true`, and `verified_allowed=false` explicitly during an +apply. Do not assume an omitted pre-change SHA-pinning value was already safe. + +When the inventory finds no external `uses:` reference, set selected actions +with GitHub-owned actions allowed, Marketplace verified creators disallowed, +and no `patterns_allowed[]` entries. This is a valid least-privilege result; +downloaded tools are not Action allowlist entries and still require the +separate `security-check` review. + +```powershell +gh api --method PUT "repos/$repo/actions/permissions" ` + -F enabled=true -f allowed_actions=selected -F sha_pinning_required=true + +gh api --method PUT "repos/$repo/actions/permissions/selected-actions" ` + -F github_owned_allowed=true -F verified_allowed=false ` + -f 'patterns_allowed[]=EXTERNAL_OWNER/ACTION@*' + +gh api --method PUT "repos/$repo/actions/permissions/workflow" ` + -f default_workflow_permissions=read ` + -F can_approve_pull_request_reviews=false +``` + +Repeat `patterns_allowed[]` only for additional observed external action or +reusable-workflow names. Read back all three endpoints after the change. + +## 5. Create or complete the default ruleset + +Save the following JSON as `ruleset.json` after replacing `Checks` with an +observed pull-request check context. Repository role ID `5` is the `admin` +role; its bypass mode is limited to pull requests. If no context is available, +remove the complete `required_status_checks` object and apply the fallback from +section 2. + +```json +{ + "name": "default", + "target": "branch", + "enforcement": "active", + "bypass_actors": [ + { "actor_id": 5, "actor_type": "RepositoryRole", "bypass_mode": "pull_request" } + ], + "conditions": { "ref_name": { "include": ["~DEFAULT_BRANCH"], "exclude": [] } }, + "rules": [ + { "type": "deletion" }, + { "type": "non_fast_forward" }, + { "type": "pull_request", "parameters": { "allowed_merge_methods": ["squash"] } }, + { "type": "required_status_checks", "parameters": { + "strict_required_status_checks_policy": true, + "do_not_enforce_on_create": false, + "required_status_checks": [{ "context": "Checks" }] + } } + ] +} +``` + +```powershell +gh api --method POST "repos/$repo/rulesets" --input ruleset.json +``` + +For an existing ruleset, fetch its detail before changing it. Preserve every +unrelated rule; identify extra bypass actors and other exceptions separately +instead of silently treating them as the administrator baseline. Send only the +complete, reviewed replacement to `PUT repos/$repo/rulesets/`. + +## 6. Verify the stored policy + +```powershell +gh api "repos/$repo/rulesets" --jq '.[] | select(.name == "default") | .id' +gh api "repos/$repo/rulesets/" +``` + +Confirm the target is `~DEFAULT_BRANCH`, deletion and force pushes are +restricted, pull requests allow only squash merging, the observed check is +required, and the only baseline bypass is repository-admin with +`pull_request` mode. Also read back the repository merge settings, immutable +releases, both Actions policy endpoints, and workflow token permissions; mark +every unavailable value unverified. diff --git a/.agents/skills/github-actions-quality-check/references/runner-selection.md b/.agents/skills/github-actions-quality-check/references/runner-selection.md new file mode 100644 index 0000000..06ccb59 --- /dev/null +++ b/.agents/skills/github-actions-quality-check/references/runner-selection.md @@ -0,0 +1,132 @@ +# GitHub-hosted Linux Runner Selection + +Select a runner per job from its actual resource, isolation, tool, and duration requirements. Do +not copy one workflow-wide label into every job without checking those requirements. + +## Contents + +- [Start from the oldest supported GA image](#start-from-the-oldest-supported-ga-image) +- [Prefer `ubuntu-slim` for lightweight jobs](#prefer-ubuntu-slim-for-lightweight-jobs) +- [Choose a full Ubuntu VM deliberately](#choose-a-full-ubuntu-vm-deliberately) +- [Operate image retirement as a recurring lifecycle](#operate-image-retirement-as-a-recurring-lifecycle) +- [Validate the selection](#validate-the-selection) + +## Start from the oldest supported GA image + +For a job whose output or validation establishes an OS compatibility floor, choose the oldest +versioned GitHub-hosted GA image that the `actions/runner-images` repository currently lists for the +required OS and architecture. For Ubuntu, this maximizes compatibility with older glibc consumers; +newer glibc is not generally backward-runnable on an older distribution. Apply the same +oldest-supported baseline to Windows and macOS support, while treating architecture, Xcode/Visual +Studio availability, and artifact type as separate constraints. + +Discover the label at review time; do not copy a once-current version from this Skill. Use an +explicit version label such as `ubuntu-`, `windows-`, or `macos-` so a +moving `*-latest` alias cannot silently raise the compatibility floor. Beta images do not count as +the oldest supported GA baseline and do not replace it before GA. + +An earlier support cutoff is allowed when current evidence shows that the old image prevents a +required library/toolchain, materially harms performance or reliability, creates disproportionate +maintenance cost, or cannot meet security/support obligations. Record the evidence, affected users +and artifacts, replacement image, migration checks, and announced support boundary. Convenience +alone is not evidence. + +## Prefer `ubuntu-slim` for lightweight jobs + +Use `ubuntu-slim` when all of these conditions hold: + +- The job is short-running with enough measured headroom below the fixed 15-minute limit. +- One x64 CPU, 5 GB RAM, and 14 GB storage are sufficient. +- The job works in an unprivileged container on a shared VM. +- Every required command is in the current slim image inventory or is installed explicitly from a + reviewed, pinned, integrity-checked source. +- Every external or local action used by the job is compatible with the slim environment. +- The job does not build, package, link, or validate a native artifact whose glibc/OS compatibility + floor is part of the supported product contract. + +Good candidates include repository metadata checks, issue or release API automation, small +format/lint/type/test jobs, and lightweight artifact assembly or publication. Measure the real job; +the category alone does not prove it fits. + +`ubuntu-slim` is not a smaller full VM. GitHub provisions an unprivileged container with a minimal +tool set. Do not select it for jobs that require filesystem mounts, Docker-in-Docker, low-level +kernel features, nested virtualization, emulators, or other privileged host access. Treat Docker +container actions and service containers as unsupported until current official documentation and a +representative run prove the exact use case works. The installed Docker client does not imply that +a usable Docker daemon is available. + +Avoid `ubuntu-slim` for typical heavyweight CI/CD builds, large native compilation, desktop/mobile +packaging toolchains, or jobs whose duration can approach 15 minutes. Split a genuinely lightweight +preflight or publication phase from a heavyweight build when the dependency graph remains explicit; +do not split jobs merely to claim slim usage. + +## Choose a full Ubuntu VM deliberately + +Use a standard Ubuntu VM when the job needs more CPU or memory, a full preinstalled toolchain, +privileged VM behavior, longer execution, or an OS/native ABI compatibility contract. Select the +oldest currently supported GA Ubuntu label unless a documented constraint justifies an earlier +support cutoff. Use `ubuntu-latest` only when automatically following GitHub's newest stable Ubuntu +image is an intended maintenance policy and migration risk has been accepted. + +Do not infer that `-latest` means the newest upstream Ubuntu release; it means GitHub's latest stable +hosted image and changes over time. + +## Operate image retirement as a recurring lifecycle + +GitHub supports at most two GA images plus one beta per OS family and begins deprecating the oldest +label after a newer OS image reaches GA. Treat the runner selection as maintained support data, not +a one-time YAML choice. + +1. On every runner-label change, and at least monthly while a repository uses a versioned hosted + image, review the current `actions/runner-images` **Available Images**, releases, and open pinned + **Announcement** issues. Record the review date and the oldest eligible GA label for each + supported OS/architecture family. +2. When a new GA image appears or a dated deprecation announcement names the selected image, open or + update a tracked migration item within one normal maintenance cycle. Capture the announcement + URL, announcement date, scheduled brownouts or phased withdrawal, final removal date, affected + workflows/artifacts, and the next-oldest supported replacement. +3. Validate the replacement in parallel before changing the declared support floor: dependency and + tool availability, compiler/runtime versions, native artifact compatibility, packaging, + performance, cache behavior, and representative workflow duration. +4. Set the repository's cutoff and merge the versioned-label migration before the first scheduled + brownout or other service-disruption phase. Leave at least one normal release/maintenance cycle + for rollback when the announcement lead time permits. If GitHub publishes only a final removal + date, choose an earlier internal cutoff with the same rollback window; do not wait for removal. +5. Remove the retired label and obsolete conditionals together, publish the support-boundary change + where users and maintainers expect it, and verify the first scheduled runs on the replacement. +6. Continue the monthly review on the replacement image. A completed migration starts the same + lifecycle again; it does not close runner maintenance permanently. + +The announcement begins GitHub's administrative deprecation process; brownouts and phased routing +are the operational disruption phase that repositories must precede. If an announcement provides +too little lead time for the normal cycle, migrate immediately and record the reduced validation or +rollback window rather than running into a brownout. + +Apply this lifecycle to Windows and macOS too. It is acceptable to drop an older image before GitHub +does when library/toolchain compatibility, performance, reliability, security, or maintenance +evidence justifies it, but follow the same tracked decision, parallel validation, communicated +cutoff, and post-migration verification. + +## Validate the selection + +1. Read the current GitHub-hosted runner reference and `ubuntu-slim` software inventory before a + migration. Also read `actions/runner-images` Available Images, releases, and dated Announcement + issues; runner capabilities, installed versions, and retirement dates can change. +2. Inventory shell commands, local actions, external actions, package installation, caches, + containers, services, artifacts, permissions, and expected peak resource use for each job. +3. Set `timeout-minutes` to at most 15 on a slim job. Leave operational headroom rather than using + the limit as the expected duration. +4. Run every changed slim job on a representative event. Check setup logs, action compatibility, + elapsed time, peak behavior, and outputs; a YAML-only review is insufficient. +5. Keep heavy and platform-specific jobs on the full runner they require. Record why each exception + cannot use slim so future reviews can reconsider it. +6. For every compatibility-bearing job, record why the selected version is the oldest supported GA + image or the evidence that justified an earlier support cutoff. + +Primary references: + +- +- +- +- +- diff --git a/.agents/skills/github-actions-quality-check/references/template-contract.md b/.agents/skills/github-actions-quality-check/references/template-contract.md new file mode 100644 index 0000000..150a748 --- /dev/null +++ b/.agents/skills/github-actions-quality-check/references/template-contract.md @@ -0,0 +1,52 @@ +# GitHub Actions Template Contract + +## Purpose + +Use the bundled baseline only when a repository needs event-owned source +validation. It intentionally does not define ecosystem setup, lint, test, +build, package, or release commands. + +## Files + +| Skill asset | Consumer path | Contract | +| --- | --- | --- | +| `assets/github/workflows/pull-request.yml` | `.github/workflows/pull-request.yml` | Validate proposed source and merge-queue commits; cancel superseded runs. | +| `assets/github/workflows/main.yml` | `.github/workflows/main.yml` | Revalidate the exact integrated commit; never cancel it. | +| `assets/github/actions/install-workflow-tools/action.yml` | `.github/actions/install-workflow-tools/action.yml` | Install checksum-verified ShellCheck, actionlint, and pinact in runner-temporary paths. | + +Both workflows call `.github/actions/lint-source`. Supply that action from the +ecosystem Skill or repository contract. Keep its name narrow and its commands +equal to documented clean-clone validation. + +## Allowed substitutions + +- Replace `main` only with the confirmed protected integration branch. +- Replace `ubuntu-slim` only after applying `runner-selection.md` and proving + the job needs a different image or platform. +- Replace the local `lint-source` action path with the ecosystem Skill's + repository-owned source gate when that Skill uses a more specific name. +- Pass only the ecosystem action inputs documented by that source gate, such + as a package directory or shared lockfile path. +- Add checkout inputs such as `submodules: recursive` only when the repository's + source contract requires them. +- Add a `test` job when tests require a distinct runner or responsibility. +- Add direct `needs` edges from later jobs to every required source gate. +- Update tool versions and SHA-256 values together only after `security-check` + verifies provenance, runtime behavior, exact asset, and cooldown eligibility. + +Do not combine the two entry workflows, remove `merge_group` while its checks +are required, add routine manual dispatch, enable broad write permissions, or +make consumer CI depend on an installed Skill path. + +## Adoption checks + +1. Inventory existing workflows and retire only a workflow whose full event and + lifecycle responsibility is duplicated by the new files. +2. Copy the assets and add the repository-owned `lint-source` action. +3. Name all `uses:` steps for their responsibility. +4. Apply the file, workflow, job, Composite Action, step, comment, and spacing + rules in [naming-and-readability.md](naming-and-readability.md). +5. Run ShellCheck for every standalone changed shell script, actionlint for all + workflows and local actions, and `pinact run --check --min-age 7`. +6. Observe successful pull-request and integration-branch jobs before making + their job names required status contexts. diff --git a/.agents/skills/github-actions-quality-check/references/validation-and-reporting.md b/.agents/skills/github-actions-quality-check/references/validation-and-reporting.md new file mode 100644 index 0000000..4ec6275 --- /dev/null +++ b/.agents/skills/github-actions-quality-check/references/validation-and-reporting.md @@ -0,0 +1,48 @@ +# GitHub Actions Validation and Reporting + +## Evidence categories + +Keep these categories distinct: + +- **Observed**: workflow text, action metadata, API responses, logs, and artifact + contents actually inspected. +- **Requested**: exact settings or workflow values the maintainer asked to + apply. +- **Applied**: mutations whose request or command succeeded. +- **Verified**: applied values confirmed by post-change read-back or a run of + the exact resulting workflow. +- **Unverified**: inaccessible settings, unavailable logs, unsupported + endpoints, or runs that have not occurred. +- **Exception**: an explicit maintainer decision identifying its narrow scope, + unmet gate, reason, and follow-up. + +Do not convert an unavailable source into a pass. A successful actionlint run +does not prove repository settings, runtime behavior, or artifact correctness. + +## Automated checks + +- Run actionlint across entry workflows, reusable workflows, and local actions. + Configure its ShellCheck integration only when the exact ShellCheck command is + available and record any disabled integration. +- Run ShellCheck on every changed standalone shell script and record an empty + target set when none exists. Review inline `run:` scripts through actionlint. +- Run pinact across every changed workflow and local action with + `pinact run --check --min-age 7`. Record each external action's full SHA, + version comment, publisher, provenance, and release-age evidence. +- Run repository-specific clean-clone commands through the ecosystem Skill. + Do not invent commands from workflow names. + +## Completion record + +Report: + +1. event and trust boundaries; +2. visible job graph and required-check compatibility; +3. effective workflow/job permissions and credential persistence; +4. runner selection and lifecycle evidence; +5. external action, download, and container review; +6. artifact lineage and release idempotency; +7. actionlint, ShellCheck, pinact, and ecosystem-check results separately; +8. repository-setting evidence and post-change read-back when applicable; +9. skipped checks, unavailable evidence, blockers, residual risk, and approved + exceptions. diff --git a/.agents/skills/github-workflow/README.md b/.agents/skills/github-workflow/README.md new file mode 100644 index 0000000..729ad48 --- /dev/null +++ b/.agents/skills/github-workflow/README.md @@ -0,0 +1,11 @@ +# github-workflow + +## Overview + +Create and review GitHub repository issues, pull requests, and their comments. + +## Install + +```shell +apm install aoirint/skills/.apm/skills/github-workflow +``` diff --git a/.agents/skills/github-workflow/SKILL.md b/.agents/skills/github-workflow/SKILL.md new file mode 100644 index 0000000..8fdadfb --- /dev/null +++ b/.agents/skills/github-workflow/SKILL.md @@ -0,0 +1,114 @@ +--- +name: github-workflow +description: >- + Quality-check GitHub repository issues, pull requests, reviews, replies, + comments, and squash merges. Use when creating, editing, reviewing, or + publishing GitHub collaboration artifacts; use github-actions-quality-check + for workflows, local actions, Actions policy, and required-check design. +--- + +# GitHub Workflow + +## When to Use + +Use this Skill for GitHub issue and pull-request text or operations: + +- Issue title, body, comment, or thread note: use **Issues**. +- Pull-request title, body, review, reply, thread note, or squash merge: use + **Pull requests**. + +Use `github-actions-quality-check` for workflows, local actions, Actions +repository settings, and required-check contexts. Use `security-check` for +security-sensitive content and `prose-quality-check` for nuanced prose. + +## Goals + +- Keep issue and pull-request artifacts concise and accurate. +- Disclose significant AI assistance consistently. +- Preserve repository templates and policies without inventing requirements. +- Validate exact stored text and squash-merge commit payloads. + +## Workflow + +### Issues + +1. Identify whether the artifact is an issue title, body, reply, or combined + update. For significant AI assistance, put this alert at the absolute top: + + ```markdown + > [!WARNING] + > This issue was created with assistance from LLMs. + ``` + + Use `This comment was created with assistance from LLMs.` for replies. +2. Make titles concise and specific. Keep bodies and replies concise, using + only useful sections such as `Summary`, `Details`, `Acceptance Criteria`, + `Verification`, `Notes`, `Findings`, or `Next Steps`. For bugs, state + expected and actual behavior and useful reproduction steps. +3. Write in English except for exact source material. Use bullets, backticks, + explicit uncertainty, and summaries rather than large logs or diffs. Never + describe AI-performed work as manual. +4. Add `Update Note` or `Discussion Note` only when requested. Put + `Request addressed: ...` after the required alert and before the note + heading; label inferences and omit secrets and private paths. +5. With `gh`, write Markdown to a temporary file and pass `--body-file`. + Verify stored issue bodies with `gh issue view --json body` and stored + replies when possible, then remove temporary files. + +### Pull requests + +1. Identify the artifact: title, body, review, reply, thread note, or squash + merge. For titles, enforce + `[optional scope][optional !]: ` and use + `commit-message-quality-check` for type and breaking-change notation. +2. Before drafting or replacing a body, read the current PR template and + contributor guidance. Follow only visible headings, required checkboxes, + and applicable sections. If no template exists, use + [fallback-pr-body.md](references/fallback-pr-body.md). Never infer a CLA, + contributor agreement, checklist, sign-off, or policy from the fallback. +3. For significant AI assistance, put this alert at the absolute top of PR + bodies: + + ```markdown + > [!WARNING] + > This pull request was created with assistance from LLMs. + ``` + + Use `This comment was created with assistance from LLMs.` for reviews, + replies, and thread notes. Preserve any existing alert after a blank line; + the LLM alert must appear exactly once and first. +4. Keep automated commands, CI results, non-AI manual checks, screenshots or + videos, and AI-assisted inspections distinct. Under `## Testing`, put + AI-assisted work in `### AI-assisted inspections` after automated checks + with `Request: ...` and nested `AI-assisted result: ...`. State skipped + verification and never describe AI work as manual. +5. Use `Update Note`, `Discussion Note`, or `Review Note` only when requested. + Put `Request addressed: ...` after the required alert; group retrospective + notes by meaningful theme, label inferences, and omit secrets, private + paths, and hidden reasoning. +6. Before writing an AI-assisted body or comment, run + `scripts/check_llm_disclosure.py` against the candidate. For a + disclosure-only repair, pass the exact prior body. After writing, fetch the + complete JSON response and run the helper against that response and the + candidate. For multi-artifact work, preflight every candidate, verify each + write immediately, audit all targets at the end, and report success only + when every target has exactly one required top alert and a matching body. +7. With `gh`, use `--body-file`. Verify the complete JSON `body` as one string + against the candidate, allowing only terminal-newline normalization. In + PowerShell, do not assign line-oriented `--jq` output when verifying + multiline bodies. Remove temporary files. +8. Before `gh pr merge` creates a squash or merge commit, resolve and pass the + exact head SHA with `--match-head-commit`. Build and validate the exact + multiline candidate commit message in a file with + `git interpret-trailers --parse`, require each expected trailer exactly + once, test the stored-message JSON parser with a fixture, merge with the + same body file, then verify `commit.message` from + `repos/{owner}/{repo}/commits/{sha}` using raw JSON. Treat post-merge + verification as secondary to pre-mutation validation. + +## Resources + +- [fallback-pr-body.md](references/fallback-pr-body.md): fallback PR template + when no repository template applies. +- `scripts/check_llm_disclosure.py`: validate required LLM disclosure, + disclosure-only repairs, and stored-body preservation. diff --git a/.agents/skills/github-workflow/agents/openai.yaml b/.agents/skills/github-workflow/agents/openai.yaml new file mode 100644 index 0000000..f845d95 --- /dev/null +++ b/.agents/skills/github-workflow/agents/openai.yaml @@ -0,0 +1,4 @@ +interface: + display_name: "GitHub Workflow" + short_description: "Review GitHub issues and pull requests." + default_prompt: "Use $github-workflow to create, review, or update a GitHub issue or pull request." diff --git a/.agents/skills/github-workflow/references/fallback-pr-body.md b/.agents/skills/github-workflow/references/fallback-pr-body.md new file mode 100644 index 0000000..9819b19 --- /dev/null +++ b/.agents/skills/github-workflow/references/fallback-pr-body.md @@ -0,0 +1,164 @@ +# Fallback Pull Request Body + +Use this fallback only when the repository has no applicable pull request +template. If a repository template exists, the live template takes precedence. +Apply repository-specific requirements only when they are present in current +repository guidance. Do not infer a CLA, checklist, sign-off, or other policy +from this generic scaffold. + +## Contents + +- [Fallback Scaffold](#fallback-scaffold) + +## Fallback Scaffold + +Keep the universal headings below. When a section has no applicable content, +write `None` or `Not applicable` instead of removing the heading. Add a +repository-specific section only when current repository guidance requires it. + +````markdown + + +## Summary + + + +## Related Issues + + + +## Notes for reviewers + + + +### Proposed merge attribution + + + +### AI disclosure + + + +## Testing + + + +```` diff --git a/.agents/skills/github-workflow/scripts/check_llm_disclosure.py b/.agents/skills/github-workflow/scripts/check_llm_disclosure.py new file mode 100644 index 0000000..9f0533b --- /dev/null +++ b/.agents/skills/github-workflow/scripts/check_llm_disclosure.py @@ -0,0 +1,148 @@ +#!/usr/bin/env python3 +"""Validate required LLM disclosure and pull-request body preservation.""" + +from __future__ import annotations + +import argparse +import json +import sys +from pathlib import Path + + +DISCLOSURES = { + "pull-request": ( + "> [!WARNING]\n" + "> This pull request was created with assistance from LLMs." + ), + "comment": ( + "> [!WARNING]\n" + "> This comment was created with assistance from LLMs." + ), +} + + +def read_text(path: Path) -> str: + with path.open("r", encoding="utf-8", newline="") as stream: + return stream.read() + + +def read_body(args: argparse.Namespace) -> str: + if args.body_file is not None: + return read_text(args.body_file) + + with args.body_json_file.open("r", encoding="utf-8", newline="") as stream: + document = json.load(stream) + if not isinstance(document, dict) or not isinstance(document.get("body"), str): + raise ValueError("JSON must contain one string-valued 'body' property") + return document["body"] + + +def disclosure_prefixes(disclosure: str) -> tuple[str, str]: + lf_prefix = disclosure + "\n\n" + crlf_prefix = disclosure.replace("\n", "\r\n") + "\r\n\r\n" + return lf_prefix, crlf_prefix + + +def matches_candidate(body: str, candidate: str) -> bool: + """Compare bodies, permitting only one terminal newline representation.""" + if body == candidate: + return True + + def without_terminal_newline(value: str) -> str: + if value.endswith("\r\n"): + return value[:-2] + if value.endswith(("\n", "\r")): + return value[:-1] + return value + + return without_terminal_newline(body) == without_terminal_newline(candidate) + + +def validate(args: argparse.Namespace) -> list[str]: + body = read_body(args) + disclosure = DISCLOSURES[args.kind] + normalized = body.replace("\r\n", "\n").replace("\r", "\n") + required_prefix = disclosure + "\n\n" + errors: list[str] = [] + + if not normalized.startswith(required_prefix): + errors.append("required LLM disclosure is not the absolute first block") + if normalized.count(disclosure) != 1: + errors.append("required LLM disclosure must appear exactly once") + + if args.prior_body_file is not None: + prior = read_text(args.prior_body_file) + raw_prefix = next( + ( + prefix + for prefix in disclosure_prefixes(disclosure) + if body.startswith(prefix) + ), + None, + ) + if raw_prefix is None or body[len(raw_prefix) :] != prior: + errors.append( + "candidate is not exactly the disclosure prefix plus the prior body" + ) + + if args.expected_body_file is not None: + expected = read_text(args.expected_body_file) + if not matches_candidate(body, expected): + errors.append( + "stored body does not match the approved candidate, allowing only " + "terminal-newline normalization" + ) + + return errors + + +def parse_args() -> argparse.Namespace: + parser = argparse.ArgumentParser() + parser.add_argument( + "--kind", + choices=tuple(DISCLOSURES), + required=True, + help="Disclosure text to require.", + ) + body = parser.add_mutually_exclusive_group(required=True) + body.add_argument("--body-file", type=Path) + body.add_argument( + "--body-json-file", + type=Path, + help="Complete JSON response containing a string-valued body property.", + ) + parser.add_argument( + "--prior-body-file", + type=Path, + help="Require a disclosure-only prefix edit that preserves this body exactly.", + ) + parser.add_argument( + "--expected-body-file", + type=Path, + help=( + "Require the body to match this approved candidate, allowing only " + "terminal-newline normalization." + ), + ) + return parser.parse_args() + + +def main() -> int: + args = parse_args() + try: + errors = validate(args) + except (OSError, UnicodeError, ValueError, json.JSONDecodeError) as error: + print(f"error: {error}", file=sys.stderr) + return 2 + + if errors: + for error in errors: + print(f"error: {error}", file=sys.stderr) + return 1 + + print("LLM disclosure and body preservation checks passed.") + return 0 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/.agents/skills/lethal-company-analyze/SKILL.md b/.agents/skills/lethal-company-analyze/SKILL.md index b081f29..27caddf 100644 --- a/.agents/skills/lethal-company-analyze/SKILL.md +++ b/.agents/skills/lethal-company-analyze/SKILL.md @@ -51,6 +51,12 @@ description: schemas. 5. Freeze analysis thresholds, binning, tie rules, sparse-cell fallbacks, folds, metrics, and uncertainty interpretation before inspecting production outcomes. +6. For an item-pool or weighted-spawn comparison, contract separately: (a) the serialized-pool weight share, (b) the + effective normal-draw share after every proved deterministic filter, replacement, reroll, or weight adjustment, and + (c) each conditional-branch share. For each endpoint, name the eligible entries, code transformation, branch + predicate, and whether its branch rate is established. Do not blend conditional branches into a normal-draw result + without their target-build rate, and do not present any draw share as an actual per-round spawned-item rate unless + attempt count, placement/instantiation outcome, and the observation window are established. ## Compute reproducibly diff --git a/.github/actions/generate-version/action.yml b/.github/actions/generate-version/action.yml index 1b0de0a..e00bedf 100644 --- a/.github/actions/generate-version/action.yml +++ b/.github/actions/generate-version/action.yml @@ -1,4 +1,4 @@ -name: Generate Version +name: Generate BepInEx version description: "Generate application and git version based on csproj version and git tags." inputs: diff --git a/.github/actions/lint-source/action.yml b/.github/actions/lint-source/action.yml index c27632d..70db1a2 100644 --- a/.github/actions/lint-source/action.yml +++ b/.github/actions/lint-source/action.yml @@ -1,4 +1,4 @@ -name: Lint source +name: Lint BepInEx source description: Run the repository's workflow, C#, and Markdown source checks. runs: diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 66e1721..55659af 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -17,19 +17,22 @@ defaults: shell: bash jobs: - lint: + checks: + name: Checks # A merged commit is validated again in this workflow. This direct # dependency is the release gate; do not replace it with workflow polling. runs-on: ubuntu-slim steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Check out integrated source + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - uses: ./.github/actions/lint-source - + - name: Run source checks + uses: ./.github/actions/lint-source plan: + name: Plan # Resolve one release identity before build mutates package source files. # Keep planning read-only so edge metadata remains reusable by its consumers. runs-on: ubuntu-slim @@ -41,7 +44,8 @@ jobs: manifest_version: ${{ steps.generate-version.outputs.manifest_version }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Check out integrated source + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false @@ -53,8 +57,9 @@ jobs: write_files: false build: + name: Build needs: - - lint + - checks - plan # Build keeps ubuntu-latest because packaging currently relies on # runner-provided shell tools such as jq and 7z. @@ -69,7 +74,8 @@ jobs: steps: # Checkout is required before generating versions because the local # composite action reads project files and fetches tags from this clone. - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Check out integrated source + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Generate version uses: ./.github/actions/generate-version @@ -79,7 +85,7 @@ jobs: app_version: ${{ needs.plan.outputs.app_version }} manifest_version: ${{ needs.plan.outputs.manifest_version }} - - name: Setup .NET + - name: Set up .NET # This shared action pins the SDK and restores the same locked graph # used by source validation. uses: ./.github/actions/setup-dotnet @@ -178,6 +184,7 @@ jobs: } >> "${GITHUB_STEP_SUMMARY}" release: + name: Release needs: - build - plan @@ -195,7 +202,8 @@ jobs: steps: # Checkout is needed even though the package is downloaded, because the # Thunderstore publisher is a repository-local composite action. - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Check out integrated source + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Download build artifact uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml index 49718ed..8abd3fc 100644 --- a/.github/workflows/pull-request.yml +++ b/.github/workflows/pull-request.yml @@ -16,13 +16,16 @@ permissions: contents: read jobs: - lint: + checks: + name: Checks # Keep proposed source validation separate from publishing privileges. runs-on: ubuntu-slim steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Check out proposed source + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - uses: ./.github/actions/lint-source + - name: Run source checks + uses: ./.github/actions/lint-source \ No newline at end of file diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index 6f0f563..2bcac5f 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -9,11 +9,11 @@ upstream license and notices continue to apply. - Source: [aoirint/skills](https://github.com/aoirint/skills), selected Skill directories under `.apm/skills/` - Pinned commit: - [`92588481a4b26cc708ed843b7d1f685a4bfa3c49`](https://github.com/aoirint/skills/tree/92588481a4b26cc708ed843b7d1f685a4bfa3c49) + [`8cedd768610d8767d160ff5b6e592bd85fd75848`](https://github.com/aoirint/skills/tree/8cedd768610d8767d160ff5b6e592bd85fd75848) - Deployed paths: selected directories under `.agents/skills/`, as recorded in `apm.lock.yaml` - License: MIT; see the - [upstream license](https://github.com/aoirint/skills/blob/92588481a4b26cc708ed843b7d1f685a4bfa3c49/LICENSE) + [upstream license](https://github.com/aoirint/skills/blob/8cedd768610d8767d160ff5b6e592bd85fd75848/LICENSE) - Copyright: Copyright (c) 2026 aoirint - Notice: the selected Skill directories contain no additional copyright or NOTICE files. diff --git a/apm.lock.yaml b/apm.lock.yaml index ab49ae4..7d7e344 100644 --- a/apm.lock.yaml +++ b/apm.lock.yaml @@ -1,12 +1,12 @@ lockfile_version: '1' -generated_at: '2026-07-26T02:34:55.222929+00:00' +generated_at: '2026-08-11T02:57:51.474130+00:00' apm_version: 0.26.0 dependencies: - repo_url: aoirint/skills name: skills host: github.com - resolved_commit: 4361f1c00e419199803f6f88a760654f486f3ae4 - resolved_ref: 4361f1c00e419199803f6f88a760654f486f3ae4 + resolved_commit: 8cedd768610d8767d160ff5b6e592bd85fd75848 + resolved_ref: 8cedd768610d8767d160ff5b6e592bd85fd75848 version: 0.0.0 package_type: apm_package deployed_files: @@ -64,6 +64,24 @@ dependencies: - .agents/skills/git-worktree-workflow/README.md - .agents/skills/git-worktree-workflow/SKILL.md - .agents/skills/git-worktree-workflow/agents/openai.yaml + - .agents/skills/github-actions-quality-check + - .agents/skills/github-actions-quality-check/README.md + - .agents/skills/github-actions-quality-check/SKILL.md + - .agents/skills/github-actions-quality-check/agents/openai.yaml + - .agents/skills/github-actions-quality-check/assets/github/actions/install-workflow-tools/action.yml + - .agents/skills/github-actions-quality-check/assets/github/workflows/main.yml + - .agents/skills/github-actions-quality-check/assets/github/workflows/pull-request.yml + - .agents/skills/github-actions-quality-check/references/naming-and-readability.md + - .agents/skills/github-actions-quality-check/references/repository-enforcement.md + - .agents/skills/github-actions-quality-check/references/runner-selection.md + - .agents/skills/github-actions-quality-check/references/template-contract.md + - .agents/skills/github-actions-quality-check/references/validation-and-reporting.md + - .agents/skills/github-workflow + - .agents/skills/github-workflow/README.md + - .agents/skills/github-workflow/SKILL.md + - .agents/skills/github-workflow/agents/openai.yaml + - .agents/skills/github-workflow/references/fallback-pr-body.md + - .agents/skills/github-workflow/scripts/check_llm_disclosure.py - .agents/skills/gitignore-workflow - .agents/skills/gitignore-workflow/README.md - .agents/skills/gitignore-workflow/SKILL.md @@ -119,18 +137,18 @@ dependencies: .agents/skills/apm-usage/scripts/propose_bootstrap_update.py: sha256:9d7d3a4292a9ad4a833f970a51cce0202f3850503d39e410c1d2fccad5eb0b58 .agents/skills/apm-usage/scripts/propose_bootstrap_update.py.lock: sha256:016afc221516f1724533f1623ec77ef8a9a80c06a1ffae431f32f5e063e59986 .agents/skills/bepinex-mono-mod-quality-check/README.md: sha256:f1cedde8c48a1aa4ebe4a57decff164fd845ba82a64ddcbe66e9fc9f349286f5 - .agents/skills/bepinex-mono-mod-quality-check/SKILL.md: sha256:cbe0d14ca7ad4e784ad16fa8c9ae1272037a6290cd9044f73eb541e7b87bbedc + .agents/skills/bepinex-mono-mod-quality-check/SKILL.md: sha256:04e705a02609eae4381990026cfac4c781507f685fa974894fd9c7a8c4e5510e .agents/skills/bepinex-mono-mod-quality-check/agents/openai.yaml: sha256:a4d486e33ec1ce652ec78ffbc6c783b8005bd30202716385aaf5b5b686451cf7 .agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/check-apm-project/action.yml: sha256:108bc5e9964026880fb49086728f8458b16174f33636dea79276bd286505bbd4 - .agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/generate-version/action.yml: sha256:38f0bad4357f2650b9da6e0b23eaaa5e855695635ede31a9d170f7ba4d20a150 + .agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/generate-version/action.yml: sha256:25e36715934dfa58aa2fca8947512f6b87eddae1b2b1fdb7961aeef3e51da065 .agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/install-workflow-tools/action.yml.template: sha256:8f881f57add1754f54fcdd59eed60a174f1cdcd240dfba708eafb4ec95cc6ecc - .agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/lint-source/action.yml.template: sha256:b00bb7dcd936ea572c8186fb43f8ca69ee2b2bf714711ace27cefa3eb994ac72 - .agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/publish-thunderstore/action.yml: sha256:aa75302334d13b50b76696e3759f1b0723f2262ae724103bb01515713d311329 + .agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/lint-source/action.yml.template: sha256:3331b5c9bb9dc32eaae28fae75ca246b6cfbb20f71e5a1f5023118018c5597e3 + .agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/publish-thunderstore/action.yml: sha256:dd877b537d3e23fb4fd44f63dd8a2f5805a38ee5b9ccbe55c395e05c1e3b0924 .agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/publish-thunderstore/publish-thunderstore.sh: sha256:1801d6c68370a3c0de36d3910f6e9cbc319654669974365f8f52df759ee16023 .agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/setup-dotnet/action.yml.template: sha256:a2d07a4b0b215b444a34fa99b80b3f00297db02e9c8440be2805c63bba39e040 .agents/skills/bepinex-mono-mod-quality-check/assets/github/pull_request_template.md: sha256:49963f5d04444593df31b14f9e8ef7640893fb6fa0014d10160b7560ed7d700f - .agents/skills/bepinex-mono-mod-quality-check/assets/github/workflows/main.yml.template: sha256:09876b3e4253ab3cd03538252ae14752f85c4b0f9591eeb272ab10ddc7efeb19 - .agents/skills/bepinex-mono-mod-quality-check/assets/github/workflows/pull-request.yml.template: sha256:b4ff31aed4a8f4b5362ffa3def1b69fb4e3fdf80c6631f60179a9d45c11f36c1 + .agents/skills/bepinex-mono-mod-quality-check/assets/github/workflows/main.yml.template: sha256:a87909b2b8e00a0bd090bf5ec0e81ce5eb4e710e53e55c6d9bb60ba973186176 + .agents/skills/bepinex-mono-mod-quality-check/assets/github/workflows/pull-request.yml.template: sha256:59556312bc855d8cee9be7015c256236abe79076ede1800816458f9d83f77784 .agents/skills/bepinex-mono-mod-quality-check/assets/github/workflows/workflow-variables.example.json: sha256:c75305b13481cd12efa9844325573801b8edfca9c5920b44227cc1e2e3a7a917 .agents/skills/bepinex-mono-mod-quality-check/assets/repository/.gitattributes: sha256:2b68c0cf28e58a65b9c842bb1f5733c32fe65e519c359c16b4081e8b21182e1e .agents/skills/bepinex-mono-mod-quality-check/assets/repository/.gitignore.template: sha256:aa3fc6bc8a3f1e0acd4bb87f23aeb4d5c0d9ff6b3e8a0a5d93823cd16ac59a98 @@ -139,10 +157,10 @@ dependencies: .agents/skills/bepinex-mono-mod-quality-check/assets/template-map.json: sha256:ebc85ebbd44d94f986568d5ae294c4adfa6843b59d440f1fa674fe137407891c .agents/skills/bepinex-mono-mod-quality-check/references/canonical-templates.md: sha256:268371468d41221932d1bef774325f682fa4bbe58907c5edd9915b5690c9e610 .agents/skills/bepinex-mono-mod-quality-check/references/guest-feature-authorization.md: sha256:a3fb62447f9cffb31b5f7ab767812d2c3a95998ff5154afe3cc357d02022d894 - .agents/skills/bepinex-mono-mod-quality-check/references/implementation-runbook.md: sha256:20920e7c4bf3004914507b15729302a4239c10c6d7754cd39fb213162d7beb7c - .agents/skills/bepinex-mono-mod-quality-check/references/repository-derived-baseline.md: sha256:386b0dabcc9d657c22b1654737bb9b2d9038c3e87ec9e84bd970a3af48bcf333 + .agents/skills/bepinex-mono-mod-quality-check/references/implementation-runbook.md: sha256:9ddfa8cd61174b4347bcbb62eac75f8f88dad9c3e8fdfc8f2e784284f913b55b + .agents/skills/bepinex-mono-mod-quality-check/references/repository-derived-baseline.md: sha256:17c479c44e7075c9be57325f6c608a596664265d85ea81b89b81c887dca2e350 .agents/skills/bepinex-mono-mod-quality-check/references/repository-family-alignment.md: sha256:8d88dfe1267a2aec93ad71d7b1ba4d5148c7d5ef148ee35d3cb90568f8ce6ba7 - .agents/skills/bepinex-mono-mod-quality-check/references/repository-quality-template.md: sha256:1d52944c5da892591b2539baa8eaa17877ef3b6da966815c1c0503c71629c4e3 + .agents/skills/bepinex-mono-mod-quality-check/references/repository-quality-template.md: sha256:8f3819694edf327962e62d9edabe1ccfdf7aa02dd9b268ed4f28191f9828308d .agents/skills/bepinex-mono-mod-quality-check/scripts/render_repository_files.ps1: sha256:61c5ba3f6cdc0a53d2f293e9e0bf4621f274ae34c216d6c06a27a0b6ca6e6ca0 .agents/skills/bepinex-mono-mod-quality-check/scripts/render_workflows.ps1: sha256:d9affc8359537e3fd691a8283cbaa39cc992044138018215e2713c39ebe53232 .agents/skills/bepinex-mono-mod-quality-check/scripts/sync_templates.ps1: sha256:15386224ed6d16041afb6008fc51a1735edc86dc4566aa3f573594392925ab70 @@ -158,11 +176,27 @@ dependencies: .agents/skills/git-worktree-workflow/README.md: sha256:fa6483b5919a01b84fa0d6ffcbaae20b84ed3807e18029e8807e61b0ee4f9de9 .agents/skills/git-worktree-workflow/SKILL.md: sha256:67e2474b9878cc6cb209ae30b19c233f65969abe5b5d543f0c9a16e46f1d40d2 .agents/skills/git-worktree-workflow/agents/openai.yaml: sha256:3eb9da73e7a041e77d82f0d5c3a8c67e914575cff8651b71d077db30fe3da99a + .agents/skills/github-actions-quality-check/README.md: sha256:1c9cb3b29bb4c99e3a2e87b1b79a6eee30470c8762b2cdb5f82cb61387176d86 + .agents/skills/github-actions-quality-check/SKILL.md: sha256:08e6ae783d3b18e3924226ead2f1fe93af67ca15ca1d478c2653c46fa868ea77 + .agents/skills/github-actions-quality-check/agents/openai.yaml: sha256:505565c70b7441db1d8c17b5522b7f777acd748be441c55fdcc1f2093e185a5d + .agents/skills/github-actions-quality-check/assets/github/actions/install-workflow-tools/action.yml: sha256:8f881f57add1754f54fcdd59eed60a174f1cdcd240dfba708eafb4ec95cc6ecc + .agents/skills/github-actions-quality-check/assets/github/workflows/main.yml: sha256:2ad5a01fbcceb748ea1a1f96b4a362aa9c4f6048e4e52eb6fae2234f007f3e3e + .agents/skills/github-actions-quality-check/assets/github/workflows/pull-request.yml: sha256:8dcb30edb98ef1f108ead5579e49b3eb73aa1c2494f36b774aa836af2b267c80 + .agents/skills/github-actions-quality-check/references/naming-and-readability.md: sha256:6bebb3f2551925b38791b6ff68e9c13747a6a7387d0d58840f86fd7ca7931821 + .agents/skills/github-actions-quality-check/references/repository-enforcement.md: sha256:72f1ace12342293c036e7bf76d031f30845c99d60fb82ca7956c65866a630c9a + .agents/skills/github-actions-quality-check/references/runner-selection.md: sha256:6e9929a316ba9efbf6171366de0d1a3c976aee73d22c26b2d1ec33017af6f164 + .agents/skills/github-actions-quality-check/references/template-contract.md: sha256:bb1c89c097aac9d294237532094d3f101f8ab9dd26fc49441b9bb5e79ee74135 + .agents/skills/github-actions-quality-check/references/validation-and-reporting.md: sha256:6b3093c39d7884f4a030977f12887ddc7dba43d69a25267177d6259a4f5d4ee2 + .agents/skills/github-workflow/README.md: sha256:381a6c5fee202282fe66b35070b605c2b344f718aa63cf9b91abeca1936ab2d2 + .agents/skills/github-workflow/SKILL.md: sha256:80069c3b7ac624e4755e244350b63ffcfb20b5c397ddaa58afc4945173635766 + .agents/skills/github-workflow/agents/openai.yaml: sha256:1d8dfa53b85500f8d112c039d1c522dde129d140208c65d7145aa55e70eae329 + .agents/skills/github-workflow/references/fallback-pr-body.md: sha256:b98239e7d4cdddd8e267ab155f4e4c38fcc514526d9a32f13fcd5b21a1c07eb2 + .agents/skills/github-workflow/scripts/check_llm_disclosure.py: sha256:bc9c5cbd8efa77095eac42e53da714ed8dff86fa3b0e7870fc3e7eca1ca36e20 .agents/skills/gitignore-workflow/README.md: sha256:0de188ebcdd40ea1aec701410e1c2182049b66bc4ec4d83a3bf55685b4267d47 .agents/skills/gitignore-workflow/SKILL.md: sha256:2ef38f42e418c10e0ba7632e3ba37614df97044dfa8847ad1338e6c4c896c089 .agents/skills/gitignore-workflow/agents/openai.yaml: sha256:f6a9b176003028588ff4c1d9ee4e23c625892d00b65086bf4b6b26a3f896030d .agents/skills/lethal-company-analyze/README.md: sha256:25274fc0d0155864c4e421d315a1b91d21cc203a4c75e25a740c17f04f9387d6 - .agents/skills/lethal-company-analyze/SKILL.md: sha256:f2d523ae1129687d1b1a636d307bb7cbaa87ddd5c595c20a028f99461a039f6b + .agents/skills/lethal-company-analyze/SKILL.md: sha256:0e027f7df896d7a89b5945b9de00e0a17d514e8f9afa1e2fa6771eef1bfec3bb .agents/skills/lethal-company-analyze/agents/openai.yaml: sha256:fb80fc51dba972198601c2ec76805752f34a214bbd9a73d4bbdff7e8165ad0bf .agents/skills/lethal-company-analyze/references/efficient-full-enumeration.md: sha256:d63989945259eb66eb483fe979d51f795882a9d0c589bc06e59c7f0ce7e84bcb .agents/skills/lethal-company-analyze/references/evidence-policy.md: sha256:64af82c994a31ec2a9791342c85c53c44966af2b4ff6c9d8b779259604777b42 @@ -195,7 +229,7 @@ dependencies: .agents/skills/unity-game-analyze/references/serialized-assets.md: sha256:19401734d5381193b5cd38c2bace359d95018848b83b7f69cade906908b7a735 .agents/skills/unity-game-analyze/scripts/inventory_build.py: sha256:8b93aa49165b8f0f406321336fbe08c7383677b13d0049af76fc64ec2313bddd .agents/skills/unity-game-analyze/scripts/inventory_build.py.lock: sha256:016afc221516f1724533f1623ec77ef8a9a80c06a1ffae431f32f5e063e59986 - content_hash: sha256:9af2aba371779ec675b76fde4a23eef4be77607b9c4968030401d2cbe3bdaae8 + content_hash: sha256:89bcb059ff88d1855643754077a320f9c2a176fd12af88fbc9e239aa4729a17b skill_subset: - apm-usage - bepinex-mono-mod-quality-check @@ -204,11 +238,10 @@ dependencies: - commit-message-quality-check - git-worktree-workflow - github-actions-quality-check + - github-workflow - gitignore-workflow - - issue-quality-check - lethal-company-analyze - prose-quality-check - - pull-request-quality-check - release-note-workflow - rollout-workflow - security-check @@ -323,7 +356,7 @@ deployments: owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:cbe0d14ca7ad4e784ad16fa8c9ae1272037a6290cd9044f73eb541e7b87bbedc + content_hash: sha256:04e705a02609eae4381990026cfac4c781507f685fa974894fd9c7a8c4e5510e - kind: project-relative target: codex value: .agents/skills/bepinex-mono-mod-quality-check/agents/openai.yaml @@ -350,7 +383,7 @@ deployments: owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:38f0bad4357f2650b9da6e0b23eaaa5e855695635ede31a9d170f7ba4d20a150 + content_hash: sha256:25e36715934dfa58aa2fca8947512f6b87eddae1b2b1fdb7961aeef3e51da065 - kind: project-relative target: codex value: .agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/install-workflow-tools/action.yml.template @@ -368,7 +401,7 @@ deployments: owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:b00bb7dcd936ea572c8186fb43f8ca69ee2b2bf714711ace27cefa3eb994ac72 + content_hash: sha256:3331b5c9bb9dc32eaae28fae75ca246b6cfbb20f71e5a1f5023118018c5597e3 - kind: project-relative target: codex value: .agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/publish-thunderstore/action.yml @@ -377,7 +410,7 @@ deployments: owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:aa75302334d13b50b76696e3759f1b0723f2262ae724103bb01515713d311329 + content_hash: sha256:dd877b537d3e23fb4fd44f63dd8a2f5805a38ee5b9ccbe55c395e05c1e3b0924 - kind: project-relative target: codex value: .agents/skills/bepinex-mono-mod-quality-check/assets/github/actions/publish-thunderstore/publish-thunderstore.sh @@ -413,7 +446,7 @@ deployments: owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:09876b3e4253ab3cd03538252ae14752f85c4b0f9591eeb272ab10ddc7efeb19 + content_hash: sha256:a87909b2b8e00a0bd090bf5ec0e81ce5eb4e710e53e55c6d9bb60ba973186176 - kind: project-relative target: codex value: .agents/skills/bepinex-mono-mod-quality-check/assets/github/workflows/pull-request.yml.template @@ -422,7 +455,7 @@ deployments: owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:b4ff31aed4a8f4b5362ffa3def1b69fb4e3fdf80c6631f60179a9d45c11f36c1 + content_hash: sha256:59556312bc855d8cee9be7015c256236abe79076ede1800816458f9d83f77784 - kind: project-relative target: codex value: .agents/skills/bepinex-mono-mod-quality-check/assets/github/workflows/workflow-variables.example.json @@ -503,7 +536,7 @@ deployments: owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:20920e7c4bf3004914507b15729302a4239c10c6d7754cd39fb213162d7beb7c + content_hash: sha256:9ddfa8cd61174b4347bcbb62eac75f8f88dad9c3e8fdfc8f2e784284f913b55b - kind: project-relative target: codex value: .agents/skills/bepinex-mono-mod-quality-check/references/repository-derived-baseline.md @@ -512,7 +545,7 @@ deployments: owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:386b0dabcc9d657c22b1654737bb9b2d9038c3e87ec9e84bd970a3af48bcf333 + content_hash: sha256:17c479c44e7075c9be57325f6c608a596664265d85ea81b89b81c887dca2e350 - kind: project-relative target: codex value: .agents/skills/bepinex-mono-mod-quality-check/references/repository-family-alignment.md @@ -530,7 +563,7 @@ deployments: owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:1d52944c5da892591b2539baa8eaa17877ef3b6da966815c1c0503c71629c4e3 + content_hash: sha256:8f3819694edf327962e62d9edabe1ccfdf7aa02dd9b268ed4f28191f9828308d - kind: project-relative target: codex value: .agents/skills/bepinex-mono-mod-quality-check/scripts/render_repository_files.ps1 @@ -702,6 +735,168 @@ deployments: - aoirint/skills active_owner: aoirint/skills content_hash: sha256:3eb9da73e7a041e77d82f0d5c3a8c67e914575cff8651b71d077db30fe3da99a +- kind: project-relative + target: codex + value: .agents/skills/github-actions-quality-check + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: null +- kind: project-relative + target: codex + value: .agents/skills/github-actions-quality-check/README.md + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: sha256:1c9cb3b29bb4c99e3a2e87b1b79a6eee30470c8762b2cdb5f82cb61387176d86 +- kind: project-relative + target: codex + value: .agents/skills/github-actions-quality-check/SKILL.md + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: sha256:08e6ae783d3b18e3924226ead2f1fe93af67ca15ca1d478c2653c46fa868ea77 +- kind: project-relative + target: codex + value: .agents/skills/github-actions-quality-check/agents/openai.yaml + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: sha256:505565c70b7441db1d8c17b5522b7f777acd748be441c55fdcc1f2093e185a5d +- kind: project-relative + target: codex + value: .agents/skills/github-actions-quality-check/assets/github/actions/install-workflow-tools/action.yml + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: sha256:8f881f57add1754f54fcdd59eed60a174f1cdcd240dfba708eafb4ec95cc6ecc +- kind: project-relative + target: codex + value: .agents/skills/github-actions-quality-check/assets/github/workflows/main.yml + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: sha256:2ad5a01fbcceb748ea1a1f96b4a362aa9c4f6048e4e52eb6fae2234f007f3e3e +- kind: project-relative + target: codex + value: .agents/skills/github-actions-quality-check/assets/github/workflows/pull-request.yml + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: sha256:8dcb30edb98ef1f108ead5579e49b3eb73aa1c2494f36b774aa836af2b267c80 +- kind: project-relative + target: codex + value: .agents/skills/github-actions-quality-check/references/naming-and-readability.md + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: sha256:6bebb3f2551925b38791b6ff68e9c13747a6a7387d0d58840f86fd7ca7931821 +- kind: project-relative + target: codex + value: .agents/skills/github-actions-quality-check/references/repository-enforcement.md + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: sha256:72f1ace12342293c036e7bf76d031f30845c99d60fb82ca7956c65866a630c9a +- kind: project-relative + target: codex + value: .agents/skills/github-actions-quality-check/references/runner-selection.md + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: sha256:6e9929a316ba9efbf6171366de0d1a3c976aee73d22c26b2d1ec33017af6f164 +- kind: project-relative + target: codex + value: .agents/skills/github-actions-quality-check/references/template-contract.md + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: sha256:bb1c89c097aac9d294237532094d3f101f8ab9dd26fc49441b9bb5e79ee74135 +- kind: project-relative + target: codex + value: .agents/skills/github-actions-quality-check/references/validation-and-reporting.md + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: sha256:6b3093c39d7884f4a030977f12887ddc7dba43d69a25267177d6259a4f5d4ee2 +- kind: project-relative + target: codex + value: .agents/skills/github-workflow + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: null +- kind: project-relative + target: codex + value: .agents/skills/github-workflow/README.md + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: sha256:381a6c5fee202282fe66b35070b605c2b344f718aa63cf9b91abeca1936ab2d2 +- kind: project-relative + target: codex + value: .agents/skills/github-workflow/SKILL.md + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: sha256:80069c3b7ac624e4755e244350b63ffcfb20b5c397ddaa58afc4945173635766 +- kind: project-relative + target: codex + value: .agents/skills/github-workflow/agents/openai.yaml + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: sha256:1d8dfa53b85500f8d112c039d1c522dde129d140208c65d7145aa55e70eae329 +- kind: project-relative + target: codex + value: .agents/skills/github-workflow/references/fallback-pr-body.md + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: sha256:b98239e7d4cdddd8e267ab155f4e4c38fcc514526d9a32f13fcd5b21a1c07eb2 +- kind: project-relative + target: codex + value: .agents/skills/github-workflow/scripts/check_llm_disclosure.py + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: sha256:bc9c5cbd8efa77095eac42e53da714ed8dff86fa3b0e7870fc3e7eca1ca36e20 - kind: project-relative target: codex value: .agents/skills/gitignore-workflow @@ -764,7 +959,7 @@ deployments: owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:f2d523ae1129687d1b1a636d307bb7cbaa87ddd5c595c20a028f99461a039f6b + content_hash: sha256:0e027f7df896d7a89b5945b9de00e0a17d514e8f9afa1e2fa6771eef1bfec3bb - kind: project-relative target: codex value: .agents/skills/lethal-company-analyze/agents/openai.yaml diff --git a/apm.yml b/apm.yml index 906a09b..67018a3 100644 --- a/apm.yml +++ b/apm.yml @@ -12,7 +12,7 @@ targets: dependencies: apm: - git: aoirint/skills - ref: 4361f1c00e419199803f6f88a760654f486f3ae4 + ref: 8cedd768610d8767d160ff5b6e592bd85fd75848 skills: - apm-usage - bepinex-mono-mod-quality-check @@ -22,10 +22,9 @@ dependencies: - git-worktree-workflow - github-actions-quality-check - gitignore-workflow - - issue-quality-check + - github-workflow - lethal-company-analyze - prose-quality-check - - pull-request-quality-check - release-note-workflow - rollout-workflow - security-check