Skip to content

Make BAML agent skill installs reproducible #3753

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rossirpaulo merged 2 commits into from
Jun 12, 2026
Merged

Make BAML agent skill installs reproducible #3753

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
48f63dc
Make agent skill installs reproducible
rossirpaulo Jun 12, 2026
ffa77d8
Address agent skills packaging feedback
rossirpaulo Jun 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
85 changes: 70 additions & 15 deletions .github/workflows/release-baml-language.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ env:
AWS_REGION: us-east-1
AWS_ROLE_ARN: arn:aws:iam::277707123528:role/pkg-boundaryml-com-github-release
PKG_BUCKET: pkgboundarymlcomstack-pkgboundarymlcomsitebucket4f-ybhvygkqittp
BAML_AGENT_SKILLS_REPOSITORY: BoundaryML/baml-skill

jobs:
plan:
Expand Down Expand Up @@ -284,6 +285,38 @@ jobs:
name: baml-vscode-vsix
path: typescript2/app-vscode-ext/*.vsix

build-agent-skills:
name: Build agent skills
needs: [plan]
runs-on: ubuntu-latest
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Resolved
steps:
- uses: actions/checkout@v4
with:
ref: ${{ needs.plan.outputs.source_sha }}
persist-credentials: false
- uses: actions/checkout@v4
with:
repository: ${{ env.BAML_AGENT_SKILLS_REPOSITORY }}
path: agent-skills-source
persist-credentials: false
- name: Package agent skills
env:
VERSION: ${{ needs.plan.outputs.version }}
run: |
set -euo pipefail
scripts/package-agent-skills \
--source agent-skills-source \
--version "$VERSION" \
--out-dir dist/agent-skills

archive="dist/agent-skills/baml-agent-skills-$VERSION.tar.gz"
tar -tzf "$archive" | tee agent-skills-list.txt
grep -E '/SKILL\.md$' agent-skills-list.txt
- uses: actions/upload-artifact@v4
with:
name: agent-skills
path: dist/agent-skills/*

build-wrapper:
name: Build wrapper (${{ matrix.target }})
needs: [plan]
Expand Down Expand Up @@ -389,6 +422,7 @@ jobs:
- build-wrapper
- build-python-sdk
- build-nodejs-sdk
- build-agent-skills
steps:
- run: echo "all release build jobs completed"

Expand Down Expand Up @@ -441,9 +475,9 @@ jobs:
source_sha: ${{ needs.plan.outputs.source_sha }}
channel: ${{ needs.plan.outputs.channel }}

publish-github-release:
name: Publish GitHub release assets
needs: [plan, all-builds]
publish-toolchain-release:
name: Publish toolchain release assets
needs: [plan, all-builds, build-agent-skills]
if: ${{ needs.plan.outputs.dry_run == 'false' && needs.plan.outputs.source_branch == 'canary' }}
runs-on: ubuntu-latest
env:
Expand All @@ -456,15 +490,14 @@ jobs:
pattern: toolchain-*
path: dist/toolchain
merge-multiple: true
- uses: actions/download-artifact@v4
with:
pattern: wrapper-*
path: dist/wrapper
merge-multiple: true
- uses: actions/download-artifact@v4
with:
name: baml-vscode-vsix
path: dist/vsix
- uses: actions/download-artifact@v4
with:
name: agent-skills
path: dist/agent-skills
- name: Generate checksum sidecars
run: |
set -euo pipefail
Expand All @@ -480,14 +513,36 @@ jobs:
run: |
set -euo pipefail
if gh release view "$TAG" >/dev/null 2>&1; then
gh release upload "$TAG" dist/toolchain/* dist/vsix/* --clobber
gh release upload "$TAG" dist/toolchain/* dist/vsix/* dist/agent-skills/* --clobber
else
gh release create "$TAG" dist/toolchain/* dist/vsix/* \
gh release create "$TAG" dist/toolchain/* dist/vsix/* dist/agent-skills/* \
--title "BAML Language $VERSION" \
--notes "BAML language toolchain $VERSION"
fi

publish-wrapper-release:
name: Publish wrapper release assets
needs: [plan, all-builds]
if: ${{ needs.plan.outputs.wrapper_changed == 'true' && needs.plan.outputs.dry_run == 'false' && needs.plan.outputs.source_branch == 'canary' }}
runs-on: ubuntu-latest
env:
GH_REPO: ${{ github.repository }}
permissions:
contents: write
steps:
- uses: actions/download-artifact@v4
with:
pattern: wrapper-*
path: dist/wrapper
merge-multiple: true
- name: Generate checksum sidecars
run: |
set -euo pipefail
find dist/wrapper -type f \( -name '*.tar.gz' -o -name '*.zip' \) -print0 |
while IFS= read -r -d '' file; do
(cd "$(dirname "$file")" && sha256sum "$(basename "$file")" > "$(basename "$file").sha256")
done
- name: Publish wrapper release
if: ${{ needs.plan.outputs.wrapper_changed == 'true' }}
env:
GH_TOKEN: ${{ github.token }}
WRAPPER_VERSION: ${{ needs.plan.outputs.wrapper_version }}
Expand All @@ -504,8 +559,8 @@ jobs:

publish-pkg-boundaryml-com:
name: Publish pkg.boundaryml.com manifests
needs: [plan, all-builds, publish-pypi, publish-nodejs-sdk, publish-github-release, publish-homebrew, publish-aur]
if: ${{ always() && needs.plan.outputs.dry_run == 'false' && needs.plan.outputs.source_branch == 'canary' && needs.publish-pypi.result == 'success' && needs.publish-nodejs-sdk.result == 'success' && needs.publish-github-release.result == 'success' && (needs.plan.outputs.wrapper_changed != 'true' || (needs.publish-homebrew.result == 'success' && needs.publish-aur.result == 'success')) }}
needs: [plan, all-builds, publish-pypi, publish-nodejs-sdk, publish-toolchain-release, publish-wrapper-release, publish-homebrew, publish-aur]
if: ${{ always() && needs.plan.outputs.dry_run == 'false' && needs.plan.outputs.source_branch == 'canary' && needs.publish-pypi.result == 'success' && needs.publish-nodejs-sdk.result == 'success' && needs.publish-toolchain-release.result == 'success' && (needs.plan.outputs.wrapper_changed != 'true' || (needs.publish-wrapper-release.result == 'success' && needs.publish-homebrew.result == 'success' && needs.publish-aur.result == 'success')) }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
Expand Down Expand Up @@ -624,7 +679,7 @@ jobs:

publish-homebrew:
name: Publish Homebrew wrapper formula
needs: [plan, all-builds, publish-github-release]
needs: [plan, all-builds, publish-wrapper-release]
if: ${{ needs.plan.outputs.wrapper_changed == 'true' && needs.plan.outputs.dry_run == 'false' && needs.plan.outputs.source_branch == 'canary' }}
runs-on: ubuntu-latest
steps:
Expand Down Expand Up @@ -662,7 +717,7 @@ jobs:

publish-aur:
name: Publish AUR wrapper packages
needs: [plan, all-builds, publish-github-release]
needs: [plan, all-builds, publish-wrapper-release]
if: ${{ needs.plan.outputs.wrapper_changed == 'true' && needs.plan.outputs.dry_run == 'false' && needs.plan.outputs.source_branch == 'canary' }}
runs-on: ubuntu-latest
steps:
Expand Down
Loading
Loading