Make BAML agent skill installs reproducible - #3753

baml_language/crates/baml_cli/src/agent_command.rs (1)

410-417: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

SKILL.md frontmatter parsing is LF-only.

split_frontmatter() only accepts ---\n / \n---\n, so --from on a Windows checkout or archive with CRLF SKILL.md files fails with “missing opening frontmatter marker”. The new packaging script has the same delimiter assumption, so the local package/install path breaks end-to-end on CRLF inputs.

Suggested fix

 fn split_frontmatter(content: &str) -> Result<(&str, &str)> {
     let rest = content
-        .strip_prefix("---\n")
+        .strip_prefix("---\r\n")
+        .or_else(|| content.strip_prefix("---\n"))
         .ok_or_else(|| anyhow!("SKILL.md is missing opening frontmatter marker"))?;
-    let Some((frontmatter, body)) = rest.split_once("\n---\n") else {
+    let Some((frontmatter, body)) = rest
+        .split_once("\r\n---\r\n")
+        .or_else(|| rest.split_once("\n---\n"))
+    else {
         anyhow::bail!("SKILL.md is missing closing frontmatter marker");
     };
     Ok((frontmatter, body))
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@baml_language/crates/baml_cli/src/agent_command.rs` around lines 410 - 417,
The split_frontmatter function currently matches only LF delimiters and fails on
CRLF files; update split_frontmatter to tolerate CRLF by normalizing input line
endings (replace "\r\n" with "\n" at function start) or by checking both "\n"
and "\r\n" variants for the opening ("---\n" / "---\r\n") and closing ("\n---\n"
/ "\r\n---\r\n") markers; ensure you still return the frontmatter and body as
&str slices consistently (adjust logic in split_frontmatter to operate on the
normalized string or to compute offsets so returned slices refer to the correct
underlying data).

scripts/package-agent-skills (1)

136-141: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Direct-layout skill discovery is depth-mismatched and misses valid SKILL.md files.

At Line 141, find "$source_dir/skills" -mindepth 2 -maxdepth 2 ... -path '*/baml-*/SKILL.md' cannot match skills/*/baml-*/SKILL.md because those files are depth 3 under skills. This will skip direct-layout skills and can incorrectly trigger the "no BAML agent skills found" failure.

Suggested minimal fix

-  done < <(find "$source_dir/skills" -mindepth 2 -maxdepth 2 -type f -path '*/baml-*/SKILL.md' -print0 | sort -z)
+  done < <(find "$source_dir/skills" -mindepth 3 -maxdepth 3 -type f -path '*/baml-*/SKILL.md' -print0 | sort -z)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/package-agent-skills` around lines 136 - 141, The find invocation
that discovers SKILL.md uses -mindepth 2 -maxdepth 2 and -path
'*/baml-*/SKILL.md', which misses direct-layout skills located at
skills/*/baml-*/SKILL.md (depth 3). Update the find call used for skill
discovery (the one piping into the while loop that reads skill_file and calls
stage_skill) to include depth 3 results (e.g., change -mindepth/-maxdepth to 3
or remove the depth limits) or add an alternative -path clause to also match
*/*/baml-*/SKILL.md so stage_skill will be invoked for those SKILL.md files and
count will reflect them.

.github/workflows/release-baml-language.yml (1)

297-301: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Pin BAML_AGENT_SKILLS_REPOSITORY checkout to an immutable ref.

This checkout currently follows the repository default branch, so reruns for the same release version can package different skill contents. That undermines reproducibility for the versioned baml-agent-skills-*.tar.gz artifact. Please use an immutable tag or commit SHA (ideally emitted by the release plan) via ref:.

🔧 Suggested direction

       - uses: actions/checkout@v4
         with:
           repository: ${{ env.BAML_AGENT_SKILLS_REPOSITORY }}
+          ref: ${{ needs.plan.outputs.agent_skills_ref }} # immutable tag or commit SHA
           path: agent-skills-source
           persist-credentials: false

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release-baml-language.yml around lines 297 - 301, The
checkout step using actions/checkout@v4 for repository ${{
env.BAML_AGENT_SKILLS_REPOSITORY }} is not pinned to an immutable ref, causing
non-reproducible artifact contents; update the checkout step (the
actions/checkout@v4 invocation that sets path: agent-skills-source) to include a
ref: that points to an immutable tag or commit SHA emitted by the release plan
(e.g. use a new env like BAML_AGENT_SKILLS_REF or the release SHA) so the
workflow always checks out the exact revision used to build
baml-agent-skills-*.tar.gz.