From 5416684180fcbd581219ffd44c4dd81f91e0b68c Mon Sep 17 00:00:00 2001 From: aoirint Date: Tue, 11 Aug 2026 12:24:26 +0900 Subject: [PATCH] build(apm): roll out artifact-link guidance Deploy the GitHub artifact-link requirement and preserve existing required status-check contexts. Co-authored-by: Codex --- .agents/skills/docker-quality-check/SKILL.md | 20 +- .../github/actions/lint-docker/action.yml | 26 +++ .../assets/github/workflows/main.yml | 53 ++++++ .../assets/github/workflows/pull-request.yml | 32 ++++ .../references/ci-template-contract.md | 47 +++++ .agents/skills/github-workflow/README.md | 2 +- .agents/skills/github-workflow/SKILL.md | 180 +++--------------- .../skills/github-workflow/agents/openai.yaml | 4 +- .../references/repository-enforcement.md | 158 --------------- .../references/runner-selection.md | 132 ------------- .agents/skills/python-quality-check/SKILL.md | 17 +- .../references/ci-and-distribution.md | 21 +- .../references/tooling-and-testing.md | 18 +- THIRD_PARTY_NOTICES.md | 4 +- apm.lock.yaml | 102 ++++++---- apm.yml | 2 +- 16 files changed, 286 insertions(+), 532 deletions(-) create mode 100644 .agents/skills/docker-quality-check/assets/github/actions/lint-docker/action.yml create mode 100644 .agents/skills/docker-quality-check/assets/github/workflows/main.yml create mode 100644 .agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml create mode 100644 .agents/skills/docker-quality-check/references/ci-template-contract.md delete mode 100644 .agents/skills/github-workflow/references/repository-enforcement.md delete mode 100644 .agents/skills/github-workflow/references/runner-selection.md diff --git a/.agents/skills/docker-quality-check/SKILL.md b/.agents/skills/docker-quality-check/SKILL.md index 95b8ab2..3f627a1 100644 --- a/.agents/skills/docker-quality-check/SKILL.md +++ b/.agents/skills/docker-quality-check/SKILL.md @@ -40,7 +40,9 @@ description: >- 6. For newly introduced or updated external images, downloaded executables, or GitHub Actions, use `security-check` to assess provenance, version or digest pinning, release age, checksums, permissions, and runtime behavior. Pin GitHub Actions to - full commit SHAs with accurate version comments. + full commit SHAs with accurate version comments. Use + `github-actions-quality-check` for workflow structure, permissions, runners, + validation, and publication gates. 7. Summarize commands run, build and smoke-test results, and every skipped check with a concrete reason. @@ -50,13 +52,7 @@ When a workflow installs hadolint, pin both the release version and the SHA-256 exact platform asset. Download over HTTPS, verify the hash before making the file executable, and install it only into the runner's temporary directory. Before changing a pin, verify the official release provenance and the repository's required adoption -cooldown. - -```shell -curl -sSfLO https://github.com/hadolint/hadolint/releases/download/v2.14.0/hadolint-linux-x86_64 -echo "6bf226944684f56c84dd014e8b979d27425c0148f61b3bd99bcc6f39e9dc5a47 hadolint-linux-x86_64" | sha256sum -c - -install -m 0755 hadolint-linux-x86_64 "$RUNNER_TEMP/bin/hadolint" -``` +cooldown. Use the bundled `lint-docker` action when its single-Dockerfile contract fits. Replace the version and checksum together only after independently verifying the official release asset. Do not use a floating download URL or skip hash verification. @@ -72,3 +68,11 @@ docker compose config Replace these examples with the repository's documented file paths, build targets, tags, and Compose files. Do not treat a successful syntax check as evidence that the image builds or starts correctly. + +## CI Templates + +Read [ci-template-contract.md](references/ci-template-contract.md) before creating or +repairing Docker CI. The bundled files under `assets/github/` keep pull-request checks +limited to lint and reserve image builds for the exact integrated main-branch commit. +Apply `github-actions-quality-check` for shared event, permission, runner, pinning, and +repository-enforcement policy. diff --git a/.agents/skills/docker-quality-check/assets/github/actions/lint-docker/action.yml b/.agents/skills/docker-quality-check/assets/github/actions/lint-docker/action.yml new file mode 100644 index 0000000..568f2d9 --- /dev/null +++ b/.agents/skills/docker-quality-check/assets/github/actions/lint-docker/action.yml @@ -0,0 +1,26 @@ +name: Lint Docker source +description: Install a verified hadolint binary and lint the repository Dockerfile. + +runs: + using: composite + steps: + - name: Install checksum-verified hadolint + shell: bash + env: + HADOLINT_VERSION: v2.15.1 + HADOLINT_SHA256: c7187db94eeeeca956519a6af171adc31453941a1e777961f6e680f697c8c507 + run: |- + install_dir="${RUNNER_TEMP}/hadolint/bin" + asset="hadolint-linux-x86_64" + mkdir -p "${install_dir}" + curl --fail --location --silent --show-error \ + --output "${install_dir}/${asset}" \ + "https://github.com/hadolint/hadolint/releases/download/${HADOLINT_VERSION}/${asset}" + echo "${HADOLINT_SHA256} ${install_dir}/${asset}" | sha256sum --check --strict + mv "${install_dir}/${asset}" "${install_dir}/hadolint" + chmod 0755 "${install_dir}/hadolint" + echo "${install_dir}" >> "${GITHUB_PATH}" + + - name: Lint Dockerfile + shell: bash + run: hadolint Dockerfile diff --git a/.agents/skills/docker-quality-check/assets/github/workflows/main.yml b/.agents/skills/docker-quality-check/assets/github/workflows/main.yml new file mode 100644 index 0000000..349b5b7 --- /dev/null +++ b/.agents/skills/docker-quality-check/assets/github/workflows/main.yml @@ -0,0 +1,53 @@ +name: Main + +on: + push: + branches: + - main + +permissions: + contents: read + +concurrency: + group: main-${{ github.ref }} + cancel-in-progress: false + +jobs: + checks: + name: Checks + # Keep the lightweight gate independent from Docker daemon requirements. + runs-on: ubuntu-slim + timeout-minutes: 5 + + steps: + - name: Checkout integrated source + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Lint Docker source + uses: ./.github/actions/lint-docker + + build: + name: Build + needs: + - checks + + # Build only integrated source; proposed-source validation stays lightweight. + runs-on: ubuntu-24.04 + + steps: + - name: Checkout integrated source + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + + - name: Build Docker image without publishing + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 + with: + context: . + file: ./Dockerfile + push: false diff --git a/.agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml b/.agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml new file mode 100644 index 0000000..2dc61bd --- /dev/null +++ b/.agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml @@ -0,0 +1,32 @@ +name: Pull Request + +on: + pull_request: + branches: + - main + merge_group: + types: + - checks_requested + +permissions: + contents: read + +concurrency: + group: pull-request-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +jobs: + checks: + name: Checks + # Avoid a network-intensive image build for proposed source. + runs-on: ubuntu-slim + timeout-minutes: 5 + + steps: + - name: Checkout proposed source + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Lint Docker source + uses: ./.github/actions/lint-docker diff --git a/.agents/skills/docker-quality-check/references/ci-template-contract.md b/.agents/skills/docker-quality-check/references/ci-template-contract.md new file mode 100644 index 0000000..415c699 --- /dev/null +++ b/.agents/skills/docker-quality-check/references/ci-template-contract.md @@ -0,0 +1,47 @@ +# Docker CI Template Contract + +## Purpose + +Use the bundled baseline for a repository with one root `Dockerfile`. It keeps proposed-source +checks fast by running hadolint only. The integrated main-branch workflow repeats lint and then +builds the exact merged commit without publishing it. + +## Files + +| Skill asset | Consumer path | Contract | +| --- | --- | --- | +| `assets/github/actions/lint-docker/action.yml` | `.github/actions/lint-docker/action.yml` | Install checksum-verified hadolint and lint the root `Dockerfile`. | +| `assets/github/workflows/pull-request.yml` | `.github/workflows/pull-request.yml` | Lint pull-request and merge-queue source; cancel superseded runs. | +| `assets/github/workflows/main.yml` | `.github/workflows/main.yml` | Re-run lint and build the integrated commit; never cancel it. | + +Copy the files into the consumer repository. Consumer workflows must run committed +repository-owned files and must not execute the installed Skill at runtime. + +## Allowed substitutions + +- Replace `main` only with the confirmed protected integration branch. +- Replace the root Dockerfile path or add a lint matrix when the repository owns multiple + Dockerfiles. +- Pass repository-evidenced build contexts, Dockerfile paths, targets, build arguments, secrets, + or cache settings to the integrated build. +- Add Compose validation, tests, or smoke checks when the repository documents those contracts. +- Add registry authentication and publication only in an integration job with the minimum required + permissions and secrets. +- Make an immutable release depend directly on the published image and every required image test. +- Update external Action pins or the hadolint version and checksum only after `security-check` + verifies provenance, runtime behavior, exact identity, and cooldown eligibility. + +Do not add Docker build or publication to the pull-request workflow merely to mirror main. Do not +expose registry credentials to proposed source, rebuild an image in a release job, or create a +release before the published image passes its required tests. + +## Adoption checks + +1. Inventory existing workflow responsibilities and retire only duplicated entry workflows. +2. Apply `github-actions-quality-check` and preserve its event, permission, concurrency, runner, + and immutable-pin requirements. +3. Run hadolint locally against every selected Dockerfile. +4. Run actionlint across workflows and actions, ShellCheck against changed standalone shell + scripts, and `pinact run --check --min-age 7`. +5. Observe the Checks job on a pull request and both Checks and Build jobs on the integrated commit + before making their contexts required. diff --git a/.agents/skills/github-workflow/README.md b/.agents/skills/github-workflow/README.md index 6add917..729ad48 100644 --- a/.agents/skills/github-workflow/README.md +++ b/.agents/skills/github-workflow/README.md @@ -2,7 +2,7 @@ ## Overview -Create and review GitHub Actions workflows, repository issues, and pull requests. +Create and review GitHub repository issues, pull requests, and their comments. ## Install diff --git a/.agents/skills/github-workflow/SKILL.md b/.agents/skills/github-workflow/SKILL.md index 88fca52..9d49fb7 100644 --- a/.agents/skills/github-workflow/SKILL.md +++ b/.agents/skills/github-workflow/SKILL.md @@ -1,159 +1,39 @@ --- name: github-workflow description: >- - Quality-check GitHub Actions workflows, repository issues, pull requests, and - their comments. Use when creating, editing, reviewing, or documenting CI - automation, issue text, PR text, reviews, replies, or squash merges. + Quality-check GitHub repository issues, pull requests, reviews, replies, + comments, and squash merges. Use when creating, editing, reviewing, or + publishing GitHub collaboration artifacts; use github-actions-quality-check + for workflows, local actions, Actions policy, and required-check design. --- # GitHub Workflow ## When to Use -Use this skill to create, update, or review a GitHub artifact. First identify -the artifact and apply only its relevant workflow: +Use this Skill for GitHub issue and pull-request text or operations: -- GitHub Actions workflow, composite action, or CI policy: use **Actions**. - Issue title, body, comment, or thread note: use **Issues**. -- Pull request title, body, review, reply, thread note, or squash merge: use +- Pull-request title, body, review, reply, thread note, or squash merge: use **Pull requests**. -Use `security-check` for security- or supply-chain-sensitive content and -`prose-quality-check` for nuanced explanatory prose. +Use `github-actions-quality-check` for workflows, local actions, Actions +repository settings, and required-check contexts. Use `security-check` for +security-sensitive content and `prose-quality-check` for nuanced prose. ## Goals -- Keep automation deterministic, least-privilege, and reviewable. -- Keep issue and pull request artifacts concise, accurate, and explicitly - AI-assisted when significant AI assistance was used. -- Preserve repository templates and policies without inventing unavailable - requirements. +- Keep issue and pull-request artifacts concise and accurate. +- Disclose significant AI assistance consistently. +- Preserve repository templates and policies without inventing requirements. +- Validate exact stored text and squash-merge commit payloads. ## Workflow -### Actions - -1. Inspect changed workflow or action files and the repository guidance that - describes them. -2. Check triggers, branch filters, merge-queue behavior, and - `workflow_dispatch` against the intended responsibility. Preserve - established publication triggers and canonical version sources unless the - request explicitly replaces them. Design boundaries around events, - privilege, and lifecycle: - - A pull-request entry workflow validates untrusted proposed source and - includes `merge_group` when a merge queue uses required checks. - - An integration-branch entry workflow re-runs required validation on the - exact pushed commit. Use a read-only `plan` job only for canonical version - or publication state, and make build and publication use direct `needs` - dependencies. - - For reusable source validation, use event-owned entry workflows: a - default-branch push workflow revalidates merged source, while a separate - pull-request workflow validates proposed source and merge-queue entries. - Reuse one local Composite Action for the same-runner validation sequence. - Do not combine those push and pull-request events into one validation - workflow: their cancellation policy and source-trust boundary differ. - Retire an older entry workflow only after confirming it duplicates that - responsibility; do not remove a workflow that owns a distinct release or - integration event. - - Name jobs for visible responsibility: `lint`, optional `test`, optional - `plan`, `build`, and `release`. Use a precisely named Composite Action - only for a reusable same-runner sequence. - - Do not emulate a direct dependency with API polling, an `await-quality` - job, or an unrelated workflow. Add `workflow_dispatch` only for a - documented diagnostic or recovery operation. Use `workflow_run` only for - a separately reviewed trust boundary. -3. Check workflow and job `permissions`. Start from `contents: read`, grant - only required access, and document unusual write access. Check concurrency - groups and cancellation rules for PRs, pushes, releases, merge queues, and - publishing. Keep default-branch validation uncancelled; cancel superseded - pull-request and merge-queue runs with a group keyed by pull-request number - or ref. In read-only checkout jobs, set `persist-credentials: false` unless - a later step demonstrably needs repository credentials. -4. Check runner labels, local composite actions, expressions, comments, cache - paths, and suppressions. Read - [runner-selection.md](references/runner-selection.md) when selecting or - changing a GitHub-hosted runner. Validate action inputs against documentation - or metadata for the exact pinned version. Use a Composite Action for a - stable same-runner sequence; use a reusable workflow only when job-level - matrix, outputs, or permission boundaries require it. Before restricting an - Actions allowlist, inventory `uses:` references in entry workflows and every - reachable local composite action or reusable workflow. Retain only the - required external action or reusable-workflow names; when full-SHA pinning - is enforced, allow an individual name with `@*` so new pinned versions do - not require repository-setting changes. Do not wildcard an owner or all - actions without an approved policy. - Give every `uses:` step a responsibility-revealing `name`. Keep version comments on - the same line as full-SHA external pins in pinact format, and add concise comments - before security- or lifecycle-sensitive steps explaining the design intent rather - than restating the step name. -5. Pin third-party actions and reusable workflows to complete commit SHAs with - accurate version comments. For external actions, downloaded tools, or - containers, use `security-check` to review provenance, release age, pinning, - permissions, and runtime behavior. -6. Run documented `actionlint`, ShellCheck, and `pinact` checks. Use - `pinact run --check --min-age 7` and `GITHUB_TOKEN` when available. Check - standalone changed automation shell scripts with ShellCheck; record an empty - target scope when none exist. Record each changed external action's full SHA, - release tag, publisher/provenance, release-age result, and validation results in - the pull request or equivalent change record. -7. For publishing workflows, gate immutable publication on all required quality - and build results for the exact source commit. Retain verified build - artifacts, derive release identity from the canonical version source, make - retries idempotent, verify existing immutable releases and expected assets, - isolate credentials, and use `security-check` for final artifacts. -8. For repository enforcement, compare required status-check contexts with - current workflow job names and verify integration freshness, merge-queue - compatibility, release immutability, tag rules, Actions permissions, and - protected environments. Unless an approved repository policy intentionally - differs, require these repository settings: - - Enable release immutability. - - Allow squash merging only; use `Pull request title` as the default squash - commit-message format. - - Always suggest updating pull request branches, allow auto-merge, and - automatically delete head branches. - - Allow actions and reusable workflows from the repository owner and - selected non-owner publishers only; require every action and reusable - workflow to be pinned to a full-length commit SHA. - - Default `GITHUB_TOKEN` permissions to read repository contents and - packages, and do not allow GitHub Actions to create or approve pull - requests. - - Require approval before fork pull-request workflows run for every - external contributor. - - Maintain a default-branch ruleset named `default` that targets the - default branch, allows repository-admin bypass only through pull - requests, restricts deletions, - requires pull requests before merging with squash as the only allowed - merge method, requires status checks to pass, and blocks force pushes. - Treat this required pull-request-only administrator bypass as a baseline - setting, not as a policy exception; evaluate any additional bypass actors - or exceptions separately. - Build an evidence map for every baseline setting from that repository's - current API response and post-change read-back. Never infer compliance from - a related setting, a prior repository audit, or an API default. Treat an - unsupported endpoint as unverified rather than applied. For an apply - request, set each requested baseline value explicitly even when its - pre-change value was not captured; for an audit-only request, leave that - value unverified. - Before creating or changing required status checks, verify that every - selected context is a current job name that runs on pull requests (and on - `merge_group` when a merge queue is used). Do not create a ruleset that can - block every merge because its required checks cannot run. - When the default ruleset is missing or incomplete, apply every safe baseline - rule first. If no current job context can safely be required, omit only the - required-status-checks rule, record the ruleset as incomplete, then add or - adapt pull-request validation and update the ruleset after observing a - successful run. Read [repository-enforcement.md](references/repository-enforcement.md) - for the ordered recovery flow and `gh` API command templates. - Mark inaccessible settings as unverified and record any approved policy - exception explicitly. -9. Summarize actionlint, ShellCheck, pinact, other automated checks, - AI-assisted inspections, and skipped checks separately. - ### Issues 1. Identify whether the artifact is an issue title, body, reply, or combined - update. For significant AI assistance, put the applicable alert at the very - top: + update. For significant AI assistance, put this alert at the absolute top: ```markdown > [!WARNING] @@ -182,8 +62,8 @@ Use `security-check` for security- or supply-chain-sensitive content and `[optional scope][optional !]: ` and use `commit-message-quality-check` for type and breaking-change notation. 2. Before drafting or replacing a body, read the current PR template and - contributor guidance. Follow only visible headings, required checkboxes, and - applicable sections. If no template exists, use + contributor guidance. Follow only visible headings, required checkboxes, + and applicable sections. If no template exists, use [fallback-pr-body.md](references/fallback-pr-body.md). Never infer a CLA, contributor agreement, checklist, sign-off, or policy from the fallback. 3. For significant AI assistance, put this alert at the absolute top of PR @@ -196,12 +76,18 @@ Use `security-check` for security- or supply-chain-sensitive content and Use `This comment was created with assistance from LLMs.` for reviews, replies, and thread notes. Preserve any existing alert after a blank line; - the LLM alert must be exactly once and first. -4. Keep automated commands, CI results, non-AI manual checks, - screenshots/videos, and AI-assisted inspections distinct. Under - `## Testing`, put AI-assisted work in `### AI-assisted inspections` after - automated checks with `Request: ...` and nested `AI-assisted result: ...`. - State skipped verification and never describe AI work as manual. + the LLM alert must appear exactly once and first. +4. Keep automated commands, CI results, non-AI manual checks, screenshots or + videos, and AI-assisted inspections distinct. Under `## Testing`, put + AI-assisted work in `### AI-assisted inspections` after automated checks + with `Request: ...` and nested `AI-assisted result: ...`. State skipped + verification and never describe AI work as manual. + When the body cites a GitHub repository, issue, pull request, commit, + release, workflow run, or other reviewable artifact, use a descriptive + Markdown link to its canonical URL. Do not leave an auditable source as only + `owner/repo#123`, a short SHA, or prose that makes the reviewer search for + the referenced artifact. An exact identity may remain in inline code when + the same item is linked beside it. 5. Use `Update Note`, `Discussion Note`, or `Review Note` only when requested. Put `Request addressed: ...` after the required alert; group retrospective notes by meaningful theme, label inferences, and omit secrets, private @@ -214,9 +100,9 @@ Use `security-check` for security- or supply-chain-sensitive content and write immediately, audit all targets at the end, and report success only when every target has exactly one required top alert and a matching body. 7. With `gh`, use `--body-file`. Verify the complete JSON `body` as one string - against the candidate, allowing only terminal-newline normalization; in - PowerShell do not assign line-oriented `--jq` output to verify multiline - bodies. Remove temporary files. + against the candidate, allowing only terminal-newline normalization. In + PowerShell, do not assign line-oriented `--jq` output when verifying + multiline bodies. Remove temporary files. 8. Before `gh pr merge` creates a squash or merge commit, resolve and pass the exact head SHA with `--match-head-commit`. Build and validate the exact multiline candidate commit message in a file with @@ -228,11 +114,7 @@ Use `security-check` for security- or supply-chain-sensitive content and ## Resources -- [runner-selection.md](references/runner-selection.md): GitHub-hosted runner - selection and image-lifecycle guidance. - [fallback-pr-body.md](references/fallback-pr-body.md): fallback PR template when no repository template applies. -- [repository-enforcement.md](references/repository-enforcement.md): recovery - flow and `gh` command templates for Actions policies and default rulesets. - `scripts/check_llm_disclosure.py`: validate required LLM disclosure, disclosure-only repairs, and stored-body preservation. diff --git a/.agents/skills/github-workflow/agents/openai.yaml b/.agents/skills/github-workflow/agents/openai.yaml index 76840c3..f845d95 100644 --- a/.agents/skills/github-workflow/agents/openai.yaml +++ b/.agents/skills/github-workflow/agents/openai.yaml @@ -1,4 +1,4 @@ interface: display_name: "GitHub Workflow" - short_description: "Create and review GitHub artifacts." - default_prompt: "Use $github-workflow to create, review, or update a GitHub Actions workflow, issue, or pull request." + short_description: "Review GitHub issues and pull requests." + default_prompt: "Use $github-workflow to create, review, or update a GitHub issue or pull request." diff --git a/.agents/skills/github-workflow/references/repository-enforcement.md b/.agents/skills/github-workflow/references/repository-enforcement.md deleted file mode 100644 index 59d9636..0000000 --- a/.agents/skills/github-workflow/references/repository-enforcement.md +++ /dev/null @@ -1,158 +0,0 @@ -# Repository Enforcement Recovery - -Use this flow when a default-branch ruleset is missing or lacks required -pull-request or status-check rules. Run the commands from the target -repository with authenticated `gh`; replace `OWNER/REPO`, check contexts, and -full commit SHAs with observed values. - -## Contents - -- [Inventory before changing policy](#1-inventory-before-changing-policy) -- [Apply the safe fallback ruleset](#2-apply-the-safe-fallback-ruleset) -- [Make a required-check context safe to require](#3-make-a-required-check-context-safe-to-require) -- [Restrict Actions without breaking composites](#4-restrict-actions-without-breaking-composites) -- [Create or complete the default ruleset](#5-create-or-complete-the-default-ruleset) -- [Verify the stored policy](#6-verify-the-stored-policy) - -## 1. Inventory before changing policy - -```powershell -$repo = 'OWNER/REPO' -gh api "repos/$repo" --jq '{default_branch,allow_squash_merge,allow_merge_commit,allow_rebase_merge,allow_auto_merge,allow_update_branch,delete_branch_on_merge,squash_merge_commit_title,squash_merge_commit_message}' -gh api "repos/$repo/immutable-releases" -gh api "repos/$repo/actions/permissions" -gh api "repos/$repo/actions/permissions/selected-actions" -gh api "repos/$repo/actions/permissions/workflow" -gh api "repos/$repo/rulesets" -``` - -Build a per-setting evidence map from these responses and from the read-back -after every mutation. Record the endpoint, observed value, and result as -`verified`, `unverified`, or an approved exception. Treat an unavailable -setting as unverified; do not infer a fork-workflow approval policy, merge -method, or ruleset bypass from another repository or a related setting. -For an apply request, set every requested baseline value explicitly even if -the pre-change response omitted it; for an audit-only request, retain that -omission as unverified. - -The fork-contributor approval endpoint can return `404` for personal-owner -repositories. Do not report that policy as applied in that case; record it as -unverified and use the repository settings UI or a supported API when one is -available. - -## 2. Apply the safe fallback ruleset - -When no check context has been observed on a pull request, create or update -the `default` ruleset with every other baseline rule: target the default -branch, restrict deletions and force pushes, require pull requests, allow only -squash merging, and allow repository-admin bypass only on pull requests. -Omit only `required_status_checks`; record the ruleset as incomplete and do -not claim status-check enforcement. - -Use the template in section 5 after removing its -`required_status_checks` object. For an existing ruleset, preserve unrelated -rules and send the complete reviewed replacement with `PUT`. - -## 3. Make a required-check context safe to require - -1. Add or adapt a validation workflow that runs the intended job on - `pull_request`. Add `merge_group` when the repository uses a merge queue. -2. Give the job a stable visible name, such as `lint` or `test`. -3. Merge that workflow change to the default branch. -4. Open a pull request and wait for a successful run. Confirm the exact - context before adding it to the ruleset: - - ```powershell - gh pr checks --required - ``` - -Do not require a job that runs only on `push`, a release job, or a context -whose current name was not observed on a pull request. - -## 4. Restrict Actions without breaking composites - -Inventory `uses:` in workflow files and all reachable local composite actions -or reusable workflows. Preserve local actions and GitHub-owned actions; allow -only the external action or reusable-workflow names that the inventory finds. -Keep full-SHA pinning required for workflow execution, but allow each selected -name with `@*` so updating a pinned version does not require a settings change. -Do not wildcard an owner or all actions. - -Set `allowed_actions=selected`, `sha_pinning_required=true`, -`github_owned_allowed=true`, and `verified_allowed=false` explicitly during an -apply. Do not assume an omitted pre-change SHA-pinning value was already safe. - -When the inventory finds no external `uses:` reference, set selected actions -with GitHub-owned actions allowed, Marketplace verified creators disallowed, -and no `patterns_allowed[]` entries. This is a valid least-privilege result; -downloaded tools are not Action allowlist entries and still require the -separate `security-check` review. - -```powershell -gh api --method PUT "repos/$repo/actions/permissions" ` - -F enabled=true -f allowed_actions=selected -F sha_pinning_required=true - -gh api --method PUT "repos/$repo/actions/permissions/selected-actions" ` - -F github_owned_allowed=true -F verified_allowed=false ` - -f 'patterns_allowed[]=EXTERNAL_OWNER/ACTION@*' - -gh api --method PUT "repos/$repo/actions/permissions/workflow" ` - -f default_workflow_permissions=read ` - -F can_approve_pull_request_reviews=false -``` - -Repeat `patterns_allowed[]` only for additional observed external action or -reusable-workflow names. Read back all three endpoints after the change. - -## 5. Create or complete the default ruleset - -Save the following JSON as `ruleset.json` after replacing `lint` with an -observed pull-request check context. Repository role ID `5` is the `admin` -role; its bypass mode is limited to pull requests. If no context is available, -remove the complete `required_status_checks` object and apply the fallback from -section 2. - -```json -{ - "name": "default", - "target": "branch", - "enforcement": "active", - "bypass_actors": [ - { "actor_id": 5, "actor_type": "RepositoryRole", "bypass_mode": "pull_request" } - ], - "conditions": { "ref_name": { "include": ["~DEFAULT_BRANCH"], "exclude": [] } }, - "rules": [ - { "type": "deletion" }, - { "type": "non_fast_forward" }, - { "type": "pull_request", "parameters": { "allowed_merge_methods": ["squash"] } }, - { "type": "required_status_checks", "parameters": { - "strict_required_status_checks_policy": true, - "do_not_enforce_on_create": false, - "required_status_checks": [{ "context": "lint" }] - } } - ] -} -``` - -```powershell -gh api --method POST "repos/$repo/rulesets" --input ruleset.json -``` - -For an existing ruleset, fetch its detail before changing it. Preserve every -unrelated rule; identify extra bypass actors and other exceptions separately -instead of silently treating them as the administrator baseline. Send only the -complete, reviewed replacement to `PUT repos/$repo/rulesets/`. - -## 6. Verify the stored policy - -```powershell -gh api "repos/$repo/rulesets" --jq '.[] | select(.name == "default") | .id' -gh api "repos/$repo/rulesets/" -``` - -Confirm the target is `~DEFAULT_BRANCH`, deletion and force pushes are -restricted, pull requests allow only squash merging, the observed check is -required, and the only baseline bypass is repository-admin with -`pull_request` mode. Also read back the repository merge settings, immutable -releases, both Actions policy endpoints, and workflow token permissions; mark -every unavailable value unverified. diff --git a/.agents/skills/github-workflow/references/runner-selection.md b/.agents/skills/github-workflow/references/runner-selection.md deleted file mode 100644 index 06ccb59..0000000 --- a/.agents/skills/github-workflow/references/runner-selection.md +++ /dev/null @@ -1,132 +0,0 @@ -# GitHub-hosted Linux Runner Selection - -Select a runner per job from its actual resource, isolation, tool, and duration requirements. Do -not copy one workflow-wide label into every job without checking those requirements. - -## Contents - -- [Start from the oldest supported GA image](#start-from-the-oldest-supported-ga-image) -- [Prefer `ubuntu-slim` for lightweight jobs](#prefer-ubuntu-slim-for-lightweight-jobs) -- [Choose a full Ubuntu VM deliberately](#choose-a-full-ubuntu-vm-deliberately) -- [Operate image retirement as a recurring lifecycle](#operate-image-retirement-as-a-recurring-lifecycle) -- [Validate the selection](#validate-the-selection) - -## Start from the oldest supported GA image - -For a job whose output or validation establishes an OS compatibility floor, choose the oldest -versioned GitHub-hosted GA image that the `actions/runner-images` repository currently lists for the -required OS and architecture. For Ubuntu, this maximizes compatibility with older glibc consumers; -newer glibc is not generally backward-runnable on an older distribution. Apply the same -oldest-supported baseline to Windows and macOS support, while treating architecture, Xcode/Visual -Studio availability, and artifact type as separate constraints. - -Discover the label at review time; do not copy a once-current version from this Skill. Use an -explicit version label such as `ubuntu-`, `windows-`, or `macos-` so a -moving `*-latest` alias cannot silently raise the compatibility floor. Beta images do not count as -the oldest supported GA baseline and do not replace it before GA. - -An earlier support cutoff is allowed when current evidence shows that the old image prevents a -required library/toolchain, materially harms performance or reliability, creates disproportionate -maintenance cost, or cannot meet security/support obligations. Record the evidence, affected users -and artifacts, replacement image, migration checks, and announced support boundary. Convenience -alone is not evidence. - -## Prefer `ubuntu-slim` for lightweight jobs - -Use `ubuntu-slim` when all of these conditions hold: - -- The job is short-running with enough measured headroom below the fixed 15-minute limit. -- One x64 CPU, 5 GB RAM, and 14 GB storage are sufficient. -- The job works in an unprivileged container on a shared VM. -- Every required command is in the current slim image inventory or is installed explicitly from a - reviewed, pinned, integrity-checked source. -- Every external or local action used by the job is compatible with the slim environment. -- The job does not build, package, link, or validate a native artifact whose glibc/OS compatibility - floor is part of the supported product contract. - -Good candidates include repository metadata checks, issue or release API automation, small -format/lint/type/test jobs, and lightweight artifact assembly or publication. Measure the real job; -the category alone does not prove it fits. - -`ubuntu-slim` is not a smaller full VM. GitHub provisions an unprivileged container with a minimal -tool set. Do not select it for jobs that require filesystem mounts, Docker-in-Docker, low-level -kernel features, nested virtualization, emulators, or other privileged host access. Treat Docker -container actions and service containers as unsupported until current official documentation and a -representative run prove the exact use case works. The installed Docker client does not imply that -a usable Docker daemon is available. - -Avoid `ubuntu-slim` for typical heavyweight CI/CD builds, large native compilation, desktop/mobile -packaging toolchains, or jobs whose duration can approach 15 minutes. Split a genuinely lightweight -preflight or publication phase from a heavyweight build when the dependency graph remains explicit; -do not split jobs merely to claim slim usage. - -## Choose a full Ubuntu VM deliberately - -Use a standard Ubuntu VM when the job needs more CPU or memory, a full preinstalled toolchain, -privileged VM behavior, longer execution, or an OS/native ABI compatibility contract. Select the -oldest currently supported GA Ubuntu label unless a documented constraint justifies an earlier -support cutoff. Use `ubuntu-latest` only when automatically following GitHub's newest stable Ubuntu -image is an intended maintenance policy and migration risk has been accepted. - -Do not infer that `-latest` means the newest upstream Ubuntu release; it means GitHub's latest stable -hosted image and changes over time. - -## Operate image retirement as a recurring lifecycle - -GitHub supports at most two GA images plus one beta per OS family and begins deprecating the oldest -label after a newer OS image reaches GA. Treat the runner selection as maintained support data, not -a one-time YAML choice. - -1. On every runner-label change, and at least monthly while a repository uses a versioned hosted - image, review the current `actions/runner-images` **Available Images**, releases, and open pinned - **Announcement** issues. Record the review date and the oldest eligible GA label for each - supported OS/architecture family. -2. When a new GA image appears or a dated deprecation announcement names the selected image, open or - update a tracked migration item within one normal maintenance cycle. Capture the announcement - URL, announcement date, scheduled brownouts or phased withdrawal, final removal date, affected - workflows/artifacts, and the next-oldest supported replacement. -3. Validate the replacement in parallel before changing the declared support floor: dependency and - tool availability, compiler/runtime versions, native artifact compatibility, packaging, - performance, cache behavior, and representative workflow duration. -4. Set the repository's cutoff and merge the versioned-label migration before the first scheduled - brownout or other service-disruption phase. Leave at least one normal release/maintenance cycle - for rollback when the announcement lead time permits. If GitHub publishes only a final removal - date, choose an earlier internal cutoff with the same rollback window; do not wait for removal. -5. Remove the retired label and obsolete conditionals together, publish the support-boundary change - where users and maintainers expect it, and verify the first scheduled runs on the replacement. -6. Continue the monthly review on the replacement image. A completed migration starts the same - lifecycle again; it does not close runner maintenance permanently. - -The announcement begins GitHub's administrative deprecation process; brownouts and phased routing -are the operational disruption phase that repositories must precede. If an announcement provides -too little lead time for the normal cycle, migrate immediately and record the reduced validation or -rollback window rather than running into a brownout. - -Apply this lifecycle to Windows and macOS too. It is acceptable to drop an older image before GitHub -does when library/toolchain compatibility, performance, reliability, security, or maintenance -evidence justifies it, but follow the same tracked decision, parallel validation, communicated -cutoff, and post-migration verification. - -## Validate the selection - -1. Read the current GitHub-hosted runner reference and `ubuntu-slim` software inventory before a - migration. Also read `actions/runner-images` Available Images, releases, and dated Announcement - issues; runner capabilities, installed versions, and retirement dates can change. -2. Inventory shell commands, local actions, external actions, package installation, caches, - containers, services, artifacts, permissions, and expected peak resource use for each job. -3. Set `timeout-minutes` to at most 15 on a slim job. Leave operational headroom rather than using - the limit as the expected duration. -4. Run every changed slim job on a representative event. Check setup logs, action compatibility, - elapsed time, peak behavior, and outputs; a YAML-only review is insufficient. -5. Keep heavy and platform-specific jobs on the full runner they require. Record why each exception - cannot use slim so future reviews can reconsider it. -6. For every compatibility-bearing job, record why the selected version is the oldest supported GA - image or the evidence that justified an earlier support cutoff. - -Primary references: - -- -- -- -- -- diff --git a/.agents/skills/python-quality-check/SKILL.md b/.agents/skills/python-quality-check/SKILL.md index af96727..059d02a 100644 --- a/.agents/skills/python-quality-check/SKILL.md +++ b/.agents/skills/python-quality-check/SKILL.md @@ -32,8 +32,10 @@ description: >- Use `code-quality-check` for general readability and maintainability, `security-check` for dependency provenance, release age, build hooks, secrets, -and external executables, and `github-workflow` for workflow triggers, -permissions, runners, action pins, and repository enforcement. +and external executables, and `github-actions-quality-check` for workflow triggers, +permissions, runners, action pins, and repository enforcement. Use +`test-quality-check` for language-independent test design, classification, +coverage policy, and overengineering audits. This Skill owns the Python-specific baseline. Framework Skills should add only their framework contracts and should not redefine weaker uv, Ruff, typing, @@ -86,13 +88,10 @@ testing, coverage, or distribution rules. - Fix lint and typing findings in code before adding a suppression. Every suppression must name the exact rule/code and a durable local reason. 4. Align tests and coverage. - - Test behavior, state, effects, cleanup, errors, boundaries, and entry points; - do not assert only that lines executed. - - Inject deterministic seams for clocks, randomness, filesystems, network, - subprocesses, and sleeps. Do not hide flakiness with CI retries. - - Enforce both statement and branch coverage at 100% for maintained - first-party source, while separately recording any genuinely unreachable - generated/platform code and its alternative verification. + - Apply `test-quality-check` for behavioral scope, deterministic oracles, + suite auditing, and the shared 100% statement/branch policy. + - Configure pytest and Coverage.py for the selected Python source roots and + run them through the locked uv environment locally and in CI. 5. Align CI and distribution. - Read [ci-and-distribution.md](references/ci-and-distribution.md) before changing workflows, build metadata, wheels, sdists, executables, or releases. diff --git a/.agents/skills/python-quality-check/references/ci-and-distribution.md b/.agents/skills/python-quality-check/references/ci-and-distribution.md index 5bea79c..1dad826 100644 --- a/.agents/skills/python-quality-check/references/ci-and-distribution.md +++ b/.agents/skills/python-quality-check/references/ci-and-distribution.md @@ -3,13 +3,12 @@ ## Contents - [CI parity](#ci-parity) -- [Event and trust boundaries](#event-and-trust-boundaries) - [Distribution verification](#distribution-verification) - [Completion evidence](#completion-evidence) ## CI parity -Use `github-workflow` and `security-check` while implementing CI. +Use `github-actions-quality-check` and `security-check` while implementing CI. - Re-run lock verification, exact sync, Ruff lint, Ruff format, strict mypy, pytest, and coverage from a clean checkout. @@ -22,25 +21,9 @@ Use `github-workflow` and `security-check` while implementing CI. local-only shortcuts are findings. - Install/select Python from `.python-version` or an explicit matrix consistent with `requires-python`. -- Pin uv and every external action to reviewed immutable versions. Validate - action inputs against the exact pinned version. +- Pin uv to a reviewed immutable version. - Bind dependency caches to `uv.lock`, runner, and Python identity. Do not cache `.venv`, secrets, credentials, or signing material. -- Use repository-owned Composite Actions only for stable same-runner sequences. - Keep job runners, permissions, matrices, artifacts, and release gates in workflows. - -## Event and trust boundaries - -- Validate untrusted changes on `pull_request`, and `merge_group` when required. -- Re-run the same required validation on the exact protected integration-branch - push; do not substitute a prior PR run or API polling. -- Start permissions at `contents: read`. Do not use `pull_request_target` to - execute untrusted proposed source. -- Keep publication/signing in protected jobs or environments after validation - and artifact creation for the same source commit. -- Use direct `needs` dependencies so build and release consume the complete - lint/type/test result and the verified artifact. -- Run actionlint, applicable ShellCheck, and pinact in addition to Python checks. ## Distribution verification diff --git a/.agents/skills/python-quality-check/references/tooling-and-testing.md b/.agents/skills/python-quality-check/references/tooling-and-testing.md index 2edcb54..d587eb9 100644 --- a/.agents/skills/python-quality-check/references/tooling-and-testing.md +++ b/.agents/skills/python-quality-check/references/tooling-and-testing.md @@ -190,18 +190,14 @@ configured development target. ## pytest and coverage policy -- Require 100% statement and branch coverage for maintained first-party source. -- Do not use broad omit rules, `pragma: no cover`, or import guards to - manufacture 100%. +- Apply `test-quality-check` for test classification, behavioral oracles, + determinism, the shared 100% statement/branch policy, exclusions, and suite + overengineering audits. +- Configure pytest and Coverage.py against the intended maintained first-party + source roots, enable branch measurement, and fail below the shared threshold. - Test module and console entry points without launching work at import time. -- Fail on unknown markers/configuration and make clock, randomness, sleep, - filesystem, subprocess, and network behavior deterministic through seams. -- Assert state, declared effects, boundary calls, failures, cleanup, and - user-observable outcomes; executing a line is not a sufficient assertion. -- Keep ordinary tests offline and independent of user credentials. -- Organize tests around contracts: domain values, application transitions, - presentation mapping, infrastructure boundaries, composition, entry points, - and artifact smoke behavior. Source-file mirroring alone is insufficient. +- Fail on unknown pytest markers and configuration. Keep Python-specific + fixtures and plugins explicit in the development dependency group. ## Locked verification diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index 3c0e9d1..6b156a2 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -18,7 +18,7 @@ that are present in that checkout. - Source: [aoirint/skills](https://github.com/aoirint/skills), selected from `.apm/skills/` - Pinned commit: - [`329572438060c1b0c34882b2c3a8e388ae30cd1a`](https://github.com/aoirint/skills/tree/329572438060c1b0c34882b2c3a8e388ae30cd1a) + [`82fb9ef5149bf59721053fc881e499b7a67ac39b`](https://github.com/aoirint/skills/tree/82fb9ef5149bf59721053fc881e499b7a67ac39b) - Deployed paths: `.agents/skills/{apm-usage,changelog-workflow,code-quality-check,commit-message-quality-check,docker-quality-check,git-worktree-workflow,github-workflow,gitignore-workflow,prose-quality-check,python-quality-check,release-note-workflow,security-check}/` -- License: [MIT](https://github.com/aoirint/skills/blob/329572438060c1b0c34882b2c3a8e388ae30cd1a/LICENSE) +- License: [MIT](https://github.com/aoirint/skills/blob/82fb9ef5149bf59721053fc881e499b7a67ac39b/LICENSE) - Copyright: Copyright (c) 2026 aoirint diff --git a/apm.lock.yaml b/apm.lock.yaml index 63fabe5..3f752a0 100644 --- a/apm.lock.yaml +++ b/apm.lock.yaml @@ -1,12 +1,12 @@ lockfile_version: '1' -generated_at: '2026-08-11T00:40:49.030563+00:00' +generated_at: '2026-08-11T03:20:37.451201+00:00' apm_version: 0.26.0 dependencies: - repo_url: aoirint/skills name: skills host: github.com - resolved_commit: 329572438060c1b0c34882b2c3a8e388ae30cd1a - resolved_ref: 329572438060c1b0c34882b2c3a8e388ae30cd1a + resolved_commit: 82fb9ef5149bf59721053fc881e499b7a67ac39b + resolved_ref: 82fb9ef5149bf59721053fc881e499b7a67ac39b version: 0.0.0 package_type: apm_package deployed_files: @@ -35,6 +35,10 @@ dependencies: - .agents/skills/docker-quality-check/README.md - .agents/skills/docker-quality-check/SKILL.md - .agents/skills/docker-quality-check/agents/openai.yaml + - .agents/skills/docker-quality-check/assets/github/actions/lint-docker/action.yml + - .agents/skills/docker-quality-check/assets/github/workflows/main.yml + - .agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml + - .agents/skills/docker-quality-check/references/ci-template-contract.md - .agents/skills/git-worktree-workflow - .agents/skills/git-worktree-workflow/README.md - .agents/skills/git-worktree-workflow/SKILL.md @@ -44,8 +48,6 @@ dependencies: - .agents/skills/github-workflow/SKILL.md - .agents/skills/github-workflow/agents/openai.yaml - .agents/skills/github-workflow/references/fallback-pr-body.md - - .agents/skills/github-workflow/references/repository-enforcement.md - - .agents/skills/github-workflow/references/runner-selection.md - .agents/skills/github-workflow/scripts/check_llm_disclosure.py - .agents/skills/gitignore-workflow - .agents/skills/gitignore-workflow/README.md @@ -96,17 +98,19 @@ dependencies: .agents/skills/commit-message-quality-check/SKILL.md: sha256:db272bb7467bcb6a6c3d837dec60a34f7081c135fcd40a9e00cf4a84e29ffabe .agents/skills/commit-message-quality-check/agents/openai.yaml: sha256:faffd948a0989dcfc87dcd3b0580c4a7003d01ef436e66dab9f280df57de652c .agents/skills/docker-quality-check/README.md: sha256:912a73d3de06babc6eed1ecdaf275139ae465797083dc5427affb54d00c57bf0 - .agents/skills/docker-quality-check/SKILL.md: sha256:1dfe7b749211884c5ffcc9670406330c9c89b91e9147f9507c3e168270828b4d + .agents/skills/docker-quality-check/SKILL.md: sha256:642f9fdb8d92170a51fdadd2c6fc98a154b1cfeda097c0c7b59bbb8307308069 .agents/skills/docker-quality-check/agents/openai.yaml: sha256:8abdaaa5a0458e86821080f50a2dfc34374c5c673a6c257fa351a2a96a16d064 + .agents/skills/docker-quality-check/assets/github/actions/lint-docker/action.yml: sha256:9f9b507f64721d295ca96eabe440a73caed1d280ec42e7dd0f81ebc796a87ad3 + .agents/skills/docker-quality-check/assets/github/workflows/main.yml: sha256:eb431cdcf975f9cbb42f2fce1a3b9afb11134f802d82ccac7d8d63946d050c4a + .agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml: sha256:0ff5ebdc316889f7d295a22de2f24c2ad0307be5c8afb76cb1555d4ac3c05782 + .agents/skills/docker-quality-check/references/ci-template-contract.md: sha256:91931e9e0d6bb3bd2291fde1b4f6159a8005100b8d8ac7666b65aa0a65403dd8 .agents/skills/git-worktree-workflow/README.md: sha256:fa6483b5919a01b84fa0d6ffcbaae20b84ed3807e18029e8807e61b0ee4f9de9 .agents/skills/git-worktree-workflow/SKILL.md: sha256:67e2474b9878cc6cb209ae30b19c233f65969abe5b5d543f0c9a16e46f1d40d2 .agents/skills/git-worktree-workflow/agents/openai.yaml: sha256:3eb9da73e7a041e77d82f0d5c3a8c67e914575cff8651b71d077db30fe3da99a - .agents/skills/github-workflow/README.md: sha256:22305baeccffab98041f4783195fc5b7804dc7429d7974cd8c8571053152fdba - .agents/skills/github-workflow/SKILL.md: sha256:29d9a78a6c2cf98fb3c102c4b4f402f96b90412a72656588bcf6ebfc4224ad09 - .agents/skills/github-workflow/agents/openai.yaml: sha256:615f3c2c18824bf08ec32a4027901b89259e6c42255c736e86b206caf1bf1a7c + .agents/skills/github-workflow/README.md: sha256:381a6c5fee202282fe66b35070b605c2b344f718aa63cf9b91abeca1936ab2d2 + .agents/skills/github-workflow/SKILL.md: sha256:d48216b0fb3656228d1af7689cd538303a3114bcc7e0b74f1404258b836f7412 + .agents/skills/github-workflow/agents/openai.yaml: sha256:1d8dfa53b85500f8d112c039d1c522dde129d140208c65d7145aa55e70eae329 .agents/skills/github-workflow/references/fallback-pr-body.md: sha256:b98239e7d4cdddd8e267ab155f4e4c38fcc514526d9a32f13fcd5b21a1c07eb2 - .agents/skills/github-workflow/references/repository-enforcement.md: sha256:92d546edb39d63bbee8cf806eecb7766aeebf349ab0986a673a0df9ba753dbd1 - .agents/skills/github-workflow/references/runner-selection.md: sha256:6e9929a316ba9efbf6171366de0d1a3c976aee73d22c26b2d1ec33017af6f164 .agents/skills/github-workflow/scripts/check_llm_disclosure.py: sha256:bc9c5cbd8efa77095eac42e53da714ed8dff86fa3b0e7870fc3e7eca1ca36e20 .agents/skills/gitignore-workflow/README.md: sha256:0de188ebcdd40ea1aec701410e1c2182049b66bc4ec4d83a3bf55685b4267d47 .agents/skills/gitignore-workflow/SKILL.md: sha256:2ef38f42e418c10e0ba7632e3ba37614df97044dfa8847ad1338e6c4c896c089 @@ -115,10 +119,10 @@ dependencies: .agents/skills/prose-quality-check/SKILL.md: sha256:9ec45813d04382e04a3b504fd187e4151fc5198352564bd0bcb064f4eaf9a702 .agents/skills/prose-quality-check/agents/openai.yaml: sha256:b83e0a5d151e6e20df6f7d97f268955c6abfd105d53820f6baad0de8403fc062 .agents/skills/python-quality-check/README.md: sha256:20a23003a24a8caf2f03dd5a06bed99c81cf93ab53fe5a196c6a67ab59c53b0e - .agents/skills/python-quality-check/SKILL.md: sha256:76c8c0d01064417e4d8e709a22f2b60b5ec62a57d9c641029e95c76a8b39b79d + .agents/skills/python-quality-check/SKILL.md: sha256:8827207925dfe0648856628561433435a6c3bd3f27e8497a784b809e90c9441d .agents/skills/python-quality-check/agents/openai.yaml: sha256:f0b4ad3807e177becec02271314fb32c1ec8d5a7682725ddd4a611a5381084d1 - .agents/skills/python-quality-check/references/ci-and-distribution.md: sha256:0f97408fd9f98dc43d468064e4f601eb26ce10e01939a9cc8ba3227ca97b6947 - .agents/skills/python-quality-check/references/tooling-and-testing.md: sha256:61ff7e27674d45949003576bef5bdb0c225172f69ba1d6c0a3129feabc42c23a + .agents/skills/python-quality-check/references/ci-and-distribution.md: sha256:e52aaf46c28816d6f6262a5421dba8de9f906d2b606987bedcda840d2e687281 + .agents/skills/python-quality-check/references/tooling-and-testing.md: sha256:8dd45ccbf2818d73c6497beec400567c294eec842199eaf329e856d40446e771 .agents/skills/python-quality-check/scripts/check_project.py: sha256:8175b500198399a2ce8b79b4fc8d1902f791d163a0d6dfd35b5ce56b41c5ccc5 .agents/skills/python-quality-check/scripts/check_project.py.lock: sha256:76042d39ffdbb675188966b4fc41d312b0ec9374a7aa438d4f5e919adcf04c07 .agents/skills/python-quality-check/scripts/inspect_distribution.py: sha256:86cc60199cf85c6eab39f648c9892963fbfd2ec6d913106119b0eb679eca6849 @@ -133,7 +137,7 @@ dependencies: .agents/skills/security-check/agents/openai.yaml: sha256:87edf0cc1e8717194d0c536f2d5ac0cc1ac9ec04402311d34e953d2e2b23fa19 .agents/skills/security-check/references/artifact-inspection.md: sha256:9842555f4789e77e6cf3d22b000116497207ecf6fa5587f2b1fe0dc20e7dffda .agents/skills/security-check/references/external-code-execution.md: sha256:87ca817baa02ef6b955e5878f0cd79c875abdb0be6e0177cfce158968e628bc3 - content_hash: sha256:9a62dc48d3bb2f41ba02046b5df84457d1bd54d21526bdc55d5cbac6ee943972 + content_hash: sha256:6eec088c34d2f984e328d7c3521313313034d7d26cae6a190bf73ef58bbbf9fa skill_subset: - apm-usage - changelog-workflow @@ -364,7 +368,7 @@ deployments: owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:1dfe7b749211884c5ffcc9670406330c9c89b91e9147f9507c3e168270828b4d + content_hash: sha256:642f9fdb8d92170a51fdadd2c6fc98a154b1cfeda097c0c7b59bbb8307308069 - kind: project-relative target: codex value: .agents/skills/docker-quality-check/agents/openai.yaml @@ -376,43 +380,43 @@ deployments: content_hash: sha256:8abdaaa5a0458e86821080f50a2dfc34374c5c673a6c257fa351a2a96a16d064 - kind: project-relative target: codex - value: .agents/skills/git-worktree-workflow + value: .agents/skills/docker-quality-check/assets/github/actions/lint-docker/action.yml runtime: null scope: project owners: - aoirint/skills active_owner: aoirint/skills - content_hash: null + content_hash: sha256:9f9b507f64721d295ca96eabe440a73caed1d280ec42e7dd0f81ebc796a87ad3 - kind: project-relative target: codex - value: .agents/skills/git-worktree-workflow/README.md + value: .agents/skills/docker-quality-check/assets/github/workflows/main.yml runtime: null scope: project owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:fa6483b5919a01b84fa0d6ffcbaae20b84ed3807e18029e8807e61b0ee4f9de9 + content_hash: sha256:eb431cdcf975f9cbb42f2fce1a3b9afb11134f802d82ccac7d8d63946d050c4a - kind: project-relative target: codex - value: .agents/skills/git-worktree-workflow/SKILL.md + value: .agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml runtime: null scope: project owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:67e2474b9878cc6cb209ae30b19c233f65969abe5b5d543f0c9a16e46f1d40d2 + content_hash: sha256:0ff5ebdc316889f7d295a22de2f24c2ad0307be5c8afb76cb1555d4ac3c05782 - kind: project-relative target: codex - value: .agents/skills/git-worktree-workflow/agents/openai.yaml + value: .agents/skills/docker-quality-check/references/ci-template-contract.md runtime: null scope: project owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:3eb9da73e7a041e77d82f0d5c3a8c67e914575cff8651b71d077db30fe3da99a + content_hash: sha256:91931e9e0d6bb3bd2291fde1b4f6159a8005100b8d8ac7666b65aa0a65403dd8 - kind: project-relative target: codex - value: .agents/skills/github-workflow + value: .agents/skills/git-worktree-workflow runtime: null scope: project owners: @@ -421,58 +425,76 @@ deployments: content_hash: null - kind: project-relative target: codex - value: .agents/skills/github-workflow/README.md + value: .agents/skills/git-worktree-workflow/README.md runtime: null scope: project owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:22305baeccffab98041f4783195fc5b7804dc7429d7974cd8c8571053152fdba + content_hash: sha256:fa6483b5919a01b84fa0d6ffcbaae20b84ed3807e18029e8807e61b0ee4f9de9 - kind: project-relative target: codex - value: .agents/skills/github-workflow/SKILL.md + value: .agents/skills/git-worktree-workflow/SKILL.md runtime: null scope: project owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:29d9a78a6c2cf98fb3c102c4b4f402f96b90412a72656588bcf6ebfc4224ad09 + content_hash: sha256:67e2474b9878cc6cb209ae30b19c233f65969abe5b5d543f0c9a16e46f1d40d2 - kind: project-relative target: codex - value: .agents/skills/github-workflow/agents/openai.yaml + value: .agents/skills/git-worktree-workflow/agents/openai.yaml runtime: null scope: project owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:615f3c2c18824bf08ec32a4027901b89259e6c42255c736e86b206caf1bf1a7c + content_hash: sha256:3eb9da73e7a041e77d82f0d5c3a8c67e914575cff8651b71d077db30fe3da99a - kind: project-relative target: codex - value: .agents/skills/github-workflow/references/fallback-pr-body.md + value: .agents/skills/github-workflow runtime: null scope: project owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:b98239e7d4cdddd8e267ab155f4e4c38fcc514526d9a32f13fcd5b21a1c07eb2 + content_hash: null - kind: project-relative target: codex - value: .agents/skills/github-workflow/references/repository-enforcement.md + value: .agents/skills/github-workflow/README.md runtime: null scope: project owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:92d546edb39d63bbee8cf806eecb7766aeebf349ab0986a673a0df9ba753dbd1 + content_hash: sha256:381a6c5fee202282fe66b35070b605c2b344f718aa63cf9b91abeca1936ab2d2 - kind: project-relative target: codex - value: .agents/skills/github-workflow/references/runner-selection.md + value: .agents/skills/github-workflow/SKILL.md runtime: null scope: project owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:6e9929a316ba9efbf6171366de0d1a3c976aee73d22c26b2d1ec33017af6f164 + content_hash: sha256:d48216b0fb3656228d1af7689cd538303a3114bcc7e0b74f1404258b836f7412 +- kind: project-relative + target: codex + value: .agents/skills/github-workflow/agents/openai.yaml + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: sha256:1d8dfa53b85500f8d112c039d1c522dde129d140208c65d7145aa55e70eae329 +- kind: project-relative + target: codex + value: .agents/skills/github-workflow/references/fallback-pr-body.md + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: sha256:b98239e7d4cdddd8e267ab155f4e4c38fcc514526d9a32f13fcd5b21a1c07eb2 - kind: project-relative target: codex value: .agents/skills/github-workflow/scripts/check_llm_disclosure.py @@ -580,7 +602,7 @@ deployments: owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:76c8c0d01064417e4d8e709a22f2b60b5ec62a57d9c641029e95c76a8b39b79d + content_hash: sha256:8827207925dfe0648856628561433435a6c3bd3f27e8497a784b809e90c9441d - kind: project-relative target: codex value: .agents/skills/python-quality-check/agents/openai.yaml @@ -598,7 +620,7 @@ deployments: owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:0f97408fd9f98dc43d468064e4f601eb26ce10e01939a9cc8ba3227ca97b6947 + content_hash: sha256:e52aaf46c28816d6f6262a5421dba8de9f906d2b606987bedcda840d2e687281 - kind: project-relative target: codex value: .agents/skills/python-quality-check/references/tooling-and-testing.md @@ -607,7 +629,7 @@ deployments: owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:61ff7e27674d45949003576bef5bdb0c225172f69ba1d6c0a3129feabc42c23a + content_hash: sha256:8dd45ccbf2818d73c6497beec400567c294eec842199eaf329e856d40446e771 - kind: project-relative target: codex value: .agents/skills/python-quality-check/scripts/check_project.py diff --git a/apm.yml b/apm.yml index a4680f3..37f414e 100644 --- a/apm.yml +++ b/apm.yml @@ -8,7 +8,7 @@ targets: dependencies: apm: - git: aoirint/skills - ref: 329572438060c1b0c34882b2c3a8e388ae30cd1a + ref: 82fb9ef5149bf59721053fc881e499b7a67ac39b skills: - apm-usage - changelog-workflow