build(apm): roll out artifact-link guidance

.agents/skills/docker-quality-check/SKILL.md

@@ -40,7 +40,9 @@ description: >-
 6. For newly introduced or updated external images, downloaded executables, or GitHub
    Actions, use `security-check` to assess provenance, version or digest pinning,
    release age, checksums, permissions, and runtime behavior. Pin GitHub Actions to
-   full commit SHAs with accurate version comments.
+   full commit SHAs with accurate version comments. Use
+   `github-actions-quality-check` for workflow structure, permissions, runners,
+   validation, and publication gates.
 7. Summarize commands run, build and smoke-test results, and every skipped check with a
    concrete reason.
 
@@ -50,13 +52,7 @@ When a workflow installs hadolint, pin both the release version and the SHA-256
 exact platform asset. Download over HTTPS, verify the hash before making the file
 executable, and install it only into the runner's temporary directory. Before changing
 a pin, verify the official release provenance and the repository's required adoption
-cooldown.
-
-```shell
-curl -sSfLO https://github.com/hadolint/hadolint/releases/download/v2.14.0/hadolint-linux-x86_64
-echo "6bf226944684f56c84dd014e8b979d27425c0148f61b3bd99bcc6f39e9dc5a47  hadolint-linux-x86_64" | sha256sum -c -
-install -m 0755 hadolint-linux-x86_64 "$RUNNER_TEMP/bin/hadolint"
-```
+cooldown. Use the bundled `lint-docker` action when its single-Dockerfile contract fits.
 
 Replace the version and checksum together only after independently verifying the
 official release asset. Do not use a floating download URL or skip hash verification.
@@ -72,3 +68,11 @@ docker compose config
 Replace these examples with the repository's documented file paths, build targets, tags,
 and Compose files. Do not treat a successful syntax check as evidence that the image
 builds or starts correctly.
+
+## CI Templates
+
+Read [ci-template-contract.md](references/ci-template-contract.md) before creating or
+repairing Docker CI. The bundled files under `assets/github/` keep pull-request checks
+limited to lint and reserve image builds for the exact integrated main-branch commit.
+Apply `github-actions-quality-check` for shared event, permission, runner, pinning, and
+repository-enforcement policy.

.agents/skills/docker-quality-check/assets/github/actions/lint-docker/action.yml

@@ -0,0 +1,26 @@
+name: Lint Docker source
+description: Install a verified hadolint binary and lint the repository Dockerfile.
+
+runs:
+  using: composite
+  steps:
+    - name: Install checksum-verified hadolint
+      shell: bash
+      env:
+        HADOLINT_VERSION: v2.15.1
+        HADOLINT_SHA256: c7187db94eeeeca956519a6af171adc31453941a1e777961f6e680f697c8c507
+      run: |-
+        install_dir="${RUNNER_TEMP}/hadolint/bin"
+        asset="hadolint-linux-x86_64"
+        mkdir -p "${install_dir}"
+        curl --fail --location --silent --show-error \
+          --output "${install_dir}/${asset}" \
+          "https://github.com/hadolint/hadolint/releases/download/${HADOLINT_VERSION}/${asset}"
+        echo "${HADOLINT_SHA256}  ${install_dir}/${asset}" | sha256sum --check --strict
+        mv "${install_dir}/${asset}" "${install_dir}/hadolint"
+        chmod 0755 "${install_dir}/hadolint"
+        echo "${install_dir}" >> "${GITHUB_PATH}"
+
+    - name: Lint Dockerfile
+      shell: bash
+      run: hadolint Dockerfile

.agents/skills/docker-quality-check/assets/github/workflows/main.yml

@@ -0,0 +1,53 @@
+name: Main
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: main-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  checks:
+    name: Checks
+    # Keep the lightweight gate independent from Docker daemon requirements.
+    runs-on: ubuntu-slim
+    timeout-minutes: 5
+
+    steps:
+      - name: Checkout integrated source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Lint Docker source
+        uses: ./.github/actions/lint-docker
+
+  build:
+    name: Build
+    needs:
+      - checks
+
+    # Build only integrated source; proposed-source validation stays lightweight.
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Checkout integrated source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Build Docker image without publishing
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: ./Dockerfile
+          push: false

.agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml

@@ -0,0 +1,32 @@
+name: Pull Request
+
+on:
+  pull_request:
+    branches:
+      - main
+  merge_group:
+    types:
+      - checks_requested
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pull-request-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  checks:
+    name: Checks
+    # Avoid a network-intensive image build for proposed source.
+    runs-on: ubuntu-slim
+    timeout-minutes: 5
+
+    steps:
+      - name: Checkout proposed source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Lint Docker source
+        uses: ./.github/actions/lint-docker

.agents/skills/docker-quality-check/references/ci-template-contract.md

@@ -0,0 +1,47 @@
+# Docker CI Template Contract
+
+## Purpose
+
+Use the bundled baseline for a repository with one root `Dockerfile`. It keeps proposed-source
+checks fast by running hadolint only. The integrated main-branch workflow repeats lint and then
+builds the exact merged commit without publishing it.
+
+## Files
+
+| Skill asset | Consumer path | Contract |
+| --- | --- | --- |
+| `assets/github/actions/lint-docker/action.yml` | `.github/actions/lint-docker/action.yml` | Install checksum-verified hadolint and lint the root `Dockerfile`. |
+| `assets/github/workflows/pull-request.yml` | `.github/workflows/pull-request.yml` | Lint pull-request and merge-queue source; cancel superseded runs. |
+| `assets/github/workflows/main.yml` | `.github/workflows/main.yml` | Re-run lint and build the integrated commit; never cancel it. |
+
+Copy the files into the consumer repository. Consumer workflows must run committed
+repository-owned files and must not execute the installed Skill at runtime.
+
+## Allowed substitutions
+
+- Replace `main` only with the confirmed protected integration branch.
+- Replace the root Dockerfile path or add a lint matrix when the repository owns multiple
+  Dockerfiles.
+- Pass repository-evidenced build contexts, Dockerfile paths, targets, build arguments, secrets,
+  or cache settings to the integrated build.
+- Add Compose validation, tests, or smoke checks when the repository documents those contracts.
+- Add registry authentication and publication only in an integration job with the minimum required
+  permissions and secrets.
+- Make an immutable release depend directly on the published image and every required image test.
+- Update external Action pins or the hadolint version and checksum only after `security-check`
+  verifies provenance, runtime behavior, exact identity, and cooldown eligibility.
+
+Do not add Docker build or publication to the pull-request workflow merely to mirror main. Do not
+expose registry credentials to proposed source, rebuild an image in a release job, or create a
+release before the published image passes its required tests.
+
+## Adoption checks
+
+1. Inventory existing workflow responsibilities and retire only duplicated entry workflows.
+2. Apply `github-actions-quality-check` and preserve its event, permission, concurrency, runner,
+   and immutable-pin requirements.
+3. Run hadolint locally against every selected Dockerfile.
+4. Run actionlint across workflows and actions, ShellCheck against changed standalone shell
+   scripts, and `pinact run --check --min-age 7`.
+5. Observe the Checks job on a pull request and both Checks and Build jobs on the integrated commit
+   before making their contexts required.

.agents/skills/github-workflow/README.md

@@ -2,7 +2,7 @@
 
 ## Overview
 
-Create and review GitHub Actions workflows, repository issues, and pull requests.
+Create and review GitHub repository issues, pull requests, and their comments.
 
 ## Install