From 71f0a18b11e5302940ba0d24c9e3af213f431b01 Mon Sep 17 00:00:00 2001 From: aoirint Date: Tue, 11 Aug 2026 15:08:30 +0900 Subject: [PATCH 1/5] ci: align source checks and agent skills Co-authored-by: Codex --- .agents/skills/apm-usage/agents/openai.yaml | 4 - .../assets/check-apm-project/action.yml | 94 ------------ .../skills/apm-usage/references/ci-guards.md | 109 ------------- .../{apm-usage => apm-workflow}/README.md | 4 +- .../{apm-usage => apm-workflow}/SKILL.md | 24 +-- .../skills/apm-workflow/agents/openai.yaml | 4 + .../references/apm-bootstrap.json | 25 ++- .../scripts/propose_bootstrap_update.py | 4 +- .../scripts/propose_bootstrap_update.py.lock | 0 .agents/skills/docker-quality-check/SKILL.md | 7 +- .../actions/check-docker-source/action.yml | 37 +++++ .../check-docker-source/install-hadolint.sh | 29 ++++ .../github/actions/lint-docker/action.yml | 26 ---- .../assets/github/workflows/main.yml | 8 +- .../assets/github/workflows/pull-request.yml | 6 +- .../references/ci-template-contract.md | 2 +- .agents/skills/python-quality-check/SKILL.md | 4 + .../actions/setup-python-locked/action.yml | 43 ++++++ .../resolve-python-contract.sh | 23 +++ .../actions/check-docker-source/action.yml | 37 +++++ .../check-docker-source/install-hadolint.sh | 29 ++++ .github/actions/lint-docker/action.yml | 25 --- .github/workflows/main.yml | 9 +- .github/workflows/pull-request.yml | 7 +- AGENTS.md | 2 +- THIRD_PARTY_NOTICES.md | 6 +- apm.lock.yaml | 145 ++++++++++-------- apm.yml | 4 +- 28 files changed, 331 insertions(+), 386 deletions(-) delete mode 100644 .agents/skills/apm-usage/agents/openai.yaml delete mode 100644 .agents/skills/apm-usage/assets/check-apm-project/action.yml delete mode 100644 .agents/skills/apm-usage/references/ci-guards.md rename .agents/skills/{apm-usage => apm-workflow}/README.md (63%) rename .agents/skills/{apm-usage => apm-workflow}/SKILL.md (95%) create mode 100644 .agents/skills/apm-workflow/agents/openai.yaml rename .agents/skills/{apm-usage => apm-workflow}/references/apm-bootstrap.json (53%) rename .agents/skills/{apm-usage => apm-workflow}/scripts/propose_bootstrap_update.py (98%) rename .agents/skills/{apm-usage => apm-workflow}/scripts/propose_bootstrap_update.py.lock (100%) create mode 100644 .agents/skills/docker-quality-check/assets/github/actions/check-docker-source/action.yml create mode 100644 .agents/skills/docker-quality-check/assets/github/actions/check-docker-source/install-hadolint.sh delete mode 100644 .agents/skills/docker-quality-check/assets/github/actions/lint-docker/action.yml create mode 100644 .agents/skills/python-quality-check/assets/github/actions/setup-python-locked/action.yml create mode 100644 .agents/skills/python-quality-check/assets/github/actions/setup-python-locked/resolve-python-contract.sh create mode 100644 .github/actions/check-docker-source/action.yml create mode 100644 .github/actions/check-docker-source/install-hadolint.sh delete mode 100644 .github/actions/lint-docker/action.yml diff --git a/.agents/skills/apm-usage/agents/openai.yaml b/.agents/skills/apm-usage/agents/openai.yaml deleted file mode 100644 index c400350..0000000 --- a/.agents/skills/apm-usage/agents/openai.yaml +++ /dev/null @@ -1,4 +0,0 @@ -interface: - display_name: "APM Usage" - short_description: "Select APM safely and manage pinned agent dependencies" - default_prompt: "Use $apm-usage to select an eligible APM version and safely manage this project's pinned agent dependencies." diff --git a/.agents/skills/apm-usage/assets/check-apm-project/action.yml b/.agents/skills/apm-usage/assets/check-apm-project/action.yml deleted file mode 100644 index 4402750..0000000 --- a/.agents/skills/apm-usage/assets/check-apm-project/action.yml +++ /dev/null @@ -1,94 +0,0 @@ -name: Check APM project -description: Check unpublished APM project and lock generator versions. - -inputs: - expected-apm-version: - description: Expected APM CLI version recorded by apm.lock.yaml. - required: true - expected-project-version: - description: Expected unpublished project version in apm.yml. - required: false - default: "0.0.0" - -runs: - using: composite - steps: - - name: Check APM project metadata - shell: bash - working-directory: ${{ github.workspace }} - env: - APM_GUARD_EXPECTED_APM_VERSION: ${{ inputs.expected-apm-version }} - APM_GUARD_EXPECTED_PROJECT_VERSION: ${{ inputs.expected-project-version }} - run: | - python3 - <<'PY' - import os - import re - import sys - from pathlib import Path - - top_level_scalar = re.compile( - r"^([A-Za-z_][A-Za-z0-9_-]*):(?:[ \t]+(.*?))?[ \t]*$" - ) - - - def read_top_level_scalar(path: Path, key: str) -> str: - matches = [] - for line in path.read_text(encoding="utf-8").splitlines(): - if not line or line[0].isspace() or line.startswith("#"): - continue - match = top_level_scalar.match(line) - if not match or match.group(1) != key: - continue - value = (match.group(2) or "").strip() - if value.startswith(("\"", "'")): - quote = value[0] - end = value.find(quote, 1) - suffix = value[end + 1 :].strip() if end >= 0 else "invalid" - if end < 0 or (suffix and not suffix.startswith("#")): - value = "" - else: - value = value[1:end] - else: - value = re.split(r"[ \t]+#", value, maxsplit=1)[0].rstrip() - matches.append(value) - - if len(matches) != 1 or not matches[0]: - raise ValueError( - f"{path}: expected exactly one non-empty top-level {key!r}" - ) - return matches[0] - - - root = Path.cwd().resolve() - checks = ( - ( - root / "apm.yml", - "version", - os.environ["APM_GUARD_EXPECTED_PROJECT_VERSION"], - ), - ( - root / "apm.lock.yaml", - "apm_version", - os.environ["APM_GUARD_EXPECTED_APM_VERSION"], - ), - ) - errors = [] - for path, key, expected in checks: - try: - actual = read_top_level_scalar(path, key) - except (OSError, UnicodeError, ValueError) as error: - errors.append(str(error)) - continue - if actual != expected: - errors.append(f"{path}: {key} is {actual!r}; expected {expected!r}") - - if errors: - for error in errors: - print(f"error: {error}", file=sys.stderr) - raise SystemExit(1) - - print( - "APM project metadata is valid " - f"(project {checks[0][2]}, APM {checks[1][2]})." - ) - PY diff --git a/.agents/skills/apm-usage/references/ci-guards.md b/.agents/skills/apm-usage/references/ci-guards.md deleted file mode 100644 index bbce59b..0000000 --- a/.agents/skills/apm-usage/references/ci-guards.md +++ /dev/null @@ -1,109 +0,0 @@ -# CI Guards - -Use these guards when a repository wants reproducible APM metadata and -Markdown lint checks without adding an installer to the lint job. - -## Contents - -- [APM project metadata](#apm-project-metadata) -- [Markdown lint through pnpm dlx](#markdown-lint-through-pnpm-dlx) - -## APM project metadata - -The Skill includes `assets/check-apm-project/action.yml` as the reviewed -template for a small repository-owned Composite Action. Copy the action to -`.github/actions/check-apm-project/action.yml`. Do not invoke the deployed Skill -path from CI: that would make a consumer workflow depend on the Skill's -internal directory structure. - -The copied guard checks two repository invariants: - -- top-level `version` in `apm.yml` is `0.0.0` for an unpublished project; -- top-level `apm_version` in `apm.lock.yaml` matches the selected APM version. - -Add one step to an existing composite lint action: - -```yaml -- name: Check APM project metadata - uses: ./.github/actions/check-apm-project - with: - expected-apm-version: "0.26.0" -``` - -The check uses only the Python standard library available on the selected -runner and does not download or execute APM. Review the copied Composite Action -as repository code, and update its caller's expected APM version in the same PR -that deliberately changes the lock generator version. - -If it reports a lock generator mismatch, invoke the reviewed APM executable by -absolute path, remove only the validated repository's `apm.lock.yaml`, and run -`apm lock`. Review the full regenerated lock, run `apm install --frozen`, and -then run `apm audit --ci`. Never repair the version field manually. - -## Markdown lint through pnpm dlx - -Pin the package version and make pnpm reject packages that have not completed -seven full days since publication, including packages with missing publication -times: - -```shell -pnpm \ - --config.minimumReleaseAge=10080 \ - --config.minimumReleaseAgeStrict=true \ - --config.minimumReleaseAgeIgnoreMissingTime=false \ - --config.minimumReleaseAgeExclude= \ - dlx markdownlint-cli2@0.22.0 \ - --config .markdownlint-cli2.yaml \ - '**/*.md' -``` - -[pnpm's `minimumReleaseAge` setting](https://pnpm.io/settings#minimumreleaseage) -is measured in minutes, so `10080` is seven days. Use pnpm 11 or newer because -all three fail-closed settings are supported there. Invoke -the reviewed pnpm executable by its resolved path, confirm `pnpm --version`, -and keep the strict, missing-time, and empty-exclusion settings explicit rather -than relying on pnpm defaults or global configuration. Before adopting the -command, confirm the effective values with the same CLI: - -```shell -pnpm --config.minimumReleaseAge=10080 config get minimumReleaseAge -pnpm --config.minimumReleaseAgeStrict=true config get minimumReleaseAgeStrict -pnpm --config.minimumReleaseAgeIgnoreMissingTime=false \ - config get minimumReleaseAgeIgnoreMissingTime -pnpm --config.minimumReleaseAgeExclude= config get minimumReleaseAgeExclude -``` - -Run the pinned `dlx` command in a clean process with no project-local pnpm -configuration overriding these command-line values. An exact package version -does not replace the cooldown gate; keep both. - -Confirm that the resolver actually enforces the gate with a safe negative -control. In a unique operating-system temporary directory, use an isolated -pnpm store and ask the resolver to add the same reviewed -`markdownlint-cli2@0.22.0` with an intentionally larger age such as `5256000` -minutes: - -```shell -probe_dir="$(mktemp -d)" -( - cd "$probe_dir" - pnpm \ - --config.storeDir="$probe_dir/store" \ - --config.minimumReleaseAge=5256000 \ - --config.minimumReleaseAgeStrict=true \ - --config.minimumReleaseAgeIgnoreMissingTime=false \ - --config.minimumReleaseAgeExclude= \ - --ignore-scripts \ - add --lockfile-only markdownlint-cli2@0.22.0 -) -``` - -The command must fail with `ERR_PNPM_NO_MATURE_MATCHING_VERSION`; any other -result is a failed probe. `--lockfile-only --ignore-scripts` prevents package -or lifecycle-script execution even if the cooldown is ineffective. After this -negative control, run the real seven-day `dlx` command and require success. - -For locally auto-fixable findings, add `--fix` after the package version and -run the normal lint command again afterward. `markdownlint-cli2 --fix` does not -repair every rule; line-length findings such as prose reported by MD013 can -still require a formatter or a meaning-preserving manual edit. diff --git a/.agents/skills/apm-usage/README.md b/.agents/skills/apm-workflow/README.md similarity index 63% rename from .agents/skills/apm-usage/README.md rename to .agents/skills/apm-workflow/README.md index ac026cd..b3adcef 100644 --- a/.agents/skills/apm-usage/README.md +++ b/.agents/skills/apm-workflow/README.md @@ -1,4 +1,4 @@ -# apm-usage +# apm-workflow ## Overview @@ -7,5 +7,5 @@ Safely set up, pin, deploy, audit, and update APM-managed agent dependencies. ## Install ```shell -apm install aoirint/skills/.apm/skills/apm-usage +apm install aoirint/skills/.apm/skills/apm-workflow ``` diff --git a/.agents/skills/apm-usage/SKILL.md b/.agents/skills/apm-workflow/SKILL.md similarity index 95% rename from .agents/skills/apm-usage/SKILL.md rename to .agents/skills/apm-workflow/SKILL.md index c18db37..205147c 100644 --- a/.agents/skills/apm-usage/SKILL.md +++ b/.agents/skills/apm-workflow/SKILL.md @@ -1,9 +1,9 @@ --- -name: apm-usage +name: apm-workflow description: Select a reviewed APM CLI version, then set up, pin, deploy, audit, and update APM-managed agent dependencies safely. Use when creating or editing apm.yml or apm.lock.yaml, choosing or installing APM, adding an Agent Skill, plugin, or MCP dependency, validating a pinned deployment, or preparing a cooldown-aware update proposal. --- -# APM Usage +# APM Workflow Keep agent context reproducible and reviewable. Select the newest reviewed APM release that has completed the seven-day cooldown or has a manifest-recorded @@ -118,7 +118,7 @@ Do not change the bootstrap manifest automatically. Use this proposal flow: release notes, installer and artifact integrity, and compatibility from the current official sources. Require explicit maintainer approval. 3. Run - `uv run --no-project --no-config --locked --script /scripts/propose_bootstrap_update.py` + `uv run --no-project --no-config --locked --script /scripts/propose_bootstrap_update.py` to isolate the locked helper from the consumer repository's uv configuration and collect an eligible candidate without changing files. Attach its JSON output to the proposal. @@ -205,21 +205,7 @@ or MCP dependency: `apm audit --ci` to the project's existing CI when the user requests CI enforcement. -### 3.1 Add the lightweight project-metadata guard - -When a repository already has a source-lint composite action, add the -repository-owned metadata guard described in [CI guards](references/ci-guards.md). -It verifies the unpublished project version and the lock generator version -without downloading or executing APM. Keep it in the existing lint job so -adoption requires one step rather than a new workflow. Do not make consumer CI -depend on a path inside the deployed Skill; copy the template into the -repository's own `.github/actions/check-apm-project/` directory. - -The metadata guard is not a replacement for `apm install --frozen` or -`apm audit --ci`. Add those separately when the requested CI policy includes -dependency replay, deployed-file integrity, or security auditing. - -### 3.2 Maintain a packaged Skill collection +### 3.1 Maintain a packaged Skill collection Apply this section only when a repository publishes Skill copies in both an authoring target such as `.agents/skills/` and a package directory such as @@ -242,7 +228,7 @@ authoring target such as `.agents/skills/` and a package directory such as use `git diff --cached --check` and a content review to distinguish a real generated-file delta from line-ending noise. -### 3.3 Rename or remove packaged local Skills +### 3.2 Rename or remove packaged local Skills Apply this section when a local packaged Skill is renamed, consolidated, or removed. Treat it as a deployment-ledger change, not a documentation-only diff --git a/.agents/skills/apm-workflow/agents/openai.yaml b/.agents/skills/apm-workflow/agents/openai.yaml new file mode 100644 index 0000000..ba6ea95 --- /dev/null +++ b/.agents/skills/apm-workflow/agents/openai.yaml @@ -0,0 +1,4 @@ +interface: + display_name: "APM Workflow" + short_description: "Select APM safely and manage pinned agent dependencies" + default_prompt: "Use $apm-workflow to select an eligible APM version and safely manage this project's pinned agent dependencies." diff --git a/.agents/skills/apm-usage/references/apm-bootstrap.json b/.agents/skills/apm-workflow/references/apm-bootstrap.json similarity index 53% rename from .agents/skills/apm-usage/references/apm-bootstrap.json rename to .agents/skills/apm-workflow/references/apm-bootstrap.json index 22c5f98..f55ba79 100644 --- a/.agents/skills/apm-usage/references/apm-bootstrap.json +++ b/.agents/skills/apm-workflow/references/apm-bootstrap.json @@ -1,45 +1,40 @@ { - "version": "v0.26.0", - "published_at": "2026-07-18T21:57:33Z", + "version": "v0.27.0", + "published_at": "2026-08-02T20:11:22Z", "cooldown_days": 7, - "eligible_on": "2026-07-25T21:57:33Z", - "release_url": "https://github.com/microsoft/apm/releases/tag/v0.26.0", + "eligible_on": "2026-08-09T20:11:22Z", + "release_url": "https://github.com/microsoft/apm/releases/tag/v0.27.0", "download_url_template": "https://github.com/microsoft/apm/releases/download/{version}/{asset}", "assets": [ { "platform": "macos-arm64", "archive": "apm-darwin-arm64.tar.gz", "extracted_directory": "apm-darwin-arm64", - "sha256": "febddd0a8beb4be7b411e708ed746937a14482d5e0935eb776b7f35e320654df" + "sha256": "4c68e5eaa3cfdb0b25734c316deb532835eaf3c3e2f7379a4c7c06918043a641" }, { "platform": "macos-x86_64", "archive": "apm-darwin-x86_64.tar.gz", "extracted_directory": "apm-darwin-x86_64", - "sha256": "6cc47251bbefabe36224bcc5370c1ef08405d4fd15900b42e11ba672ae29483f" + "sha256": "846b30055d96cbc6fa0fcf451f50d13f632b540ffdff344873a025bba607e25a" }, { "platform": "linux-arm64", "archive": "apm-linux-arm64.tar.gz", "extracted_directory": "apm-linux-arm64", - "sha256": "c4d6b5ab6d9bdca3c3c324db7ce8d1c4faf7b317f45a55a50ae2571eaa506d25" + "sha256": "7df6e64ca9540665367f07af0226077ba92820f6cc759c10a5ca37e038a500e4" }, { "platform": "linux-x86_64", "archive": "apm-linux-x86_64.tar.gz", "extracted_directory": "apm-linux-x86_64", - "sha256": "3afba455c5283852ba4c392f668be7c27b65bc4a0fa60a8b53a4626c52628431" + "sha256": "be2d8a97ca8816636117ec26da85482d647ae3353213ea022fb1130c2dd3d3b0" }, { "platform": "windows-x86_64", "archive": "apm-windows-x86_64.zip", "extracted_directory": "apm-windows-x86_64", - "sha256": "1b74a90c7ee6373ab2926addd110c1dbc5934a9675e5f436cac4d04f46cce2f5" + "sha256": "1a7703864babee7deaab3d13b4fe50b51ea5c1ae2edb2dae46fbbab5a6cead9d" } - ], - "cooldown_exception": { - "approved_at": "2026-07-24T13:48:14Z", - "reason": "APM 0.26.0 fixes audit config-consistency false failures for virtual packages (microsoft/apm#2214).", - "scope": "bootstrap-cli-release-time-gate" - } + ] } diff --git a/.agents/skills/apm-usage/scripts/propose_bootstrap_update.py b/.agents/skills/apm-workflow/scripts/propose_bootstrap_update.py similarity index 98% rename from .agents/skills/apm-usage/scripts/propose_bootstrap_update.py rename to .agents/skills/apm-workflow/scripts/propose_bootstrap_update.py index 7d7938c..0cfed40 100644 --- a/.agents/skills/apm-usage/scripts/propose_bootstrap_update.py +++ b/.agents/skills/apm-workflow/scripts/propose_bootstrap_update.py @@ -31,13 +31,13 @@ def semver(tag: str) -> tuple[int, int, int]: def request_json(url: str) -> object: - request = urllib.request.Request(url, headers={"Accept": "application/vnd.github+json", "User-Agent": "apm-usage-skill"}) + request = urllib.request.Request(url, headers={"Accept": "application/vnd.github+json", "User-Agent": "apm-workflow-skill"}) with urllib.request.urlopen(request, timeout=30) as response: return json.load(response) def request_text(url: str) -> str: - request = urllib.request.Request(url, headers={"User-Agent": "apm-usage-skill"}) + request = urllib.request.Request(url, headers={"User-Agent": "apm-workflow-skill"}) with urllib.request.urlopen(request, timeout=30) as response: return response.read().decode("utf-8") diff --git a/.agents/skills/apm-usage/scripts/propose_bootstrap_update.py.lock b/.agents/skills/apm-workflow/scripts/propose_bootstrap_update.py.lock similarity index 100% rename from .agents/skills/apm-usage/scripts/propose_bootstrap_update.py.lock rename to .agents/skills/apm-workflow/scripts/propose_bootstrap_update.py.lock diff --git a/.agents/skills/docker-quality-check/SKILL.md b/.agents/skills/docker-quality-check/SKILL.md index 3f627a1..f065539 100644 --- a/.agents/skills/docker-quality-check/SKILL.md +++ b/.agents/skills/docker-quality-check/SKILL.md @@ -42,7 +42,10 @@ description: >- release age, checksums, permissions, and runtime behavior. Pin GitHub Actions to full commit SHAs with accurate version comments. Use `github-actions-quality-check` for workflow structure, permissions, runners, - validation, and publication gates. + validation, and publication gates. For an APM-managed repository, apply + `apm-workflow` and keep `apm audit --ci` in the outer source-check action. + Keep Markdown source validation in that same action so container-only + changes cannot bypass the repository documentation gate. 7. Summarize commands run, build and smoke-test results, and every skipped check with a concrete reason. @@ -52,7 +55,7 @@ When a workflow installs hadolint, pin both the release version and the SHA-256 exact platform asset. Download over HTTPS, verify the hash before making the file executable, and install it only into the runner's temporary directory. Before changing a pin, verify the official release provenance and the repository's required adoption -cooldown. Use the bundled `lint-docker` action when its single-Dockerfile contract fits. +cooldown. Use the bundled `check-docker-source` action when its single-Dockerfile contract fits. Replace the version and checksum together only after independently verifying the official release asset. Do not use a floating download URL or skip hash verification. diff --git a/.agents/skills/docker-quality-check/assets/github/actions/check-docker-source/action.yml b/.agents/skills/docker-quality-check/assets/github/actions/check-docker-source/action.yml new file mode 100644 index 0000000..b3979ed --- /dev/null +++ b/.agents/skills/docker-quality-check/assets/github/actions/check-docker-source/action.yml @@ -0,0 +1,37 @@ +name: Check Docker source +description: Audit APM, lint Docker and Markdown source, and remove action-owned tools. + +runs: + using: composite + steps: + - name: Set up reviewed APM CLI + uses: microsoft/apm-action@d723bb64ed70c135bbaf87d126b721dd2dae0439 # v1.10.0 + with: + apm-version: "0.27.0" + setup-only: "true" + + - name: Audit APM deployment + shell: bash + run: apm audit --ci + + - name: Install checksum-verified hadolint + shell: bash + env: + HADOLINT_VERSION: v2.15.1 + HADOLINT_SHA256: c7187db94eeeeca956519a6af171adc31453941a1e777961f6e680f697c8c507 + run: bash "${{ github.action_path }}/install-hadolint.sh" + + - name: Lint Dockerfile + shell: bash + run: hadolint Dockerfile + + - name: Lint Markdown source + uses: DavidAnson/markdownlint-cli2-action@ce4853d43830c74c1753b39f3cf40f71c2031eb9 # v23.0.0 + with: + config: .markdownlint-cli2.yaml + globs: "**/*.md" + + - name: Remove hadolint + if: always() + shell: bash + run: rm -rf -- "${RUNNER_TEMP}/hadolint" diff --git a/.agents/skills/docker-quality-check/assets/github/actions/check-docker-source/install-hadolint.sh b/.agents/skills/docker-quality-check/assets/github/actions/check-docker-source/install-hadolint.sh new file mode 100644 index 0000000..30d7a78 --- /dev/null +++ b/.agents/skills/docker-quality-check/assets/github/actions/check-docker-source/install-hadolint.sh @@ -0,0 +1,29 @@ +#!/usr/bin/env bash + +set -euo pipefail + +main() { + : "${HADOLINT_VERSION:?HADOLINT_VERSION is required}" + : "${HADOLINT_SHA256:?HADOLINT_SHA256 is required}" + : "${RUNNER_TEMP:?RUNNER_TEMP is required}" + : "${GITHUB_PATH:?GITHUB_PATH is required}" + + local asset=hadolint-linux-x86_64 + local install_dir="${RUNNER_TEMP}/hadolint/bin" + local download_path="${install_dir}/${asset}" + mkdir -p "$install_dir" + curl \ + --fail \ + --location \ + --show-error \ + --silent \ + --output "$download_path" \ + "https://github.com/hadolint/hadolint/releases/download/${HADOLINT_VERSION}/${asset}" + printf '%s %s\n' "$HADOLINT_SHA256" "$download_path" | + sha256sum --check --strict + mv "$download_path" "${install_dir}/hadolint" + chmod 0755 "${install_dir}/hadolint" + printf '%s\n' "$install_dir" >>"$GITHUB_PATH" +} + +main "$@" diff --git a/.agents/skills/docker-quality-check/assets/github/actions/lint-docker/action.yml b/.agents/skills/docker-quality-check/assets/github/actions/lint-docker/action.yml deleted file mode 100644 index 568f2d9..0000000 --- a/.agents/skills/docker-quality-check/assets/github/actions/lint-docker/action.yml +++ /dev/null @@ -1,26 +0,0 @@ -name: Lint Docker source -description: Install a verified hadolint binary and lint the repository Dockerfile. - -runs: - using: composite - steps: - - name: Install checksum-verified hadolint - shell: bash - env: - HADOLINT_VERSION: v2.15.1 - HADOLINT_SHA256: c7187db94eeeeca956519a6af171adc31453941a1e777961f6e680f697c8c507 - run: |- - install_dir="${RUNNER_TEMP}/hadolint/bin" - asset="hadolint-linux-x86_64" - mkdir -p "${install_dir}" - curl --fail --location --silent --show-error \ - --output "${install_dir}/${asset}" \ - "https://github.com/hadolint/hadolint/releases/download/${HADOLINT_VERSION}/${asset}" - echo "${HADOLINT_SHA256} ${install_dir}/${asset}" | sha256sum --check --strict - mv "${install_dir}/${asset}" "${install_dir}/hadolint" - chmod 0755 "${install_dir}/hadolint" - echo "${install_dir}" >> "${GITHUB_PATH}" - - - name: Lint Dockerfile - shell: bash - run: hadolint Dockerfile diff --git a/.agents/skills/docker-quality-check/assets/github/workflows/main.yml b/.agents/skills/docker-quality-check/assets/github/workflows/main.yml index 349b5b7..9fd2eae 100644 --- a/.agents/skills/docker-quality-check/assets/github/workflows/main.yml +++ b/.agents/skills/docker-quality-check/assets/github/workflows/main.yml @@ -13,8 +13,8 @@ concurrency: cancel-in-progress: false jobs: - checks: - name: Checks + check: + name: Check # Keep the lightweight gate independent from Docker daemon requirements. runs-on: ubuntu-slim timeout-minutes: 5 @@ -26,12 +26,12 @@ jobs: persist-credentials: false - name: Lint Docker source - uses: ./.github/actions/lint-docker + uses: ./.github/actions/check-docker-source build: name: Build needs: - - checks + - check # Build only integrated source; proposed-source validation stays lightweight. runs-on: ubuntu-24.04 diff --git a/.agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml b/.agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml index 2dc61bd..4e324bd 100644 --- a/.agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml +++ b/.agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml @@ -16,8 +16,8 @@ concurrency: cancel-in-progress: true jobs: - checks: - name: Checks + check: + name: Check # Avoid a network-intensive image build for proposed source. runs-on: ubuntu-slim timeout-minutes: 5 @@ -29,4 +29,4 @@ jobs: persist-credentials: false - name: Lint Docker source - uses: ./.github/actions/lint-docker + uses: ./.github/actions/check-docker-source diff --git a/.agents/skills/docker-quality-check/references/ci-template-contract.md b/.agents/skills/docker-quality-check/references/ci-template-contract.md index 415c699..fb0e112 100644 --- a/.agents/skills/docker-quality-check/references/ci-template-contract.md +++ b/.agents/skills/docker-quality-check/references/ci-template-contract.md @@ -10,7 +10,7 @@ builds the exact merged commit without publishing it. | Skill asset | Consumer path | Contract | | --- | --- | --- | -| `assets/github/actions/lint-docker/action.yml` | `.github/actions/lint-docker/action.yml` | Install checksum-verified hadolint and lint the root `Dockerfile`. | +| `assets/github/actions/check-docker-source/action.yml` | `.github/actions/check-docker-source/action.yml` | Install checksum-verified hadolint and lint the root `Dockerfile`. | | `assets/github/workflows/pull-request.yml` | `.github/workflows/pull-request.yml` | Lint pull-request and merge-queue source; cancel superseded runs. | | `assets/github/workflows/main.yml` | `.github/workflows/main.yml` | Re-run lint and build the integrated commit; never cancel it. | diff --git a/.agents/skills/python-quality-check/SKILL.md b/.agents/skills/python-quality-check/SKILL.md index 059d02a..b40c394 100644 --- a/.agents/skills/python-quality-check/SKILL.md +++ b/.agents/skills/python-quality-check/SKILL.md @@ -95,6 +95,10 @@ testing, coverage, or distribution rules. 5. Align CI and distribution. - Read [ci-and-distribution.md](references/ci-and-distribution.md) before changing workflows, build metadata, wheels, sdists, executables, or releases. + - Use this Skill's `assets/github/actions/setup-python-locked` as the single + shared implementation for committed Python/uv resolution, cache setup, + lock verification, and synchronization. Domain Skills may compose the + installed local action but must not carry another editable copy. - Re-run the complete locked validation on pull requests and on the exact protected integration-branch commit. - Build applicable distributions from a clean reviewed commit. Inspect diff --git a/.agents/skills/python-quality-check/assets/github/actions/setup-python-locked/action.yml b/.agents/skills/python-quality-check/assets/github/actions/setup-python-locked/action.yml new file mode 100644 index 0000000..807c282 --- /dev/null +++ b/.agents/skills/python-quality-check/assets/github/actions/setup-python-locked/action.yml @@ -0,0 +1,43 @@ +name: Set up locked Python environment +description: Install reviewed uv/Python and synchronize the exact locked graph. + +outputs: + environment-owned: + description: Whether this action established ownership of the project environment. + value: ${{ steps.ownership.outputs.environment-owned }} + python_version: + description: Python version selected from .python-version. + value: ${{ steps.toolchain.outputs.python_version }} + uv_version: + description: Reviewed uv version used for the locked environment. + value: ${{ steps.toolchain.outputs.uv_version }} + +runs: + using: composite + steps: + - name: Reserve the Python environment + id: ownership + shell: bash + run: | + test ! -e .venv + echo 'environment-owned=true' >>"$GITHUB_OUTPUT" + + - name: Read committed toolchain versions + id: toolchain + shell: bash + run: bash "${{ github.action_path }}/resolve-python-contract.sh" + + - name: Install uv + uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 + with: + enable-cache: true + python-version: ${{ steps.toolchain.outputs.python_version }} + version: ${{ steps.toolchain.outputs.uv_version }} + + - name: Verify the dependency lock + shell: bash + run: uv lock --check + + - name: Synchronize locked dependencies + shell: bash + run: uv sync --locked --all-groups diff --git a/.agents/skills/python-quality-check/assets/github/actions/setup-python-locked/resolve-python-contract.sh b/.agents/skills/python-quality-check/assets/github/actions/setup-python-locked/resolve-python-contract.sh new file mode 100644 index 0000000..ba0f273 --- /dev/null +++ b/.agents/skills/python-quality-check/assets/github/actions/setup-python-locked/resolve-python-contract.sh @@ -0,0 +1,23 @@ +#!/usr/bin/env bash + +set -euo pipefail + +main() { + : "${GITHUB_OUTPUT:?GITHUB_OUTPUT is required}" + + local -a versions + mapfile -t versions <.python-version + local python_version=${versions[0]:-} + python_version=${python_version%$'\r'} + if [[ ${#versions[@]} -ne 1 || -z "$python_version" ]]; then + printf '.python-version must select one Python version.\n' >&2 + return 1 + fi + + { + printf 'python_version=%s\n' "$python_version" + printf 'uv_version=0.11.21\n' + } >>"$GITHUB_OUTPUT" +} + +main "$@" diff --git a/.github/actions/check-docker-source/action.yml b/.github/actions/check-docker-source/action.yml new file mode 100644 index 0000000..b3979ed --- /dev/null +++ b/.github/actions/check-docker-source/action.yml @@ -0,0 +1,37 @@ +name: Check Docker source +description: Audit APM, lint Docker and Markdown source, and remove action-owned tools. + +runs: + using: composite + steps: + - name: Set up reviewed APM CLI + uses: microsoft/apm-action@d723bb64ed70c135bbaf87d126b721dd2dae0439 # v1.10.0 + with: + apm-version: "0.27.0" + setup-only: "true" + + - name: Audit APM deployment + shell: bash + run: apm audit --ci + + - name: Install checksum-verified hadolint + shell: bash + env: + HADOLINT_VERSION: v2.15.1 + HADOLINT_SHA256: c7187db94eeeeca956519a6af171adc31453941a1e777961f6e680f697c8c507 + run: bash "${{ github.action_path }}/install-hadolint.sh" + + - name: Lint Dockerfile + shell: bash + run: hadolint Dockerfile + + - name: Lint Markdown source + uses: DavidAnson/markdownlint-cli2-action@ce4853d43830c74c1753b39f3cf40f71c2031eb9 # v23.0.0 + with: + config: .markdownlint-cli2.yaml + globs: "**/*.md" + + - name: Remove hadolint + if: always() + shell: bash + run: rm -rf -- "${RUNNER_TEMP}/hadolint" diff --git a/.github/actions/check-docker-source/install-hadolint.sh b/.github/actions/check-docker-source/install-hadolint.sh new file mode 100644 index 0000000..30d7a78 --- /dev/null +++ b/.github/actions/check-docker-source/install-hadolint.sh @@ -0,0 +1,29 @@ +#!/usr/bin/env bash + +set -euo pipefail + +main() { + : "${HADOLINT_VERSION:?HADOLINT_VERSION is required}" + : "${HADOLINT_SHA256:?HADOLINT_SHA256 is required}" + : "${RUNNER_TEMP:?RUNNER_TEMP is required}" + : "${GITHUB_PATH:?GITHUB_PATH is required}" + + local asset=hadolint-linux-x86_64 + local install_dir="${RUNNER_TEMP}/hadolint/bin" + local download_path="${install_dir}/${asset}" + mkdir -p "$install_dir" + curl \ + --fail \ + --location \ + --show-error \ + --silent \ + --output "$download_path" \ + "https://github.com/hadolint/hadolint/releases/download/${HADOLINT_VERSION}/${asset}" + printf '%s %s\n' "$HADOLINT_SHA256" "$download_path" | + sha256sum --check --strict + mv "$download_path" "${install_dir}/hadolint" + chmod 0755 "${install_dir}/hadolint" + printf '%s\n' "$install_dir" >>"$GITHUB_PATH" +} + +main "$@" diff --git a/.github/actions/lint-docker/action.yml b/.github/actions/lint-docker/action.yml deleted file mode 100644 index d572103..0000000 --- a/.github/actions/lint-docker/action.yml +++ /dev/null @@ -1,25 +0,0 @@ -name: Lint Docker source -description: Install a verified hadolint binary and lint the repository Dockerfile. - -runs: - using: composite - steps: - - name: Install checksum-verified hadolint - shell: bash - env: - HADOLINT_VERSION: v2.15.1 - HADOLINT_SHA256: c7187db94eeeeca956519a6af171adc31453941a1e777961f6e680f697c8c507 - run: |- - install_dir="${RUNNER_TEMP}/hadolint/bin" - asset="hadolint-linux-x86_64" - mkdir -p "${install_dir}" - curl --fail --location --silent --show-error \ - --output "${install_dir}/${asset}" \ - "https://github.com/hadolint/hadolint/releases/download/${HADOLINT_VERSION}/${asset}" - echo "${HADOLINT_SHA256} ${install_dir}/${asset}" | sha256sum --check --strict - mv "${install_dir}/${asset}" "${install_dir}/hadolint" - chmod 0755 "${install_dir}/hadolint" - echo "${install_dir}" >> "${GITHUB_PATH}" - - name: Lint Dockerfile - shell: bash - run: hadolint Dockerfile diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index b2e23d2..3016d01 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -16,7 +16,8 @@ env: GHCR_IMAGE_NAME: ghcr.io/aoirint/sd_scripts jobs: - lint: + check: + name: Check runs-on: ubuntu-slim timeout-minutes: 5 steps: @@ -24,8 +25,8 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - name: Lint Docker source - uses: ./.github/actions/lint-docker + - name: Check Docker source + uses: ./.github/actions/check-docker-source plan: runs-on: ubuntu-slim @@ -58,7 +59,7 @@ jobs: echo "release_mode=${release_mode}" >> "$GITHUB_OUTPUT" build: - needs: [lint, plan] + needs: [check, plan] runs-on: ubuntu-24.04 permissions: contents: read diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml index 209f6a0..5a2e179 100644 --- a/.github/workflows/pull-request.yml +++ b/.github/workflows/pull-request.yml @@ -16,7 +16,8 @@ concurrency: cancel-in-progress: true jobs: - lint: + check: + name: Check runs-on: ubuntu-slim timeout-minutes: 5 @@ -26,5 +27,5 @@ jobs: with: persist-credentials: false - - name: Lint Docker source - uses: ./.github/actions/lint-docker + - name: Check Docker source + uses: ./.github/actions/check-docker-source diff --git a/AGENTS.md b/AGENTS.md index 9ca7cb6..a4ca459 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -28,7 +28,7 @@ directly. ### Approved cooldown exception -Use APM CLI 0.26.0 for lock operations. Its normal seven-day cooldown was +Use APM CLI 0.27.0 for lock operations. Its normal seven-day cooldown was explicitly waived because it fixes virtual-package `config-consistency` audit failures. The waiver covers only the CLI release time gate. diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index 6b156a2..032508b 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -18,7 +18,7 @@ that are present in that checkout. - Source: [aoirint/skills](https://github.com/aoirint/skills), selected from `.apm/skills/` - Pinned commit: - [`82fb9ef5149bf59721053fc881e499b7a67ac39b`](https://github.com/aoirint/skills/tree/82fb9ef5149bf59721053fc881e499b7a67ac39b) -- Deployed paths: `.agents/skills/{apm-usage,changelog-workflow,code-quality-check,commit-message-quality-check,docker-quality-check,git-worktree-workflow,github-workflow,gitignore-workflow,prose-quality-check,python-quality-check,release-note-workflow,security-check}/` -- License: [MIT](https://github.com/aoirint/skills/blob/82fb9ef5149bf59721053fc881e499b7a67ac39b/LICENSE) + [`7ee24b75904233a42a7fc01d79c6dfc81ca36d7c`](https://github.com/aoirint/skills/tree/7ee24b75904233a42a7fc01d79c6dfc81ca36d7c) +- Deployed paths: `.agents/skills/{apm-workflow,changelog-workflow,code-quality-check,commit-message-quality-check,docker-quality-check,git-worktree-workflow,github-workflow,gitignore-workflow,prose-quality-check,python-quality-check,release-note-workflow,security-check}/` +- License: [MIT](https://github.com/aoirint/skills/blob/7ee24b75904233a42a7fc01d79c6dfc81ca36d7c/LICENSE) - Copyright: Copyright (c) 2026 aoirint diff --git a/apm.lock.yaml b/apm.lock.yaml index 3f752a0..2c21afe 100644 --- a/apm.lock.yaml +++ b/apm.lock.yaml @@ -1,24 +1,22 @@ lockfile_version: '1' -generated_at: '2026-08-11T03:20:37.451201+00:00' -apm_version: 0.26.0 +generated_at: '2026-08-11T06:02:42.555552+00:00' +apm_version: 0.27.0 dependencies: - repo_url: aoirint/skills name: skills host: github.com - resolved_commit: 82fb9ef5149bf59721053fc881e499b7a67ac39b - resolved_ref: 82fb9ef5149bf59721053fc881e499b7a67ac39b + resolved_commit: 7ee24b75904233a42a7fc01d79c6dfc81ca36d7c + resolved_ref: 7ee24b75904233a42a7fc01d79c6dfc81ca36d7c version: 0.0.0 package_type: apm_package deployed_files: - - .agents/skills/apm-usage - - .agents/skills/apm-usage/README.md - - .agents/skills/apm-usage/SKILL.md - - .agents/skills/apm-usage/agents/openai.yaml - - .agents/skills/apm-usage/assets/check-apm-project/action.yml - - .agents/skills/apm-usage/references/apm-bootstrap.json - - .agents/skills/apm-usage/references/ci-guards.md - - .agents/skills/apm-usage/scripts/propose_bootstrap_update.py - - .agents/skills/apm-usage/scripts/propose_bootstrap_update.py.lock + - .agents/skills/apm-workflow + - .agents/skills/apm-workflow/README.md + - .agents/skills/apm-workflow/SKILL.md + - .agents/skills/apm-workflow/agents/openai.yaml + - .agents/skills/apm-workflow/references/apm-bootstrap.json + - .agents/skills/apm-workflow/scripts/propose_bootstrap_update.py + - .agents/skills/apm-workflow/scripts/propose_bootstrap_update.py.lock - .agents/skills/changelog-workflow - .agents/skills/changelog-workflow/README.md - .agents/skills/changelog-workflow/SKILL.md @@ -35,7 +33,8 @@ dependencies: - .agents/skills/docker-quality-check/README.md - .agents/skills/docker-quality-check/SKILL.md - .agents/skills/docker-quality-check/agents/openai.yaml - - .agents/skills/docker-quality-check/assets/github/actions/lint-docker/action.yml + - .agents/skills/docker-quality-check/assets/github/actions/check-docker-source/action.yml + - .agents/skills/docker-quality-check/assets/github/actions/check-docker-source/install-hadolint.sh - .agents/skills/docker-quality-check/assets/github/workflows/main.yml - .agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml - .agents/skills/docker-quality-check/references/ci-template-contract.md @@ -61,6 +60,8 @@ dependencies: - .agents/skills/python-quality-check/README.md - .agents/skills/python-quality-check/SKILL.md - .agents/skills/python-quality-check/agents/openai.yaml + - .agents/skills/python-quality-check/assets/github/actions/setup-python-locked/action.yml + - .agents/skills/python-quality-check/assets/github/actions/setup-python-locked/resolve-python-contract.sh - .agents/skills/python-quality-check/references/ci-and-distribution.md - .agents/skills/python-quality-check/references/tooling-and-testing.md - .agents/skills/python-quality-check/scripts/check_project.py @@ -80,14 +81,12 @@ dependencies: - .agents/skills/security-check/references/artifact-inspection.md - .agents/skills/security-check/references/external-code-execution.md deployed_file_hashes: - .agents/skills/apm-usage/README.md: sha256:70351aaebf54291433dfcff86280e87edc757ff4e93e506aa1e8f06a0b913f06 - .agents/skills/apm-usage/SKILL.md: sha256:82bfde7980c17b69f043b62cb5669a42b1e65386f4a8476a224617285f33653e - .agents/skills/apm-usage/agents/openai.yaml: sha256:931ed250f3abe81dcad27da5b668d7546cd65f528cd37de754dee4c9df1905e0 - .agents/skills/apm-usage/assets/check-apm-project/action.yml: sha256:108bc5e9964026880fb49086728f8458b16174f33636dea79276bd286505bbd4 - .agents/skills/apm-usage/references/apm-bootstrap.json: sha256:f3b8921d2db8d6bfad9088657895b126ebd8d87b92133bd65331be4a8a0a515e - .agents/skills/apm-usage/references/ci-guards.md: sha256:7898244519895206b90713bdeb23d7bc8ba54437f8205944cdce98acf12fe1d1 - .agents/skills/apm-usage/scripts/propose_bootstrap_update.py: sha256:9d7d3a4292a9ad4a833f970a51cce0202f3850503d39e410c1d2fccad5eb0b58 - .agents/skills/apm-usage/scripts/propose_bootstrap_update.py.lock: sha256:016afc221516f1724533f1623ec77ef8a9a80c06a1ffae431f32f5e063e59986 + .agents/skills/apm-workflow/README.md: sha256:e346edab06f5ec792cdb77edcaa8042f523af67753dc4fe72498ae1899b87c89 + .agents/skills/apm-workflow/SKILL.md: sha256:4191b0fbc4ea9e832ecaede048693f280d36bead7c98276a2cdd0966edc3b88e + .agents/skills/apm-workflow/agents/openai.yaml: sha256:f3c083196472ec9253886b369202ddeb8eb2534fd2da9799798bae2eb33b2e55 + .agents/skills/apm-workflow/references/apm-bootstrap.json: sha256:e0ebfd624fc79e35c5a5a305d77476860ff87019edc3afc0b37b5cd2884276b1 + .agents/skills/apm-workflow/scripts/propose_bootstrap_update.py: sha256:5c8d079ff9caa4175a971c5d231bc24d8143d47d238496cace60b1d91d8d00d8 + .agents/skills/apm-workflow/scripts/propose_bootstrap_update.py.lock: sha256:016afc221516f1724533f1623ec77ef8a9a80c06a1ffae431f32f5e063e59986 .agents/skills/changelog-workflow/README.md: sha256:7ef8167d26522d95f62b9f11d752487d62b6bfdae05850315189fbe2a19fed83 .agents/skills/changelog-workflow/SKILL.md: sha256:8d9de8e0e3c31c4a2c176a0d14e3f1a45daf3db364ede7dd86983c8c3f571f54 .agents/skills/changelog-workflow/agents/openai.yaml: sha256:6264e6dbd0433ab63370e15033ecb94da8dd131c4edcb1d3f2b9abdeb4f680f1 @@ -98,12 +97,13 @@ dependencies: .agents/skills/commit-message-quality-check/SKILL.md: sha256:db272bb7467bcb6a6c3d837dec60a34f7081c135fcd40a9e00cf4a84e29ffabe .agents/skills/commit-message-quality-check/agents/openai.yaml: sha256:faffd948a0989dcfc87dcd3b0580c4a7003d01ef436e66dab9f280df57de652c .agents/skills/docker-quality-check/README.md: sha256:912a73d3de06babc6eed1ecdaf275139ae465797083dc5427affb54d00c57bf0 - .agents/skills/docker-quality-check/SKILL.md: sha256:642f9fdb8d92170a51fdadd2c6fc98a154b1cfeda097c0c7b59bbb8307308069 + .agents/skills/docker-quality-check/SKILL.md: sha256:1f63030c08c7c12ce586b5c759789da36f7cdc0957a5697545796dc7889c0edf .agents/skills/docker-quality-check/agents/openai.yaml: sha256:8abdaaa5a0458e86821080f50a2dfc34374c5c673a6c257fa351a2a96a16d064 - .agents/skills/docker-quality-check/assets/github/actions/lint-docker/action.yml: sha256:9f9b507f64721d295ca96eabe440a73caed1d280ec42e7dd0f81ebc796a87ad3 - .agents/skills/docker-quality-check/assets/github/workflows/main.yml: sha256:eb431cdcf975f9cbb42f2fce1a3b9afb11134f802d82ccac7d8d63946d050c4a - .agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml: sha256:0ff5ebdc316889f7d295a22de2f24c2ad0307be5c8afb76cb1555d4ac3c05782 - .agents/skills/docker-quality-check/references/ci-template-contract.md: sha256:91931e9e0d6bb3bd2291fde1b4f6159a8005100b8d8ac7666b65aa0a65403dd8 + .agents/skills/docker-quality-check/assets/github/actions/check-docker-source/action.yml: sha256:d7aaecc6000e0fd8b5bc05c20226ff2772367d7442b28826b1008ad3f24456bd + .agents/skills/docker-quality-check/assets/github/actions/check-docker-source/install-hadolint.sh: sha256:1a2e0159029597ed5fc8c51759bfd784447cd5e1ffc3db17d3be36b9a11c2f74 + .agents/skills/docker-quality-check/assets/github/workflows/main.yml: sha256:92ef7f067110e0403652b5096fe65b5ade523fa0c10fbe56bb555b0b2fb89f1a + .agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml: sha256:78486f8ba5ca32f5e298cda33d2f553e3f7ec36b688929d01ba5369461f23ecb + .agents/skills/docker-quality-check/references/ci-template-contract.md: sha256:af78ac12c756d4901cf664bd1edf69c2425b56968ee477492b7ec5f5abe826ae .agents/skills/git-worktree-workflow/README.md: sha256:fa6483b5919a01b84fa0d6ffcbaae20b84ed3807e18029e8807e61b0ee4f9de9 .agents/skills/git-worktree-workflow/SKILL.md: sha256:67e2474b9878cc6cb209ae30b19c233f65969abe5b5d543f0c9a16e46f1d40d2 .agents/skills/git-worktree-workflow/agents/openai.yaml: sha256:3eb9da73e7a041e77d82f0d5c3a8c67e914575cff8651b71d077db30fe3da99a @@ -119,8 +119,10 @@ dependencies: .agents/skills/prose-quality-check/SKILL.md: sha256:9ec45813d04382e04a3b504fd187e4151fc5198352564bd0bcb064f4eaf9a702 .agents/skills/prose-quality-check/agents/openai.yaml: sha256:b83e0a5d151e6e20df6f7d97f268955c6abfd105d53820f6baad0de8403fc062 .agents/skills/python-quality-check/README.md: sha256:20a23003a24a8caf2f03dd5a06bed99c81cf93ab53fe5a196c6a67ab59c53b0e - .agents/skills/python-quality-check/SKILL.md: sha256:8827207925dfe0648856628561433435a6c3bd3f27e8497a784b809e90c9441d + .agents/skills/python-quality-check/SKILL.md: sha256:201e37035213c33daf2e469c757a66a0414d7df6ec0c3778ae669d90c3b9a76d .agents/skills/python-quality-check/agents/openai.yaml: sha256:f0b4ad3807e177becec02271314fb32c1ec8d5a7682725ddd4a611a5381084d1 + .agents/skills/python-quality-check/assets/github/actions/setup-python-locked/action.yml: sha256:fe8c80687def5eea23f9b49f2214cb7c1049813bb3af8b7c1b79da7a63f88e21 + .agents/skills/python-quality-check/assets/github/actions/setup-python-locked/resolve-python-contract.sh: sha256:b766a0686b02370f4794d09b640b636e32d1f20b69fcb464b85134d2247dd068 .agents/skills/python-quality-check/references/ci-and-distribution.md: sha256:e52aaf46c28816d6f6262a5421dba8de9f906d2b606987bedcda840d2e687281 .agents/skills/python-quality-check/references/tooling-and-testing.md: sha256:8dd45ccbf2818d73c6497beec400567c294eec842199eaf329e856d40446e771 .agents/skills/python-quality-check/scripts/check_project.py: sha256:8175b500198399a2ce8b79b4fc8d1902f791d163a0d6dfd35b5ce56b41c5ccc5 @@ -137,9 +139,9 @@ dependencies: .agents/skills/security-check/agents/openai.yaml: sha256:87edf0cc1e8717194d0c536f2d5ac0cc1ac9ec04402311d34e953d2e2b23fa19 .agents/skills/security-check/references/artifact-inspection.md: sha256:9842555f4789e77e6cf3d22b000116497207ecf6fa5587f2b1fe0dc20e7dffda .agents/skills/security-check/references/external-code-execution.md: sha256:87ca817baa02ef6b955e5878f0cd79c875abdb0be6e0177cfce158968e628bc3 - content_hash: sha256:6eec088c34d2f984e328d7c3521313313034d7d26cae6a190bf73ef58bbbf9fa + content_hash: sha256:9880f8b48160964a276f061840d95504326316fdbb1647f88b4ab8c16fed7f85 skill_subset: - - apm-usage + - apm-workflow - changelog-workflow - code-quality-check - commit-message-quality-check @@ -155,7 +157,7 @@ dependencies: deployments: - kind: project-relative target: codex - value: .agents/skills/apm-usage + value: .agents/skills/apm-workflow runtime: null scope: project owners: @@ -164,70 +166,52 @@ deployments: content_hash: null - kind: project-relative target: codex - value: .agents/skills/apm-usage/README.md + value: .agents/skills/apm-workflow/README.md runtime: null scope: project owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:70351aaebf54291433dfcff86280e87edc757ff4e93e506aa1e8f06a0b913f06 + content_hash: sha256:e346edab06f5ec792cdb77edcaa8042f523af67753dc4fe72498ae1899b87c89 - kind: project-relative target: codex - value: .agents/skills/apm-usage/SKILL.md + value: .agents/skills/apm-workflow/SKILL.md runtime: null scope: project owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:82bfde7980c17b69f043b62cb5669a42b1e65386f4a8476a224617285f33653e + content_hash: sha256:4191b0fbc4ea9e832ecaede048693f280d36bead7c98276a2cdd0966edc3b88e - kind: project-relative target: codex - value: .agents/skills/apm-usage/agents/openai.yaml + value: .agents/skills/apm-workflow/agents/openai.yaml runtime: null scope: project owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:931ed250f3abe81dcad27da5b668d7546cd65f528cd37de754dee4c9df1905e0 + content_hash: sha256:f3c083196472ec9253886b369202ddeb8eb2534fd2da9799798bae2eb33b2e55 - kind: project-relative target: codex - value: .agents/skills/apm-usage/assets/check-apm-project/action.yml + value: .agents/skills/apm-workflow/references/apm-bootstrap.json runtime: null scope: project owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:108bc5e9964026880fb49086728f8458b16174f33636dea79276bd286505bbd4 + content_hash: sha256:e0ebfd624fc79e35c5a5a305d77476860ff87019edc3afc0b37b5cd2884276b1 - kind: project-relative target: codex - value: .agents/skills/apm-usage/references/apm-bootstrap.json + value: .agents/skills/apm-workflow/scripts/propose_bootstrap_update.py runtime: null scope: project owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:f3b8921d2db8d6bfad9088657895b126ebd8d87b92133bd65331be4a8a0a515e + content_hash: sha256:5c8d079ff9caa4175a971c5d231bc24d8143d47d238496cace60b1d91d8d00d8 - kind: project-relative target: codex - value: .agents/skills/apm-usage/references/ci-guards.md - runtime: null - scope: project - owners: - - aoirint/skills - active_owner: aoirint/skills - content_hash: sha256:7898244519895206b90713bdeb23d7bc8ba54437f8205944cdce98acf12fe1d1 -- kind: project-relative - target: codex - value: .agents/skills/apm-usage/scripts/propose_bootstrap_update.py - runtime: null - scope: project - owners: - - aoirint/skills - active_owner: aoirint/skills - content_hash: sha256:9d7d3a4292a9ad4a833f970a51cce0202f3850503d39e410c1d2fccad5eb0b58 -- kind: project-relative - target: codex - value: .agents/skills/apm-usage/scripts/propose_bootstrap_update.py.lock + value: .agents/skills/apm-workflow/scripts/propose_bootstrap_update.py.lock runtime: null scope: project owners: @@ -368,7 +352,7 @@ deployments: owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:642f9fdb8d92170a51fdadd2c6fc98a154b1cfeda097c0c7b59bbb8307308069 + content_hash: sha256:1f63030c08c7c12ce586b5c759789da36f7cdc0957a5697545796dc7889c0edf - kind: project-relative target: codex value: .agents/skills/docker-quality-check/agents/openai.yaml @@ -380,13 +364,22 @@ deployments: content_hash: sha256:8abdaaa5a0458e86821080f50a2dfc34374c5c673a6c257fa351a2a96a16d064 - kind: project-relative target: codex - value: .agents/skills/docker-quality-check/assets/github/actions/lint-docker/action.yml + value: .agents/skills/docker-quality-check/assets/github/actions/check-docker-source/action.yml runtime: null scope: project owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:9f9b507f64721d295ca96eabe440a73caed1d280ec42e7dd0f81ebc796a87ad3 + content_hash: sha256:d7aaecc6000e0fd8b5bc05c20226ff2772367d7442b28826b1008ad3f24456bd +- kind: project-relative + target: codex + value: .agents/skills/docker-quality-check/assets/github/actions/check-docker-source/install-hadolint.sh + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: sha256:1a2e0159029597ed5fc8c51759bfd784447cd5e1ffc3db17d3be36b9a11c2f74 - kind: project-relative target: codex value: .agents/skills/docker-quality-check/assets/github/workflows/main.yml @@ -395,7 +388,7 @@ deployments: owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:eb431cdcf975f9cbb42f2fce1a3b9afb11134f802d82ccac7d8d63946d050c4a + content_hash: sha256:92ef7f067110e0403652b5096fe65b5ade523fa0c10fbe56bb555b0b2fb89f1a - kind: project-relative target: codex value: .agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml @@ -404,7 +397,7 @@ deployments: owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:0ff5ebdc316889f7d295a22de2f24c2ad0307be5c8afb76cb1555d4ac3c05782 + content_hash: sha256:78486f8ba5ca32f5e298cda33d2f553e3f7ec36b688929d01ba5369461f23ecb - kind: project-relative target: codex value: .agents/skills/docker-quality-check/references/ci-template-contract.md @@ -413,7 +406,7 @@ deployments: owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:91931e9e0d6bb3bd2291fde1b4f6159a8005100b8d8ac7666b65aa0a65403dd8 + content_hash: sha256:af78ac12c756d4901cf664bd1edf69c2425b56968ee477492b7ec5f5abe826ae - kind: project-relative target: codex value: .agents/skills/git-worktree-workflow @@ -602,7 +595,7 @@ deployments: owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:8827207925dfe0648856628561433435a6c3bd3f27e8497a784b809e90c9441d + content_hash: sha256:201e37035213c33daf2e469c757a66a0414d7df6ec0c3778ae669d90c3b9a76d - kind: project-relative target: codex value: .agents/skills/python-quality-check/agents/openai.yaml @@ -612,6 +605,24 @@ deployments: - aoirint/skills active_owner: aoirint/skills content_hash: sha256:f0b4ad3807e177becec02271314fb32c1ec8d5a7682725ddd4a611a5381084d1 +- kind: project-relative + target: codex + value: .agents/skills/python-quality-check/assets/github/actions/setup-python-locked/action.yml + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: sha256:fe8c80687def5eea23f9b49f2214cb7c1049813bb3af8b7c1b79da7a63f88e21 +- kind: project-relative + target: codex + value: .agents/skills/python-quality-check/assets/github/actions/setup-python-locked/resolve-python-contract.sh + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: sha256:b766a0686b02370f4794d09b640b636e32d1f20b69fcb464b85134d2247dd068 - kind: project-relative target: codex value: .agents/skills/python-quality-check/references/ci-and-distribution.md diff --git a/apm.yml b/apm.yml index 37f414e..cf93c7f 100644 --- a/apm.yml +++ b/apm.yml @@ -8,9 +8,9 @@ targets: dependencies: apm: - git: aoirint/skills - ref: 82fb9ef5149bf59721053fc881e499b7a67ac39b + ref: 7ee24b75904233a42a7fc01d79c6dfc81ca36d7c skills: - - apm-usage + - apm-workflow - changelog-workflow - code-quality-check - commit-message-quality-check From 402bf57883ef13c19739d422adb16145a9bc92d6 Mon Sep 17 00:00:00 2001 From: aoirint Date: Tue, 11 Aug 2026 15:17:50 +0900 Subject: [PATCH 2/5] fix(ci): complete source-check migration Co-authored-by: Codex --- .markdownlint-cli2.yaml | 43 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 .markdownlint-cli2.yaml diff --git a/.markdownlint-cli2.yaml b/.markdownlint-cli2.yaml new file mode 100644 index 0000000..c0058c3 --- /dev/null +++ b/.markdownlint-cli2.yaml @@ -0,0 +1,43 @@ +--- +# Lint every committed Markdown document by default so docs, release notes, and +# GitHub templates follow one repository-wide style. +globs: + - "**/*.md" + +# Exclude Agent-local work areas for the first Markdown lint rollout. Skill +# Markdown can be included later with a narrower ignore that still excludes +# transient .agents/worktrees content. +ignores: + - ".agents/**" + +# Respect .gitignore so generated, local, or tool cache Markdown files do not +# affect CI when they are intentionally outside version control. +gitignore: true + +config: + # Start from markdownlint's recommended defaults, then document each local + # exception below instead of maintaining a broad custom rule set. + default: true + + # Existing prose clusters around 118-120 columns. Keep code blocks, tables, + # and headings exempt unless examples/tables become intentionally wrapped. + MD013: + line_length: 120 + code_blocks: false + headings: false + tables: false + + # Use four-space nested list indentation for conservative renderer + # compatibility. + MD007: + indent: 4 + + # Changelogs intentionally repeat headings such as "Changed" and "Notes" + # under different release versions, so only duplicate sibling headings are + # suspicious. + MD024: + siblings_only: true + + # PR-template guidance needs to appear before the first visible heading, so + # do not require the first line to be an H1. + MD041: false From 1d029b85c1e173870cc8cedd71acb8ca08b65a70 Mon Sep 17 00:00:00 2001 From: aoirint Date: Tue, 11 Aug 2026 15:41:23 +0900 Subject: [PATCH 3/5] chore(skills): deploy final source-check contracts Co-authored-by: Codex --- .markdownlint-cli2.yaml | 28 +++------------------------- THIRD_PARTY_NOTICES.md | 4 ++-- apm.lock.yaml | 8 ++++---- apm.yml | 2 +- 4 files changed, 10 insertions(+), 32 deletions(-) diff --git a/.markdownlint-cli2.yaml b/.markdownlint-cli2.yaml index c0058c3..688c6b5 100644 --- a/.markdownlint-cli2.yaml +++ b/.markdownlint-cli2.yaml @@ -1,43 +1,21 @@ --- -# Lint every committed Markdown document by default so docs, release notes, and -# GitHub templates follow one repository-wide style. globs: - "**/*.md" -# Exclude Agent-local work areas for the first Markdown lint rollout. Skill -# Markdown can be included later with a narrower ignore that still excludes -# transient .agents/worktrees content. ignores: - ".agents/**" -# Respect .gitignore so generated, local, or tool cache Markdown files do not -# affect CI when they are intentionally outside version control. gitignore: true config: - # Start from markdownlint's recommended defaults, then document each local - # exception below instead of maintaining a broad custom rule set. default: true - # Existing prose clusters around 118-120 columns. Keep code blocks, tables, - # and headings exempt unless examples/tables become intentionally wrapped. - MD013: - line_length: 120 - code_blocks: false - headings: false - tables: false - - # Use four-space nested list indentation for conservative renderer - # compatibility. MD007: - indent: 4 + indent: 2 + + MD013: false - # Changelogs intentionally repeat headings such as "Changed" and "Notes" - # under different release versions, so only duplicate sibling headings are - # suspicious. MD024: siblings_only: true - # PR-template guidance needs to appear before the first visible heading, so - # do not require the first line to be an H1. MD041: false diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index 032508b..bc6b21d 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -18,7 +18,7 @@ that are present in that checkout. - Source: [aoirint/skills](https://github.com/aoirint/skills), selected from `.apm/skills/` - Pinned commit: - [`7ee24b75904233a42a7fc01d79c6dfc81ca36d7c`](https://github.com/aoirint/skills/tree/7ee24b75904233a42a7fc01d79c6dfc81ca36d7c) + [`bd19f9e124aeb6947e664df29922ce3881f66609`](https://github.com/aoirint/skills/tree/bd19f9e124aeb6947e664df29922ce3881f66609) - Deployed paths: `.agents/skills/{apm-workflow,changelog-workflow,code-quality-check,commit-message-quality-check,docker-quality-check,git-worktree-workflow,github-workflow,gitignore-workflow,prose-quality-check,python-quality-check,release-note-workflow,security-check}/` -- License: [MIT](https://github.com/aoirint/skills/blob/7ee24b75904233a42a7fc01d79c6dfc81ca36d7c/LICENSE) +- License: [MIT](https://github.com/aoirint/skills/blob/bd19f9e124aeb6947e664df29922ce3881f66609/LICENSE) - Copyright: Copyright (c) 2026 aoirint diff --git a/apm.lock.yaml b/apm.lock.yaml index 2c21afe..11801c0 100644 --- a/apm.lock.yaml +++ b/apm.lock.yaml @@ -1,12 +1,12 @@ lockfile_version: '1' -generated_at: '2026-08-11T06:02:42.555552+00:00' +generated_at: '2026-08-11T06:37:13.675762+00:00' apm_version: 0.27.0 dependencies: - repo_url: aoirint/skills name: skills host: github.com - resolved_commit: 7ee24b75904233a42a7fc01d79c6dfc81ca36d7c - resolved_ref: 7ee24b75904233a42a7fc01d79c6dfc81ca36d7c + resolved_commit: bd19f9e124aeb6947e664df29922ce3881f66609 + resolved_ref: bd19f9e124aeb6947e664df29922ce3881f66609 version: 0.0.0 package_type: apm_package deployed_files: @@ -139,7 +139,7 @@ dependencies: .agents/skills/security-check/agents/openai.yaml: sha256:87edf0cc1e8717194d0c536f2d5ac0cc1ac9ec04402311d34e953d2e2b23fa19 .agents/skills/security-check/references/artifact-inspection.md: sha256:9842555f4789e77e6cf3d22b000116497207ecf6fa5587f2b1fe0dc20e7dffda .agents/skills/security-check/references/external-code-execution.md: sha256:87ca817baa02ef6b955e5878f0cd79c875abdb0be6e0177cfce158968e628bc3 - content_hash: sha256:9880f8b48160964a276f061840d95504326316fdbb1647f88b4ab8c16fed7f85 + content_hash: sha256:f5509ac40a802023b1b1b8dc5dc7d589ed5c9d7e43e6a81d369b719f2df90134 skill_subset: - apm-workflow - changelog-workflow diff --git a/apm.yml b/apm.yml index cf93c7f..e836701 100644 --- a/apm.yml +++ b/apm.yml @@ -8,7 +8,7 @@ targets: dependencies: apm: - git: aoirint/skills - ref: 7ee24b75904233a42a7fc01d79c6dfc81ca36d7c + ref: bd19f9e124aeb6947e664df29922ce3881f66609 skills: - apm-workflow - changelog-workflow From 659a7e37c6d4358bb26ed814546417735927c251 Mon Sep 17 00:00:00 2001 From: aoirint Date: Tue, 11 Aug 2026 16:19:22 +0900 Subject: [PATCH 4/5] chore(skills): update shared quality guidance Co-authored-by: Codex --- .agents/skills/prose-quality-check/SKILL.md | 9 ++++ .../assets/markdownlint-cli2.yaml | 43 +++++++++++++++++++ .markdownlint-cli2.yaml | 28 ++++++++++-- THIRD_PARTY_NOTICES.md | 4 +- apm.lock.yaml | 23 +++++++--- apm.yml | 2 +- 6 files changed, 97 insertions(+), 12 deletions(-) create mode 100644 .agents/skills/prose-quality-check/assets/markdownlint-cli2.yaml diff --git a/.agents/skills/prose-quality-check/SKILL.md b/.agents/skills/prose-quality-check/SKILL.md index 0ebbe4a..52d86b3 100644 --- a/.agents/skills/prose-quality-check/SKILL.md +++ b/.agents/skills/prose-quality-check/SKILL.md @@ -77,6 +77,15 @@ use the applicable documentation-system or domain-specific skill. - Confirm each list or paragraph has one clear job. - Confirm the structure did not imply a stronger, weaker, broader, or narrower claim than the source material supports. +9. When establishing repository-wide Markdown validation, copy + `assets/markdownlint-cli2.yaml` to `.markdownlint-cli2.yaml` without + deleting its rationale comments or changing its rule baseline. Add a local + ignore or exception only for an evidenced generated, vendored, submodule, + renderer, or document-format requirement, and document that reason beside + the narrow override. When an applicable domain Skill owns a reviewed derived + configuration, such as `hugo-quality-check`, use that asset instead of + recreating its exceptions in the consumer. Use `github-actions-quality-check` + to wire the repository-owned configuration into CI. ## Output checklist diff --git a/.agents/skills/prose-quality-check/assets/markdownlint-cli2.yaml b/.agents/skills/prose-quality-check/assets/markdownlint-cli2.yaml new file mode 100644 index 0000000..c0058c3 --- /dev/null +++ b/.agents/skills/prose-quality-check/assets/markdownlint-cli2.yaml @@ -0,0 +1,43 @@ +--- +# Lint every committed Markdown document by default so docs, release notes, and +# GitHub templates follow one repository-wide style. +globs: + - "**/*.md" + +# Exclude Agent-local work areas for the first Markdown lint rollout. Skill +# Markdown can be included later with a narrower ignore that still excludes +# transient .agents/worktrees content. +ignores: + - ".agents/**" + +# Respect .gitignore so generated, local, or tool cache Markdown files do not +# affect CI when they are intentionally outside version control. +gitignore: true + +config: + # Start from markdownlint's recommended defaults, then document each local + # exception below instead of maintaining a broad custom rule set. + default: true + + # Existing prose clusters around 118-120 columns. Keep code blocks, tables, + # and headings exempt unless examples/tables become intentionally wrapped. + MD013: + line_length: 120 + code_blocks: false + headings: false + tables: false + + # Use four-space nested list indentation for conservative renderer + # compatibility. + MD007: + indent: 4 + + # Changelogs intentionally repeat headings such as "Changed" and "Notes" + # under different release versions, so only duplicate sibling headings are + # suspicious. + MD024: + siblings_only: true + + # PR-template guidance needs to appear before the first visible heading, so + # do not require the first line to be an H1. + MD041: false diff --git a/.markdownlint-cli2.yaml b/.markdownlint-cli2.yaml index 688c6b5..c0058c3 100644 --- a/.markdownlint-cli2.yaml +++ b/.markdownlint-cli2.yaml @@ -1,21 +1,43 @@ --- +# Lint every committed Markdown document by default so docs, release notes, and +# GitHub templates follow one repository-wide style. globs: - "**/*.md" +# Exclude Agent-local work areas for the first Markdown lint rollout. Skill +# Markdown can be included later with a narrower ignore that still excludes +# transient .agents/worktrees content. ignores: - ".agents/**" +# Respect .gitignore so generated, local, or tool cache Markdown files do not +# affect CI when they are intentionally outside version control. gitignore: true config: + # Start from markdownlint's recommended defaults, then document each local + # exception below instead of maintaining a broad custom rule set. default: true - MD007: - indent: 2 + # Existing prose clusters around 118-120 columns. Keep code blocks, tables, + # and headings exempt unless examples/tables become intentionally wrapped. + MD013: + line_length: 120 + code_blocks: false + headings: false + tables: false - MD013: false + # Use four-space nested list indentation for conservative renderer + # compatibility. + MD007: + indent: 4 + # Changelogs intentionally repeat headings such as "Changed" and "Notes" + # under different release versions, so only duplicate sibling headings are + # suspicious. MD024: siblings_only: true + # PR-template guidance needs to appear before the first visible heading, so + # do not require the first line to be an H1. MD041: false diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index bc6b21d..2bde91b 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -18,7 +18,7 @@ that are present in that checkout. - Source: [aoirint/skills](https://github.com/aoirint/skills), selected from `.apm/skills/` - Pinned commit: - [`bd19f9e124aeb6947e664df29922ce3881f66609`](https://github.com/aoirint/skills/tree/bd19f9e124aeb6947e664df29922ce3881f66609) + [`6a1e6431bbaed762f55783c3dcd7dc4b07736596`](https://github.com/aoirint/skills/tree/6a1e6431bbaed762f55783c3dcd7dc4b07736596) - Deployed paths: `.agents/skills/{apm-workflow,changelog-workflow,code-quality-check,commit-message-quality-check,docker-quality-check,git-worktree-workflow,github-workflow,gitignore-workflow,prose-quality-check,python-quality-check,release-note-workflow,security-check}/` -- License: [MIT](https://github.com/aoirint/skills/blob/bd19f9e124aeb6947e664df29922ce3881f66609/LICENSE) +- License: [MIT](https://github.com/aoirint/skills/blob/6a1e6431bbaed762f55783c3dcd7dc4b07736596/LICENSE) - Copyright: Copyright (c) 2026 aoirint diff --git a/apm.lock.yaml b/apm.lock.yaml index 11801c0..70a2aa3 100644 --- a/apm.lock.yaml +++ b/apm.lock.yaml @@ -1,12 +1,12 @@ lockfile_version: '1' -generated_at: '2026-08-11T06:37:13.675762+00:00' +generated_at: '2026-08-11T07:12:25.413331+00:00' apm_version: 0.27.0 dependencies: - repo_url: aoirint/skills name: skills host: github.com - resolved_commit: bd19f9e124aeb6947e664df29922ce3881f66609 - resolved_ref: bd19f9e124aeb6947e664df29922ce3881f66609 + resolved_commit: 6a1e6431bbaed762f55783c3dcd7dc4b07736596 + resolved_ref: 6a1e6431bbaed762f55783c3dcd7dc4b07736596 version: 0.0.0 package_type: apm_package deployed_files: @@ -56,6 +56,7 @@ dependencies: - .agents/skills/prose-quality-check/README.md - .agents/skills/prose-quality-check/SKILL.md - .agents/skills/prose-quality-check/agents/openai.yaml + - .agents/skills/prose-quality-check/assets/markdownlint-cli2.yaml - .agents/skills/python-quality-check - .agents/skills/python-quality-check/README.md - .agents/skills/python-quality-check/SKILL.md @@ -116,8 +117,9 @@ dependencies: .agents/skills/gitignore-workflow/SKILL.md: sha256:2ef38f42e418c10e0ba7632e3ba37614df97044dfa8847ad1338e6c4c896c089 .agents/skills/gitignore-workflow/agents/openai.yaml: sha256:f6a9b176003028588ff4c1d9ee4e23c625892d00b65086bf4b6b26a3f896030d .agents/skills/prose-quality-check/README.md: sha256:8e4d9f8f8fdfba1cf7fe71fa88cac6baffa0d3c7616f744c0e3b1add102be5e7 - .agents/skills/prose-quality-check/SKILL.md: sha256:9ec45813d04382e04a3b504fd187e4151fc5198352564bd0bcb064f4eaf9a702 + .agents/skills/prose-quality-check/SKILL.md: sha256:9509e1ec536631841ae6e2395a8305e853ed68c0231332ac4923699c32a98c1f .agents/skills/prose-quality-check/agents/openai.yaml: sha256:b83e0a5d151e6e20df6f7d97f268955c6abfd105d53820f6baad0de8403fc062 + .agents/skills/prose-quality-check/assets/markdownlint-cli2.yaml: sha256:1044e29915fe15e9083f808d1170c84cfc0b848123c0da435cabb9512d39c203 .agents/skills/python-quality-check/README.md: sha256:20a23003a24a8caf2f03dd5a06bed99c81cf93ab53fe5a196c6a67ab59c53b0e .agents/skills/python-quality-check/SKILL.md: sha256:201e37035213c33daf2e469c757a66a0414d7df6ec0c3778ae669d90c3b9a76d .agents/skills/python-quality-check/agents/openai.yaml: sha256:f0b4ad3807e177becec02271314fb32c1ec8d5a7682725ddd4a611a5381084d1 @@ -139,7 +141,7 @@ dependencies: .agents/skills/security-check/agents/openai.yaml: sha256:87edf0cc1e8717194d0c536f2d5ac0cc1ac9ec04402311d34e953d2e2b23fa19 .agents/skills/security-check/references/artifact-inspection.md: sha256:9842555f4789e77e6cf3d22b000116497207ecf6fa5587f2b1fe0dc20e7dffda .agents/skills/security-check/references/external-code-execution.md: sha256:87ca817baa02ef6b955e5878f0cd79c875abdb0be6e0177cfce158968e628bc3 - content_hash: sha256:f5509ac40a802023b1b1b8dc5dc7d589ed5c9d7e43e6a81d369b719f2df90134 + content_hash: sha256:ac27952ee585df0cc8fdfb53d02e4681405ca7b5eebb80f2c2d1707342adaeef skill_subset: - apm-workflow - changelog-workflow @@ -559,7 +561,7 @@ deployments: owners: - aoirint/skills active_owner: aoirint/skills - content_hash: sha256:9ec45813d04382e04a3b504fd187e4151fc5198352564bd0bcb064f4eaf9a702 + content_hash: sha256:9509e1ec536631841ae6e2395a8305e853ed68c0231332ac4923699c32a98c1f - kind: project-relative target: codex value: .agents/skills/prose-quality-check/agents/openai.yaml @@ -569,6 +571,15 @@ deployments: - aoirint/skills active_owner: aoirint/skills content_hash: sha256:b83e0a5d151e6e20df6f7d97f268955c6abfd105d53820f6baad0de8403fc062 +- kind: project-relative + target: codex + value: .agents/skills/prose-quality-check/assets/markdownlint-cli2.yaml + runtime: null + scope: project + owners: + - aoirint/skills + active_owner: aoirint/skills + content_hash: sha256:1044e29915fe15e9083f808d1170c84cfc0b848123c0da435cabb9512d39c203 - kind: project-relative target: codex value: .agents/skills/python-quality-check diff --git a/apm.yml b/apm.yml index e836701..1121301 100644 --- a/apm.yml +++ b/apm.yml @@ -8,7 +8,7 @@ targets: dependencies: apm: - git: aoirint/skills - ref: bd19f9e124aeb6947e664df29922ce3881f66609 + ref: 6a1e6431bbaed762f55783c3dcd7dc4b07736596 skills: - apm-workflow - changelog-workflow From 6028818f334d6f71b66b0c9af25d5028c85a41a7 Mon Sep 17 00:00:00 2001 From: aoirint Date: Tue, 11 Aug 2026 16:25:34 +0900 Subject: [PATCH 5/5] docs: satisfy shared markdown rules Co-authored-by: Codex --- CHANGELOG.md | 8 ++++---- README.md | 26 +++++++++++++++++--------- THIRD_PARTY_NOTICES.md | 2 +- 3 files changed, 22 insertions(+), 14 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6057533..903ba79 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -30,10 +30,10 @@ releases. - Update the bundled Hugging Face runtime stack while keeping sd-scripts at v0.10.5: - - `transformers` 4.54.1 to 5.8.0. - - `diffusers` 0.32.1 to 0.38.0. - - `huggingface-hub` 0.34.3 to 1.14.0. - - `safetensors` 0.4.5 to the 0.8.0rc0 prerelease required by diffusers. + - `transformers` 4.54.1 to 5.8.0. + - `diffusers` 0.32.1 to 0.38.0. + - `huggingface-hub` 0.34.3 to 1.14.0. + - `safetensors` 0.4.5 to the 0.8.0rc0 prerelease required by diffusers. - Update the WD14 captioning dependency `onnx` from 1.18.0 to 1.21.0. - Update the HTTP client dependency `requests` from 2.32.4 to 2.33.0. - Update pinned Docker GitHub Actions. diff --git a/README.md b/README.md index d8259e9..78bd431 100644 --- a/README.md +++ b/README.md @@ -8,8 +8,8 @@ Dockerfile for [kohya-ss/sd-scripts](https://github.com/kohya-ss/sd-scripts). - [Docker Engine](https://docs.docker.com/engine/install/ubuntu/) 29 or later - [NVIDIA Container Toolkit](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/install-guide.html) - NVIDIA GeForce RTX 4000 series, 5000 series - - 1000 series does not work due to CUDA compatibility. - - 2000 series and 3000 series might work, but untested. + - 1000 series does not work due to CUDA compatibility. + - 2000 series and 3000 series might work, but untested. ## Usage @@ -51,7 +51,10 @@ wget -O "animagineXL40_v4Zero.safetensors" "https://civitai.com/api/download/mod echo "f15812e65c2ea7f4e19ce37fb2a8445eb65c64da450a508dd9c8f237c73f6bb8 animagineXL40_v4Zero" | sha256sum -c - ``` -Prepare a dataset directory `work/my_dataset-20230715.1` and a config file `work/my_dataset-20230715.1/config.toml` following [train_README](https://github.com/kohya-ss/sd-scripts/blob/6721028c79ee85a78b3a06dfd8954dae310a1cce/docs/train_README-ja.md#dreambooth%E3%82%AD%E3%83%A3%E3%83%97%E3%82%B7%E3%83%A7%E3%83%B3%E6%96%B9%E5%BC%8F%E6%AD%A3%E5%89%87%E5%8C%96%E7%94%BB%E5%83%8F%E4%BD%BF%E7%94%A8%E5%8F%AF). +Prepare a dataset directory `work/my_dataset-20230715.1` and a config file +`work/my_dataset-20230715.1/config.toml` following [train_README]. + +[train_README]: https://github.com/kohya-ss/sd-scripts/blob/6721028c79ee85a78b3a06dfd8954dae310a1cce/docs/train_README-ja.md#dreambooth%E3%82%AD%E3%83%A3%E3%83%97%E3%82%B7%E3%83%A7%E3%83%B3%E6%96%B9%E5%BC%8F%E6%AD%A3%E5%89%87%E5%8C%96%E7%94%BB%E5%83%8F%E4%BD%BF%E7%94%A8%E5%8F%AF Set file ownership `UID:GID = 1000:1000` (`sudo chown -R 1000:1000 "./work"`). @@ -149,14 +152,19 @@ To update the bundled sd-scripts version before a release, follow [Updating sd-scripts](docs/update-sd-scripts.md) first. 1. Update `VERSION` to the version to publish. - - Stable releases use SemVer without a prerelease suffix, such as `0.1.0`. - - Prereleases use SemVer with a prerelease suffix, such as `0.1.0-rc.1`. + - Stable releases use SemVer without a prerelease suffix, such as `0.1.0`. + - Prereleases use SemVer with a prerelease suffix, such as `0.1.0-rc.1`. 2. Commit the `VERSION` change and merge it to `main`. 3. The build workflow checks whether `v` already exists on GitHub. - - If the tag does not exist and `VERSION` is stable, it creates a latest GitHub Release and publishes Docker images tagged `v` and `latest`. - - If the tag does not exist and `VERSION` is a prerelease, it creates a prerelease GitHub Release and publishes the Docker image tagged `edge`. - - If `VERSION` is `0.0.0`, it is treated as an edge build and only the `edge` Docker image is updated. - - If the tag already exists, the push is treated as an edge build and only the `edge` Docker image is updated. + - If the tag does not exist and `VERSION` is stable, it creates a latest + GitHub Release and publishes Docker images tagged `v` and + `latest`. + - If the tag does not exist and `VERSION` is a prerelease, it creates a + prerelease GitHub Release and publishes the Docker image tagged `edge`. + - If `VERSION` is `0.0.0`, it is treated as an edge build and only the + `edge` Docker image is updated. + - If the tag already exists, the push is treated as an edge build and only + the `edge` Docker image is updated. ## License diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index 2bde91b..fcc436a 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -4,7 +4,7 @@ This project builds Docker images that include third-party software. ## kohya-ss/sd-scripts -- Source: https://github.com/kohya-ss/sd-scripts +- Source: - Bundled location in image: `/opt/sd-scripts` - Version: see `SD_SCRIPTS_VERSION` in `Dockerfile` - License: primarily Apache License 2.0, with some portions under separate