ci: align source checks and agent skills

.agents/skills/apm-usage/README.md → .agents/skills/apm-workflow/README.md

@@ -1,4 +1,4 @@
-# apm-usage
+# apm-workflow
 
 ## Overview
 
@@ -7,5 +7,5 @@ Safely set up, pin, deploy, audit, and update APM-managed agent dependencies.
 ## Install
 
 ```shell
-apm install aoirint/skills/.apm/skills/apm-usage
+apm install aoirint/skills/.apm/skills/apm-workflow
 ```

.agents/skills/apm-usage/SKILL.md → .agents/skills/apm-workflow/SKILL.md

@@ -1,9 +1,9 @@
 ---
-name: apm-usage
+name: apm-workflow
 description: Select a reviewed APM CLI version, then set up, pin, deploy, audit, and update APM-managed agent dependencies safely. Use when creating or editing apm.yml or apm.lock.yaml, choosing or installing APM, adding an Agent Skill, plugin, or MCP dependency, validating a pinned deployment, or preparing a cooldown-aware update proposal.
 ---
 
-# APM Usage
+# APM Workflow
 
 Keep agent context reproducible and reviewable. Select the newest reviewed APM
 release that has completed the seven-day cooldown or has a manifest-recorded
@@ -118,7 +118,7 @@ Do not change the bootstrap manifest automatically. Use this proposal flow:
    release notes, installer and artifact integrity, and compatibility from the
    current official sources. Require explicit maintainer approval.
 3. Run
-   `uv run --no-project --no-config --locked --script <apm-usage-skill>/scripts/propose_bootstrap_update.py`
+   `uv run --no-project --no-config --locked --script <apm-workflow-skill>/scripts/propose_bootstrap_update.py`
    to isolate the locked helper from the consumer repository's uv configuration
    and collect an eligible candidate without changing files. Attach its JSON
    output to the proposal.
@@ -205,21 +205,7 @@ or MCP dependency:
    `apm audit --ci` to the project's existing CI when the user requests CI
    enforcement.
 
-### 3.1 Add the lightweight project-metadata guard
-
-When a repository already has a source-lint composite action, add the
-repository-owned metadata guard described in [CI guards](references/ci-guards.md).
-It verifies the unpublished project version and the lock generator version
-without downloading or executing APM. Keep it in the existing lint job so
-adoption requires one step rather than a new workflow. Do not make consumer CI
-depend on a path inside the deployed Skill; copy the template into the
-repository's own `.github/actions/check-apm-project/` directory.
-
-The metadata guard is not a replacement for `apm install --frozen` or
-`apm audit --ci`. Add those separately when the requested CI policy includes
-dependency replay, deployed-file integrity, or security auditing.
-
-### 3.2 Maintain a packaged Skill collection
+### 3.1 Maintain a packaged Skill collection
 
 Apply this section only when a repository publishes Skill copies in both an
 authoring target such as `.agents/skills/` and a package directory such as
@@ -242,7 +228,7 @@ authoring target such as `.agents/skills/` and a package directory such as
    use `git diff --cached --check` and a content review to distinguish a real
    generated-file delta from line-ending noise.
 
-### 3.3 Rename or remove packaged local Skills
+### 3.2 Rename or remove packaged local Skills
 
 Apply this section when a local packaged Skill is renamed, consolidated, or
 removed. Treat it as a deployment-ledger change, not a documentation-only

.agents/skills/apm-workflow/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "APM Workflow"
+  short_description: "Select APM safely and manage pinned agent dependencies"
+  default_prompt: "Use $apm-workflow to select an eligible APM version and safely manage this project's pinned agent dependencies."

.agents/skills/apm-usage/references/apm-bootstrap.json → .agents/skills/apm-workflow/references/apm-bootstrap.json

@@ -1,45 +1,40 @@
 {
-  "version": "v0.26.0",
-  "published_at": "2026-07-18T21:57:33Z",
+  "version": "v0.27.0",
+  "published_at": "2026-08-02T20:11:22Z",
   "cooldown_days": 7,
-  "eligible_on": "2026-07-25T21:57:33Z",
-  "release_url": "https://github.com/microsoft/apm/releases/tag/v0.26.0",
+  "eligible_on": "2026-08-09T20:11:22Z",
+  "release_url": "https://github.com/microsoft/apm/releases/tag/v0.27.0",
   "download_url_template": "https://github.com/microsoft/apm/releases/download/{version}/{asset}",
   "assets": [
     {
       "platform": "macos-arm64",
       "archive": "apm-darwin-arm64.tar.gz",
       "extracted_directory": "apm-darwin-arm64",
-      "sha256": "febddd0a8beb4be7b411e708ed746937a14482d5e0935eb776b7f35e320654df"
+      "sha256": "4c68e5eaa3cfdb0b25734c316deb532835eaf3c3e2f7379a4c7c06918043a641"
     },
     {
       "platform": "macos-x86_64",
       "archive": "apm-darwin-x86_64.tar.gz",
       "extracted_directory": "apm-darwin-x86_64",
-      "sha256": "6cc47251bbefabe36224bcc5370c1ef08405d4fd15900b42e11ba672ae29483f"
+      "sha256": "846b30055d96cbc6fa0fcf451f50d13f632b540ffdff344873a025bba607e25a"
     },
     {
       "platform": "linux-arm64",
       "archive": "apm-linux-arm64.tar.gz",
       "extracted_directory": "apm-linux-arm64",
-      "sha256": "c4d6b5ab6d9bdca3c3c324db7ce8d1c4faf7b317f45a55a50ae2571eaa506d25"
+      "sha256": "7df6e64ca9540665367f07af0226077ba92820f6cc759c10a5ca37e038a500e4"
     },
     {
       "platform": "linux-x86_64",
       "archive": "apm-linux-x86_64.tar.gz",
       "extracted_directory": "apm-linux-x86_64",
-      "sha256": "3afba455c5283852ba4c392f668be7c27b65bc4a0fa60a8b53a4626c52628431"
+      "sha256": "be2d8a97ca8816636117ec26da85482d647ae3353213ea022fb1130c2dd3d3b0"
     },
     {
       "platform": "windows-x86_64",
       "archive": "apm-windows-x86_64.zip",
       "extracted_directory": "apm-windows-x86_64",
-      "sha256": "1b74a90c7ee6373ab2926addd110c1dbc5934a9675e5f436cac4d04f46cce2f5"
+      "sha256": "1a7703864babee7deaab3d13b4fe50b51ea5c1ae2edb2dae46fbbab5a6cead9d"
     }
-  ],
-  "cooldown_exception": {
-    "approved_at": "2026-07-24T13:48:14Z",
-    "reason": "APM 0.26.0 fixes audit config-consistency false failures for virtual packages (microsoft/apm#2214).",
-    "scope": "bootstrap-cli-release-time-gate"
-  }
+  ]
 }

.agents/skills/apm-usage/scripts/propose_bootstrap_update.py → .agents/skills/apm-workflow/scripts/propose_bootstrap_update.py

@@ -31,13 +31,13 @@ def semver(tag: str) -> tuple[int, int, int]:
 
 
 def request_json(url: str) -> object:
-    request = urllib.request.Request(url, headers={"Accept": "application/vnd.github+json", "User-Agent": "apm-usage-skill"})
+    request = urllib.request.Request(url, headers={"Accept": "application/vnd.github+json", "User-Agent": "apm-workflow-skill"})
     with urllib.request.urlopen(request, timeout=30) as response:
         return json.load(response)
 
 
 def request_text(url: str) -> str:
-    request = urllib.request.Request(url, headers={"User-Agent": "apm-usage-skill"})
+    request = urllib.request.Request(url, headers={"User-Agent": "apm-workflow-skill"})
     with urllib.request.urlopen(request, timeout=30) as response:
         return response.read().decode("utf-8")
 

.agents/skills/docker-quality-check/SKILL.md

@@ -42,7 +42,10 @@ description: >-
    release age, checksums, permissions, and runtime behavior. Pin GitHub Actions to
    full commit SHAs with accurate version comments. Use
    `github-actions-quality-check` for workflow structure, permissions, runners,
-   validation, and publication gates.
+   validation, and publication gates. For an APM-managed repository, apply
+   `apm-workflow` and keep `apm audit --ci` in the outer source-check action.
+   Keep Markdown source validation in that same action so container-only
+   changes cannot bypass the repository documentation gate.
 7. Summarize commands run, build and smoke-test results, and every skipped check with a
    concrete reason.
 
@@ -52,7 +55,7 @@ When a workflow installs hadolint, pin both the release version and the SHA-256
 exact platform asset. Download over HTTPS, verify the hash before making the file
 executable, and install it only into the runner's temporary directory. Before changing
 a pin, verify the official release provenance and the repository's required adoption
-cooldown. Use the bundled `lint-docker` action when its single-Dockerfile contract fits.
+cooldown. Use the bundled `check-docker-source` action when its single-Dockerfile contract fits.
 
 Replace the version and checksum together only after independently verifying the
 official release asset. Do not use a floating download URL or skip hash verification.