csh/playbook
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

📦 deps(thirdparty): update snapshots

Browse Source
This commit is contained in:
ci[bot]
2026-07-20 00:03:02 +00:00
parent 47ce7f78dc
commit 2c00adccd5
1216 changed files with 10376 additions and 90058 deletions
Download Patch File Download Diff File Expand all files Collapse all files
antigravity-awesome-skills/.github/CODEOWNERS
Vendored
-6
View File
@@ -7,10 +7,4 @@
# Documentation
*.md @sickn33
# AAS v1 independently frozen verifier baseline. Independent reviewer
# attestations are content-addressed inside the protected baseline.
/verification/aas-v1/ @sickn33
/.github/workflows/aas-v1-baseline-check.yml @sickn33
/.github/workflows/aas-v1-product-verifier.yml @sickn33
/.github/workflows/aas-v1-verifier-harness.yml @sickn33
/.github/CODEOWNERS @sickn33
antigravity-awesome-skills/.github/MAINTENANCE.md
Vendored
+15 -61
View File
@@ -13,6 +13,12 @@ It covers the **Quality Bar**, **Documentation Consistency**, and **Release Work
**AGENTS MUST READ AND FOLLOW THIS SECTION BEFORE MARKING ANY TASK AS COMPLETE.**
### Current-base instruction guard
After establishing the clean task base, re-read `AGENTS.md`, this guide, the repository-canonical maintainer skill, and `package.json` from that exact base. Do not rely on repository instructions inherited from a different checkout.
Every command, script, reviewer, or gate described as mandatory must exist on the current task base. If it does not, never import or run the retired implementation from another branch, worktree, stash, installed copy, or historical commit. Compare with `origin/main`, inspect the removal history, and use the current-base contract; stop and report only if the conflict cannot be resolved from repository history.
There are 5 things that usually fail/get forgotten. **DO NOT FORGET THEM:**
### 1. 📤 ALWAYS PUSH (Non-Negotiable)
@@ -131,14 +137,7 @@ Before ANY commit that adds/modifies skills, run the chain:
```bash
npm run audit:maintainer
```
When you are reducing legacy `risk: unknown` debt, use this sequence instead of hand-editing large batches:
```bash
npm run audit:skills
npm run sync:risk-labels -- --dry-run
npm run sync:risk-labels
npm run sync:repo-state
```
`sync:risk-labels` is intentionally conservative. It should handle only the obvious subset; the ambiguous tail still needs maintainer review.
Risk labels are declared metadata. Validate the declared value and review ambiguous `risk: unknown` cases semantically; do not infer or rewrite risk from isolated words.
6. **COMMIT GENERATED FILES**:
```bash
@@ -156,45 +155,9 @@ Before ANY commit that adds/modifies skills, run the chain:
**Before merging:**
### Mandatory local reviewer gate for changed skills
### Skill-content review gate
<!-- local-skill-reviewer-policy:v1 -->
For every canonical `SKILL.md` change or change to one of its tracked bundle files, the maintainer must complete this local gate before the official merge gate:
1. Stage only the exact changed skill and bundle blobs intended for review. The local reviewer reads the Git index; an unstaged correction is not reviewed, and unrelated paths must not be staged with it.
2. Use a private result directory outside the repository and run:
```bash
npm run review:skills:local -- review <skill-id> --merge-gate --result-dir <private-temp-dir>
```
3. Inspect `triage.reviewStatus`, `triage.priority`, and `triage.reasonCodes`. For P0/P1, uncertain, or locally namespaced `manual-review-required` results, choose exactly one semantic preparation route.
Single-skill semantic route (alternative to batch preparation):
```bash
npm run review:skills:semantic:packet -- <skill-id> --result-dir <private-temp-dir>
```
Obtain the Codex judgment for that packet, then import and verify it:
```bash
npm run review:skills:semantic:import -- <skill-id> --input <codex-judgment.json> --result-dir <private-temp-dir>
npm run review:skills:semantic:verify -- <skill-id> --result-dir <private-temp-dir>
```
Batch semantic route (alternative to the single-skill packet command):
```bash
npm run review:skills:semantic:prepare -- --result-dir <private-temp-dir>
```
For each escalated skill in that batch, obtain its Codex judgment, then run the same `semantic:import` and `semantic:verify` commands above. Never run `semantic:packet` and `semantic:prepare` for the same skill in the same result directory.
4. After any correction, stage the exact intended blobs again and rerun the local reviewer, `npm run validate`, `npm run validate:references`, `npm run security:docs`, and the relevant tests.
The local status is identified by `source: local-skill-reviewer`. It is triage and review support only: it does not replace Tessl, is not the CI status with the same name, and does not satisfy the exact-head attestation. A truthful Tessl `review` or the normal maintainer attestation bound to the full head SHA remains the official merge gate.
For every canonical `SKILL.md` or tracked bundle-file change, run validation, reference validation, documentation security, changed-skill evidence, and relevant tests. Review semantics, provenance, declared risk, limitations, and bundled files directly. The separate `skill-review` workflow or an exact-head maintainer attestation remains authoritative; local heuristic scores and inferred risk labels are not merge gates.
1. **CI is green** — Validation, warning-budget enforcement, README source-credit checks, reference checks, tests, and generated artifact steps passed (see [`.github/workflows/ci.yml`](workflows/ci.yml)). If the PR changes any `SKILL.md`, the separate [`skill-review` workflow](workflows/skill-review.yml) must also be green.
2. **Generated drift understood** — On pull requests, generator drift is informational only. Do not block a good PR solely because canonical artifacts would be regenerated. Also do not accept PRs that directly edit `CATALOG.md`, `skills_index.json`, or `data/*.json`; those files are `main`-owned.
@@ -213,7 +176,7 @@ This happens regularly on community PRs from forks. The common symptoms are:
- `gh pr checks` shows `no checks reported` even though Actions runs exist.
- `gh run list` shows `action_required` with `jobs: []` for `Skills Registry CI` or `Skill Review`.
- `pr-policy` fails with `PR body must include the Quality Bar Checklist from the template.` even after you corrected the PR body and hit rerun.
- the PR body does not include the optional Quality Bar Checklist.
Use this playbook:
@@ -225,19 +188,10 @@ Use this playbook:
```bash
npm run merge:batch -- --prs <PR_NUMBER> --reviewed-head <40-character-head-sha>
```
2. **Normalize the PR body** so it includes the repository template's `## Quality Bar Checklist ✅` section. If `gh pr edit` works, use it. If `gh pr edit` fails with the GraphQL `projectCards` / Projects Classic deprecation error, patch the PR body through the REST API instead:
```bash
gh api repos/<OWNER>/<REPO>/pulls/<PR_NUMBER> -X PATCH --input <(jq -n --rawfile body /tmp/pr_body.md '{body:$body}')
```
3. **Do not trust a plain rerun** to pick up the updated PR body. In practice, `gh run rerun <RUN_ID>` may re-use the original `pull_request` event payload, so `pr-policy` can keep reading the stale body and fail again.
4. **If the rerun still sees stale metadata, close and reopen the PR** to force a fresh `pull_request` event:
```bash
gh pr close <PR_NUMBER> --comment "Maintainer workflow refresh: closing and reopening to retrigger pull_request checks against the updated PR body."
gh pr reopen <PR_NUMBER>
```
5. **Let `merge:batch` wait for and approve newly created fork runs** after reopen. GitHub Actions materializes those runs asynchronously, so an empty first lookup is not evidence that approval is unnecessary. Do not approve them directly by run ID; the command binds every approval to the current PR, exact head SHA, allowlisted workflow, locally recomputed diff, and the workflow/check-suite generation created after the reopen.
6. **Wait for the new checks only.** You may see older failed `pr-policy` runs in the rollup alongside newer green runs. Freshness is determined by workflow-run and check-suite IDs captured after the reopen, not by head SHA or completion time alone. Merge only after that fresh run set is fully green: `pr-policy`, `pr-evidence`, `source-validation`, `artifact-preview`, and a truthful skill-review outcome when `SKILL.md` changed. `review` means Tessl semantic review actually ran or reused a successful result for the identical skill-content fingerprint. `manual-review-required` means Tessl did not run because repository secrets or Tessl credits were unavailable and requires the exact-SHA maintainer attestation above. Never describe `manual-review-required` as a Tessl review, and never rerun Tessl merely because the PR head or base moved when the changed skill content is identical. `source-validation` enforces the frozen warning budget and README source-credit coverage for changed skills, so missing `## When to Use` sections, missing README repo credits, or other new warning drift must be fixed before merge.
7. **If `gh pr merge` says `Base branch was modified`**, refresh the PR state and retry. This is normal when you are merging a batch and `main` moved between attempts.
2. **Treat the checklist as guidance, not evidence.** A missing checklist emits a notice; objective path, blob, validation, reference, provenance, security, test, and exact-head review gates determine mergeability.
3. **Let `merge:batch` approve action-required fork runs.** GitHub Actions materializes those runs asynchronously, so an empty first lookup is not evidence that approval is unnecessary. Do not approve them directly by run ID; the command binds every approval to the current PR, exact head SHA, allowlisted workflow, locally recomputed diff, and immutable PR tuple.
4. **Wait for the required checks.** Merge only after `pr-policy`, `pr-evidence`, `source-validation`, `artifact-preview`, and a truthful skill-review outcome when `SKILL.md` changed. `review` means Tessl semantic review actually passed or reused a successful result for the identical skill-content fingerprint. `manual-review-required` means credentials or credits were unavailable, or Tessl did not produce a passing result; it requires the exact-SHA maintainer judgment above. Never describe `manual-review-required` as “Tessl passed,” and never rerun Tessl merely because the PR head or base moved when the changed skill content is identical.
5. **If the merge endpoint says `Base branch was modified`**, refresh the PR state and retry. This is normal when you are merging a batch and `main` moved between attempts.
**If a PR was closed after local integration (reopen and merge):**
@@ -283,7 +237,7 @@ We used this flow for PRs [#220](https://github.com/sickn33/agentic-awesome-skil
**Maintainer shortcut for batched PRs:**
- Use `npm run merge:batch -- --prs 450,449,446,451` to automate the ordered maintainer flow for multiple PRs. See [docs/maintainers/merge-batch.md](../docs/maintainers/merge-batch.md) for the short usage guide.
- Pages is release-only: ordinary pushes to `main` never deploy it. Dispatch `.github/workflows/pages.yml` explicitly only at an approved publication gate. Canonical-sync merges still use `--skip-pages` and carry `[skip pages]` as a durable audit marker; required CI, the frozen AAS baseline, and CodeQL remain enforced.
- Pages is release-only: ordinary pushes to `main` never deploy it. Dispatch `.github/workflows/pages.yml` explicitly only at an approved publication gate. Canonical-sync merges still use `--skip-pages` and carry `[skip pages]` as a durable audit marker; the four routine app-bound checks and CodeQL remain enforced. The supported Core preview uses the targeted packed smoke workflow; retired certified-v1 verifier harnesses are not part of the repository workflow.
- The script keeps the GitHub-only squash merge rule, handles fork-run approvals and stale PR metadata refresh, waits only on fresh required checks, retries `Base branch was modified`, and runs the mandatory post-merge `sync:contributors` follow-up on `main`. The fork content allowlist applies only to external PRs; same-repository maintainer PRs may change repository-wide source while remaining subject to protected checks, trusted changed-skill evidence, exact-head review, and immutable PR identity.
- It is intentionally not a conflict resolver. If a PR is conflicting, stop and follow the manual conflict playbook.
antigravity-awesome-skills/.github/workflows/aas-agent-first-preview.yml
Vendored
+5 -21
View File
@@ -41,6 +41,10 @@ jobs:
- name: Verify deterministic catalog and preview contracts
run: |
npm run plugin-compat:sync
npm run index
npm run catalog
npm run build:aas-v1-catalog
npm run check:aas-v1-catalog
npm run test:aas-v1
node --check verification/aas-preview/runner.mjs
@@ -68,21 +72,6 @@ jobs:
- job-id: linux-node-22
os: ubuntu-24.04
node: 22.23.1
- job-id: linux-node-24
os: ubuntu-24.04
node: 24.18.0
- job-id: macos-node-22
os: macos-15-intel
node: 22.23.1
- job-id: macos-node-24
os: macos-15-intel
node: 24.18.0
- job-id: windows-node-22
os: windows-2025
node: 22.23.1
- job-id: windows-node-24
os: windows-2025
node: 24.18.0
runs-on: ${{ matrix.os }}
timeout-minutes: 25
steps:
@@ -169,18 +158,13 @@ jobs:
path: ${{ runner.temp }}/aas-preview-receipts
merge-multiple: true
- name: Aggregate without weakening certified-v1 gates
- name: Aggregate the supported preview smoke
shell: bash
run: |
set -euo pipefail
root="$RUNNER_TEMP/aas-preview-receipts"
node verification/aas-preview/aggregate.mjs \
--receipt "$root/aas-preview-linux-node-22.json" \
--receipt "$root/aas-preview-linux-node-24.json" \
--receipt "$root/aas-preview-macos-node-22.json" \
--receipt "$root/aas-preview-macos-node-24.json" \
--receipt "$root/aas-preview-windows-node-22.json" \
--receipt "$root/aas-preview-windows-node-24.json" \
--workbench "$root/aas-preview-workbench.json" \
--out "$RUNNER_TEMP/aas-agent-first-preview.json"
antigravity-awesome-skills/.github/workflows/aas-v1-baseline-check.yml
Vendored
-50
View File
@@ -1,50 +0,0 @@
name: AAS v1 baseline freeze
on:
pull_request:
push:
branches: ["main"]
permissions:
contents: read
jobs:
baseline-freeze:
name: aas-v1-baseline
runs-on: ubuntu-24.04
timeout-minutes: 15
steps:
- name: Check out candidate baseline
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
with:
persist-credentials: false
- name: Use the frozen verifier runtime
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
with:
node-version: 22.23.1
cache: npm
cache-dependency-path: verification/aas-v1/verifier/package-lock.json
- name: Install verifier dependencies without lifecycle scripts
run: npm --prefix verification/aas-v1/verifier ci --ignore-scripts
- name: Run reference metric tests
run: npm --prefix verification/aas-v1/verifier test
- name: Validate frozen schemas and corpora
run: |
npm --prefix verification/aas-v1/verifier run check:schemas
npm --prefix verification/aas-v1/verifier run check:structure
npm --prefix verification/aas-v1/verifier run check:benchmark:frozen
npm --prefix verification/aas-v1/verifier run check:secondary:frozen
- name: Verify hostile fixtures and legacy snapshots
run: |
node verification/aas-v1/baseline/v1/hostile/verify-fixtures.mjs
node verification/aas-v1/baseline/v1/legacy/14.6.0/validate-snapshots.mjs
- name: Verify ownership, freeze readiness, and content digest
run: |
npm --prefix verification/aas-v1/verifier run check:freeze-ready
npm --prefix verification/aas-v1/verifier run freeze:check
antigravity-awesome-skills/.github/workflows/aas-v1-product-verifier.yml
Vendored
-199
View File
@@ -1,199 +0,0 @@
name: AAS v1 product verifier
on:
pull_request:
branches: [main]
paths:
- "tools/bin/aas.js"
- "tools/bin/aas-mcp.js"
- "tools/lib/aas-v1/**"
- "data/aas-v1/**"
- "schemas/aas-v1/**"
- "package.json"
- "package-lock.json"
workflow_dispatch:
inputs:
candidate_commit:
description: Full candidate commit SHA
required: true
type: string
permissions:
contents: read
concurrency:
group: aas-v1-product-${{ github.event.pull_request.head.sha || inputs.candidate_commit }}
cancel-in-progress: false
jobs:
candidate-pack:
name: Candidate tarball
runs-on: ubuntu-24.04
timeout-minutes: 15
outputs:
commit: ${{ steps.identity.outputs.commit }}
verifier_commit: ${{ steps.identity.outputs.verifier_commit }}
steps:
- name: Resolve immutable candidate
id: identity
shell: bash
env:
PR_SHA: ${{ github.event.pull_request.head.sha }}
BASE_SHA: ${{ github.event.pull_request.base.sha }}
INPUT_SHA: ${{ inputs.candidate_commit }}
WORKFLOW_SHA: ${{ github.sha }}
run: |
sha="${PR_SHA:-$INPUT_SHA}"
verifier_sha="${BASE_SHA:-$WORKFLOW_SHA}"
[[ "$sha" =~ ^[0-9a-f]{40}$ ]] || exit 64
[[ "$verifier_sha" =~ ^[0-9a-f]{40}$ ]] || exit 64
echo "commit=$sha" >> "$GITHUB_OUTPUT"
echo "verifier_commit=$verifier_sha" >> "$GITHUB_OUTPUT"
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
with:
ref: ${{ steps.identity.outputs.commit }}
path: candidate
persist-credentials: false
- uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
with:
node-version: 24.18.0
cache: npm
cache-dependency-path: candidate/package-lock.json
- name: Pack without lifecycle execution
working-directory: candidate
shell: bash
run: |
mkdir -p "$RUNNER_TEMP/aas-candidate"
npm pack --ignore-scripts --json --pack-destination "$RUNNER_TEMP/aas-candidate" > "$RUNNER_TEMP/aas-pack.json"
test "$(find "$RUNNER_TEMP/aas-candidate" -maxdepth 1 -name '*.tgz' -type f | wc -l | tr -d ' ')" = 1
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
name: aas-v1-candidate-${{ steps.identity.outputs.commit }}
path: ${{ runner.temp }}/aas-candidate/*.tgz
if-no-files-found: error
retention-days: 14
verify:
name: ${{ matrix.id }}
needs: candidate-pack
env:
GIT_CONFIG_COUNT: 1
GIT_CONFIG_KEY_0: core.autocrlf
GIT_CONFIG_VALUE_0: "false"
strategy:
fail-fast: false
matrix:
include:
- id: linux-node-22
os: ubuntu-24.04
node: 22.23.1
fs_type: ext4
fs_case: sensitive
- id: linux-node-24
os: ubuntu-24.04
node: 24.18.0
fs_type: ext4
fs_case: sensitive
- id: macos-node-22
os: macos-15-intel
node: 22.23.1
fs_type: apfs
fs_case: insensitive-preserving
- id: macos-node-24
os: macos-15-intel
node: 24.18.0
fs_type: apfs
fs_case: insensitive-preserving
- id: windows-node-22
os: windows-2025
node: 22.23.1
fs_type: ntfs
fs_case: insensitive-preserving
- id: windows-node-24
os: windows-2025
node: 24.18.0
fs_type: ntfs
fs_case: insensitive-preserving
runs-on: ${{ matrix.os }}
continue-on-error: false
timeout-minutes: 45
steps:
- name: Checkout protected verifier revision
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
with:
ref: ${{ needs.candidate-pack.outputs.verifier_commit }}
path: trusted
persist-credentials: false
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
with:
name: aas-v1-candidate-${{ needs.candidate-pack.outputs.commit }}
path: ${{ runner.temp }}/candidate
- uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
with:
node-version: ${{ matrix.node }}
cache: npm
cache-dependency-path: trusted/verification/aas-v1/verifier/package-lock.json
- name: Install verifier dependencies only
working-directory: trusted/verification/aas-v1/verifier
run: npm ci --ignore-scripts
- name: Verify protected freeze before candidate execution
working-directory: trusted/verification/aas-v1/verifier
run: npm run freeze:check
- name: Run black-box verifier
shell: bash
env:
AAS_VERIFIER_RUNNER_LABEL: ${{ matrix.os }}
AAS_VERIFIER_FILESYSTEM_TYPE: ${{ matrix.fs_type }}
AAS_VERIFIER_FILESYSTEM_CASE: ${{ matrix.fs_case }}
run: |
tarball="$(find "$RUNNER_TEMP/candidate" -maxdepth 1 -name '*.tgz' -type f -print -quit)"
node trusted/verification/aas-v1/verifier/bin/verify-product.mjs \
--tarball "$tarball" \
--candidate-commit "${{ needs.candidate-pack.outputs.commit }}" \
--verifier-commit "${{ needs.candidate-pack.outputs.verifier_commit }}" \
--job-id "${{ matrix.id }}" \
--transaction-evidence "$RUNNER_TEMP/aas-transaction-evidence.json" \
--work-root "$RUNNER_TEMP/aas-v1-work" \
--out "$RUNNER_TEMP/aas-v1-${{ matrix.id }}.json"
- name: Upload immutable job receipt
if: always()
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
name: aas-v1-receipt-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.id }}
path: ${{ runner.temp }}/aas-v1-${{ matrix.id }}.json
if-no-files-found: error
retention-days: 30
aggregate:
name: Aggregate exact matrix
if: always()
needs: [candidate-pack, verify]
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
with:
ref: ${{ needs.candidate-pack.outputs.verifier_commit }}
path: trusted
persist-credentials: false
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
with:
pattern: aas-v1-receipt-${{ github.run_id }}-${{ github.run_attempt }}-*
path: ${{ runner.temp }}/receipts
merge-multiple: true
- uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
with:
node-version: 24.18.0
- name: Merge and enforce all six receipts
shell: bash
run: |
npm ci --ignore-scripts --prefix trusted/verification/aas-v1/verifier
node trusted/verification/aas-v1/verifier/bin/merge-product-evidence.mjs \
--out "$RUNNER_TEMP/aas-v1-evidence-bundle.json" \
"$RUNNER_TEMP"/receipts/*.json
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
if: always()
with:
name: aas-v1-evidence-${{ github.run_id }}-${{ github.run_attempt }}
path: ${{ runner.temp }}/aas-v1-evidence-bundle.json
if-no-files-found: error
retention-days: 30
antigravity-awesome-skills/.github/workflows/aas-v1-verifier-harness.yml
Vendored
-58
View File
@@ -1,58 +0,0 @@
name: AAS v1 verifier harness
on:
pull_request:
branches: [main]
paths:
- "verification/aas-v1/**"
- ".github/workflows/aas-v1-verifier-harness.yml"
- ".github/workflows/aas-v1-product-verifier.yml"
- ".github/CODEOWNERS"
workflow_dispatch:
permissions:
contents: read
jobs:
harness:
name: ${{ matrix.id }}
env:
GIT_CONFIG_COUNT: 1
GIT_CONFIG_KEY_0: core.autocrlf
GIT_CONFIG_VALUE_0: "false"
strategy:
fail-fast: false
matrix:
include:
- { id: linux-node-22, os: ubuntu-24.04, node: 22.23.1 }
- { id: linux-node-24, os: ubuntu-24.04, node: 24.18.0 }
- { id: macos-node-22, os: macos-15-intel, node: 22.23.1 }
- { id: macos-node-24, os: macos-15-intel, node: 24.18.0 }
- { id: windows-node-22, os: windows-2025, node: 22.23.1 }
- { id: windows-node-24, os: windows-2025, node: 24.18.0 }
runs-on: ${{ matrix.os }}
continue-on-error: false
timeout-minutes: 15
steps:
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
with:
persist-credentials: false
- uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
with:
node-version: ${{ matrix.node }}
cache: npm
cache-dependency-path: verification/aas-v1/verifier/package-lock.json
- name: Install verifier without lifecycle execution
working-directory: verification/aas-v1/verifier
run: npm ci --ignore-scripts
- name: Schemas, structure, freeze and self-tests
working-directory: verification/aas-v1/verifier
shell: bash
run: |
npm run check:schemas
npm run check:structure
npm run freeze:check
npm test
- name: Platform-native observer sentinel
working-directory: verification/aas-v1/verifier
run: npm run test:platform -- --job-id ${{ matrix.id }}
antigravity-awesome-skills/.github/workflows/ci.yml
Vendored
+5 -12
View File
@@ -127,8 +127,7 @@ jobs:
fi
if [ "${{ steps.intake.outputs.has_quality_checklist }}" != "true" ]; then
echo "PR body must include the Quality Bar Checklist from the template."
exit 1
echo "::notice::PR body does not include the optional Quality Bar Checklist."
fi
if [ "${{ steps.intake.outputs.has_issue_link }}" != "true" ]; then
@@ -186,21 +185,12 @@ jobs:
if: needs.pr-policy.outputs.requires_references == 'true'
run: npm run validate:references
- name: Audit npm dependencies
run: npm audit --audit-level=high
- name: Refresh ephemeral derived sources for tests
run: npm run plugin-compat:sync && npm run index && npm run bundles:sync
run: npm run plugin-compat:sync && npm run index && npm run bundles:sync && npm run sync:metadata && npm run catalog && npm run build:aas-v1-catalog
- name: Run tests
run: npm run test
- name: Install web-app dependencies
run: npm run app:install
- name: Run web app coverage
run: npm run app:test:coverage
- name: Run docs security checks
run: npm run security:docs
@@ -303,6 +293,9 @@ jobs:
needs: [pr-policy, source-validation]
steps:
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
with:
fetch-depth: 0
persist-credentials: false
- name: Set up Python
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
antigravity-awesome-skills/.github/workflows/pages.yml
Vendored
+3
View File
@@ -25,6 +25,9 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
with:
fetch-depth: 0
persist-credentials: false
- name: Setup Node
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
antigravity-awesome-skills/.github/workflows/publish-npm.yml
Vendored
+10 -2
View File
@@ -32,7 +32,7 @@ jobs:
- name: Setup Node
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
with:
node-version: "20"
node-version: "22.23.1"
registry-url: "https://registry.npmjs.org"
- name: Verify release identity
@@ -77,6 +77,14 @@ jobs:
run: npm pack --dry-run --json
- name: Publish
run: npm publish
shell: bash
run: |
version="$(node -p "require('./package.json').version")"
node -e "const v=process.argv[1]; const semver=/^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$/; if (!semver.test(v)) process.exit(1)" "$version"
if [[ "$version" == *-* ]]; then
npm publish --tag next
else
npm publish --tag latest
fi
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
antigravity-awesome-skills/.github/workflows/skill-apply-optimize-run.yml
Vendored
-23
View File
@@ -1,23 +0,0 @@
name: Apply Skill Optimization Run (Paused)
on:
workflow_dispatch:
inputs:
pr_number:
description: Pull request number to apply the latest Tessl optimization to
required: true
type: string
concurrency:
group: skill-apply-optimize-${{ inputs.pr_number }}
cancel-in-progress: false
jobs:
apply:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- name: Explain paused auto-apply
run: |
echo "::error title=/apply-optimize paused::This workflow depended on deprecated Tessl Skill Review comments. Re-enable it after wiring Tessl Review Fix safely."
exit 1
antigravity-awesome-skills/.github/workflows/skill-apply-optimize.yml
Vendored
-56
View File
@@ -1,56 +0,0 @@
name: Explain Skill Optimization Apply
on:
issue_comment:
types: [created]
jobs:
explain:
if: >-
github.event.issue.pull_request &&
contains(github.event.comment.body, '/apply-optimize')
runs-on: ubuntu-latest
permissions:
issues: write
steps:
- uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
with:
github-token: ${{ github.token }}
script: |
const trusted = new Set(['OWNER', 'MEMBER', 'COLLABORATOR']);
const prNumber = context.payload.issue?.number;
const association = context.payload.comment?.author_association ?? 'NONE';
if (!prNumber) {
core.setFailed('No pull request number found in issue_comment payload.');
return;
}
if (!trusted.has(association)) {
await github.rest.issues.createComment({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: prNumber,
body:
'⚠️ `/apply-optimize` can only be queued by repository maintainers ' +
'(OWNER, MEMBER, or COLLABORATOR).',
});
return;
}
await github.rest.reactions.createForIssueComment({
owner: context.repo.owner,
repo: context.repo.repo,
comment_id: context.payload.comment.id,
content: 'eyes',
});
await github.rest.issues.createComment({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: prNumber,
body:
'⚠️ `/apply-optimize` is paused while this repository migrates from ' +
'deprecated Tessl Skill Review comments to Tessl Review runs. ' +
'Please use the `skill-review` check output for now; maintainers can ' +
're-enable auto-fix once the `tessl review fix` output contract is wired safely.',
});
antigravity-awesome-skills/.github/workflows/skill-review.yml
Vendored
+8 -15
View File
@@ -79,7 +79,8 @@ jobs:
echo "result=quota" >> "$GITHUB_OUTPUT"
echo "::warning title=Tessl quota unavailable::A maintainer must review and attest to this exact head SHA before merge."
else
exit "$status"
echo "result=manual" >> "$GITHUB_OUTPUT"
echo "::warning title=Tessl review needs maintainer judgment::Tessl did not produce a passing semantic result. A maintainer must review and attest to this exact head SHA before merge."
fi
env:
BASE_SHA: ${{ github.event.pull_request.base.sha }}
@@ -107,6 +108,8 @@ jobs:
echo "outcome=reviewed" >> "$GITHUB_OUTPUT"
elif [ "$TESSL_RESULT" = "quota" ]; then
echo "outcome=quota" >> "$GITHUB_OUTPUT"
elif [ "$TESSL_RESULT" = "manual" ]; then
echo "outcome=manual" >> "$GITHUB_OUTPUT"
else
echo "::error title=Unresolved review state::The Tessl review did not produce a trustworthy outcome."
exit 1
@@ -134,7 +137,7 @@ jobs:
manual-review-required:
needs: [review-state, review-attempt]
if: ${{ always() && ((needs.review-state.outputs.configured != 'true' && github.event.pull_request.head.repo.full_name != github.repository) || needs.review-attempt.outputs.outcome == 'quota') }}
if: ${{ always() && (needs.review-state.outputs.configured != 'true' || (needs.review-attempt.result == 'success' && needs.review-attempt.outputs.outcome != 'reviewed')) }}
runs-on: ubuntu-latest
permissions:
contents: read
@@ -146,8 +149,10 @@ jobs:
run: |
if [ "$REVIEW_OUTCOME" = "quota" ]; then
reason="the Tessl credit quota is unavailable"
elif [ "$REVIEW_OUTCOME" = "manual" ]; then
reason="Tessl did not produce a passing semantic result"
else
reason="repository secrets are unavailable to this fork pull request"
reason="Tessl credentials are unavailable"
fi
echo "::warning title=Manual skill review required::Semantic review is unavailable because ${reason}. A maintainer must attest to the exact head SHA before merge: ${HEAD_SHA}."
{
@@ -156,15 +161,3 @@ jobs:
echo "- Head SHA: \`${HEAD_SHA}\`"
echo "- Reason: ${reason}."
} >> "$GITHUB_STEP_SUMMARY"
missing-review-credentials:
needs: [review-state, review-attempt]
if: ${{ always() && needs.review-state.outputs.configured != 'true' && github.event.pull_request.head.repo.full_name == github.repository }}
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- name: Require Tessl token for repository branches
run: |
echo "::error title=Missing Tessl token::Configure TESSL_TOKEN, or keep the legacy TESSL_API_TOKEN secret until the migration is complete."
exit 1