358 lines
30 KiB
Markdown
358 lines
30 KiB
Markdown
# Maintenance Walkthrough - 2026-07-28
|
|
|
|
- Added a fail-closed provenance exception ledger for maintainer-verified upstream repository renames. The initial Modellix entry records that `Modellix/modellix-skill` and `Modellix/modellix-plugin` resolve to GitHub repository ID `1150322983`; only the exact recorded transition is allowed, while unrelated provenance changes remain blocked.
|
|
- Traced a live Search Console `Pagina con reindirizzamento` report to the
|
|
slashless `/plugins` URL, which GitHub Pages correctly redirects to the
|
|
indexable `/plugins/` route.
|
|
- Normalized every runtime link to workbench, plugin, topic, and skill pages
|
|
through the existing trailing-slash route helper so crawlers are no longer
|
|
invited to request redirecting URL variants.
|
|
- Added focused web-app assertions for trailing-slash navigation targets; the
|
|
sitemap, canonical metadata, and public route remain aligned on `/plugins/`.
|
|
|
|
# Maintenance Walkthrough - 2026-07-26
|
|
|
|
- Imported the MIT-licensed `fedora-hyprland-installer` contribution from
|
|
[maleksaadi0109/hyprfedora](https://github.com/maleksaadi0109/hyprfedora) at
|
|
upstream commit `3ec6d4fc5eecdb188613dd841dce9926ae5c8319`.
|
|
- Hardened its privileged Fedora workflow with explicit critical-risk metadata,
|
|
provenance, limitations, consistent NVIDIA guidance, isolated tests, and
|
|
claims bounded to the behavior implemented by the bundled scripts.
|
|
- Added the MIT-licensed `find-complementary-founders` skill from
|
|
[merc1305/findMate](https://github.com/merc1305/findMate).
|
|
- Preserved its own-owner-only invariant, offline evidence assessment,
|
|
hash-bound publication approvals, expiring profiles, and stop-at-101 star
|
|
rule while adapting metadata, triggers, provenance, and limitations to the
|
|
AAS quality contract.
|
|
- Included the complete source skill directory without generated registry
|
|
artifacts, private owner data, credentials, or publication receipts.
|
|
- Synced the five actionable review fixes from canonical FindMate release
|
|
`v1.3.4`: consent-free private drafts, temporal consent validation,
|
|
one-sided seeking cards, source-identity self-exclusion, and the bundled
|
|
Russian onboarding reference. The canonical suite passes 40 tests and the
|
|
portable release resolves to commit `c78a78b0280f4168294b72f38aa39317e7b7d7b8`.
|
|
- Synced the privacy-preserving G35 publication path from immutable canonical
|
|
release `v1.3.5` at
|
|
`d23cd66d0ee324c0ed7e85156606d8814250c1f8`: one exact owner-approved GitHub
|
|
comment may now carry bounded inline JSON, the existing immutable linked
|
|
source remains supported, and deleting or unmarking the source removes its
|
|
current validation receipt. The owner is warned that the publishing login
|
|
and proof/contact links may connect the alias to a real identity and that
|
|
public edit history or copies prevent any promise of complete erasure.
|
|
- Preserved the AAS catalog metadata, usage guidance, provenance, limitations,
|
|
source-only contract, and all owner consent boundaries while updating the
|
|
five compatible reference/script files. The canonical FindMate suite passes
|
|
47 tests; no owner profile, credential, generated registry, or plugin mirror
|
|
is included in this contributor update.
|
|
- Added the MIT-licensed `orchestrate` skill from
|
|
[provencher/codex-skills](https://github.com/provencher/codex-skills) at
|
|
upstream commit `8aa6c42b73781c905c55f8a1253a18127079ac21`.
|
|
- Preserved its concise Codex-native delegation policy and UI metadata while
|
|
adding the repository-required usage guidance, limitations, immutable
|
|
provenance, and user-held approval boundaries.
|
|
- Kept the source PR limited to canonical skill content, source credit, and this
|
|
maintenance evidence; generated registries and plugin mirrors remain owned by
|
|
protected canonical synchronization.
|
|
- Consolidated the two open UIZZE contribution paths into one protected maintainer repair, preserving the actionable public-catalog research, design-contract, implementation, and hard finish-gate workflow contributed by [@samuelbushi](https://github.com/samuelbushi) in PR `#929` together with the bounded preview introduced by PR `#983`.
|
|
- Kept the free `check_ui_slop` preview optional while requiring explicit approval before persistent MCP configuration or external HTML/CSS transmission.
|
|
- Added the official MIT license metadata and organizational author while preserving the existing immutable source identity; GitHub redirects the historical upstream URL to the transferred official repository.
|
|
- Left generated registries and plugin mirrors out of the source PR so the protected canonical synchronization workflow remains their sole owner.
|
|
- Merged the consolidated source through PR [#985](https://github.com/sickn33/agentic-awesome-skills/pull/985), then converged generated state and plugin mirrors through protected PR [#986](https://github.com/sickn33/agentic-awesome-skills/pull/986).
|
|
|
|
# Maintenance Walkthrough - 2026-04-17
|
|
|
|
- Imported 8 frontend/design skills from [Leonxlnx/taste-skill](https://github.com/Leonxlnx/taste-skill) into `skills/`:
|
|
- `design-taste-frontend`
|
|
- `gpt-taste`
|
|
- `redesign-existing-projects`
|
|
- `high-end-visual-design`
|
|
- `minimalist-ui`
|
|
- `industrial-brutalist-ui`
|
|
- `stitch-design-taste`
|
|
- `full-output-enforcement`
|
|
- Normalized the imported skill metadata to repository conventions:
|
|
- folder names match `name`
|
|
- `risk`, `source`, `source_repo`, `source_type`, `author`, and `date_added` are present
|
|
- descriptions are shortened for validation
|
|
- `## When to Use` sections were added where the upstream files did not have one
|
|
- Preserved the upstream `stitch-design-taste/DESIGN.md` artifact.
|
|
- Added source attribution for `Leonxlnx/taste-skill` in `README.md` and `docs/sources/sources.md`.
|
|
|
|
# Maintenance Walkthrough - 2026-04-05
|
|
|
|
- Merged community PR batch `#487`, `#488`, `#489`, and `#490` on GitHub with squash, following the maintainer GitHub-only merge contract instead of local integration.
|
|
- Used the repository batch shortcut for the initial pass, then switched to the manual maintainer playbook when fork metadata drift produced stale `pr-policy` failures on reopened PRs.
|
|
- Repaired PR `#488` on the contributor branch by adding the missing `fruitwyatt/puzzle-activity-planner` source credit to `README.md`, then pushed the maintainer fix back to the fork and re-ran the fork workflows.
|
|
- Normalized PR `#490` by patching the body to include the required `## Quality Bar Checklist ✅` section, then closed and reopened it to force fresh `pull_request` checks against the updated metadata.
|
|
- Approved the pending fork workflow runs for PRs `#487` through `#490` after each reopen/push cycle so `Skills Registry CI`, `Skill Review & Optimize`, `Dependency Review`, and `CodeQL` could execute on the contributor heads.
|
|
- Ran the mandatory post-merge `npm run sync:contributors` follow-up after each successful merge and pushed the resulting README contributor-sync commits directly to `main` when the sync changed tracked files.
|
|
- Prepared the `v9.12.0` release notes in `CHANGELOG.md` to cover the Rayden UI additions, puzzle activity planning, skill diagnostics, and the `sales-automator` YAML repair before starting the release workflow.
|
|
|
|
- Closed issues `#455` and `#456` with maintainer comments explaining what a follow-up submission must include before reopening:
|
|
- concrete repo diff or implementation PR
|
|
- source-only contributor branch
|
|
- Quality Bar checklist and maintainer validations from `.github/MAINTENANCE.md`
|
|
- Reviewed open issues `#455` and `#456` during the maintainer sweep; neither had a matching accepted PR and both remain open pending a source-quality contributor submission.
|
|
- Triaged PR `#454` as superseded by `#457` because `#457` rebuilds the Windows validation/test fixes on top of current `main` and includes the follow-up batch activation fix requested in review.
|
|
- Verified PR `#457` locally on the contributor head with:
|
|
- `npm run validate`
|
|
- `npm run validate:references`
|
|
- `npm run check:warning-budget`
|
|
- `npm run check:readme-credits -- --base origin/main --head HEAD`
|
|
- `npm run test`
|
|
- `npm run app:test:coverage`
|
|
- `npm run app:build`
|
|
- Cleaned PR `#457` back to the repository's source-only PR contract by dropping maintainer-owned generated registry artifacts before merge review.
|
|
- Normalized the PR metadata so the required Quality Bar Checklist is present before re-triggering the fork-based GitHub Actions checks.
|
|
|
|
# Maintenance Walkthrough - 2026-03-30
|
|
|
|
- Merged PR #418 on GitHub with squash after approving the pending fork workflow run and waiting for `pr-policy`, `source-validation`, and `artifact-preview` to finish green.
|
|
- Repaired PR #423's stale metadata state by updating the PR body to include the required Quality Bar Checklist, then closed and reopened it to force fresh `pull_request` runs before squash merging it on GitHub.
|
|
- Synced local `main` after the PR merge batch so release preparation starts from the canonical remote state.
|
|
- Resolved issue #421 by ensuring the `README.md` Community Contributed Skills section includes `SoulPass` on `main`.
|
|
- Resolved issue #419 by tightening the `github-issue-creator` frontmatter description and "When to Use" guidance for better discoverability.
|
|
- Prepared the `v9.3.0` release notes in `CHANGELOG.md` and recorded the maintainer actions here before running the release flow.
|
|
|
|
# Maintenance Walkthrough - 2026-03-29
|
|
|
|
- Re-triaged the full 2026-03-15 security finding set against current `main` and wrote a fresh current-head report in `docs/maintainers/security-findings-triage-2026-03-29-refresh.md`.
|
|
- Added a matching machine-readable export at `docs/maintainers/security-findings-triage-2026-03-29-refresh.csv` so the refreshed statuses are available in both markdown and CSV form.
|
|
- Kept the old `2026-03-15` markdown/CSV as historical baseline input, preserved the smaller `2026-03-29` addendum as a transition note, and pointed both docs at the new refresh as the current source of truth.
|
|
- The refreshed triage currently lands at:
|
|
- `0` findings still present and exploitable
|
|
- `0` findings still present but low practical risk
|
|
- `26` obsolete/not reproducible on current HEAD
|
|
- `7` duplicates
|
|
- The refresh folds in the hardening shipped today and earlier in the session:
|
|
- symlink/path safety in maintainer/install/web copy flows
|
|
- frontmatter parser robustness
|
|
- removal of shared frontend star writes
|
|
- secure Office unpack behavior
|
|
- migration away from predictable `/tmp` state files
|
|
|
|
- Fixed the remaining production/documentation drift introduced by the web-app and CI hardening work:
|
|
- clarified that the hosted GitHub Pages app runs in static public-catalog mode
|
|
- documented that `Sync Skills` is development-only unless explicitly enabled in local maintainer runs
|
|
- documented that web-app save/star interactions are intentionally browser-local today
|
|
- Hardened the maintainer documentation so release and CI expectations now match the live workflows:
|
|
- release docs now mention the shared `tools/requirements.txt` install path, the web-app coverage gate, and blocking `npm audit --audit-level=high` on publish
|
|
- maintainer docs now document the narrow canonical-artifact auto-sync contract on `main`
|
|
- Expanded the documented risk-maintenance workflow after the new automation landed:
|
|
- `audit:skills` exposes `suggested_risk`
|
|
- `sync:risk-labels` supports conservative high-confidence legacy cleanup
|
|
- offensive auto-promotions now also insert the canonical `AUTHORIZED USE ONLY` notice
|
|
- Updated user-facing install docs to mention that the npm installer now uses a shallow clone for lighter first-run installs.
|
|
- Updated the onboarding/trust docs to reflect the real `risk` taxonomy (`unknown`, `none`, `safe`, `critical`, `offensive`) instead of the older simplified wording.
|
|
|
|
# Maintenance Walkthrough - 2026-03-25
|
|
|
|
- Imported 14 skills from [Dimillian/Skills](https://github.com/Dimillian/Skills) into `skills/`:
|
|
- `app-store-changelog`
|
|
- `github`
|
|
- `ios-debugger-agent`
|
|
- `macos-menubar-tuist-app`
|
|
- `macos-spm-app-packaging`
|
|
- `orchestrate-batch-refactor`
|
|
- `project-skill-audit`
|
|
- `react-component-performance`
|
|
- `simplify-code`
|
|
- `swift-concurrency-expert`
|
|
- `swiftui-liquid-glass`
|
|
- `swiftui-performance-audit`
|
|
- `swiftui-ui-patterns`
|
|
- `swiftui-view-refactor`
|
|
- Normalized the imported skill metadata to match repository validation requirements:
|
|
- shortened oversized frontmatter descriptions
|
|
- added `risk`, `source`, and `date_added`
|
|
- added `## When to Use` sections so the imported batch does not increase the warning budget
|
|
- Added source attribution for `Dimillian/Skills` in:
|
|
- `README.md` under `Credits & Sources`
|
|
- `docs/sources/sources.md`
|
|
- Merged PR `#395` via GitHub squash merge after maintainer refresh of forked workflow approvals and PR body normalization; this added the new `snowflake-development` skill.
|
|
- Merged PR `#394` via GitHub squash merge after converting the contributor branch back to source-only, normalizing the PR checklist body, and shortening an oversized `wordpress-penetration-testing` description so CI passed.
|
|
- Patched `skills/snowflake-development/SKILL.md` on `main` with a `## When to Use` section so the repository stayed within the frozen validation warning budget after the PR merge batch.
|
|
- Reworked `/apply-optimize` automation to address GitHub code scanning alert `#36`: the public `issue_comment` trigger now only queues a trusted workflow, while the privileged branch checkout/apply logic runs in a separate `workflow_dispatch` path limited to same-repository branches.
|
|
- Ran the required direct-`main` maintainer sync flow after touching `skills/`:
|
|
- `npm run chain`
|
|
- `npm run check:warning-budget`
|
|
- `npm run catalog`
|
|
- Synced maintainer-owned generated artifacts and metadata to the new `1,325+` skill count:
|
|
- `README.md`
|
|
- `package.json`
|
|
- `skills_index.json`
|
|
- `CATALOG.md`
|
|
- `data/catalog.json`
|
|
- `data/bundles.json`
|
|
- curated user/maintainer docs updated by `sync_repo_metadata.py`
|
|
|
|
# Maintenance Walkthrough - 2026-03-21 Follow-up Import Sync
|
|
|
|
- Imported and normalized a new batch of external skills into `skills/`, covering Anthropic Claude API/internal comms entries, marketing workflows, SEO orchestration/sub-skills, and Obsidian-focused file-format/CLI skills.
|
|
- Added and standardized the following imported skill families:
|
|
- `claude-api`, `internal-comms`
|
|
- `ad-creative`, `ai-seo`, `churn-prevention`, `cold-email`, `content-strategy`, `lead-magnets`, `product-marketing-context`, `revops`, `sales-enablement`, `site-architecture`
|
|
- `seo`, `seo-competitor-pages`, `seo-content`, `seo-dataforseo`, `seo-geo`, `seo-hreflang`, `seo-image-gen`, `seo-images`, `seo-page`, `seo-plan`, `seo-programmatic`, `seo-schema`, `seo-sitemap`, `seo-technical`
|
|
- `defuddle`, `json-canvas`, `obsidian-bases`, `obsidian-cli`, `obsidian-markdown`
|
|
- Preserved the existing `docx`, `pdf`, `pptx`, and `xlsx` aliases as the repository's symlinked `*-official` entries instead of duplicating those directories.
|
|
- Normalized imported frontmatter so the new skills align with repository validation expectations:
|
|
- shortened oversized descriptions
|
|
- added missing `risk`, `source`, and `date_added` fields where needed
|
|
- added `## When to Use` sections across the new imports
|
|
- removed or rewrote imported dangling links that referenced non-existent upstream paths in this repository
|
|
- Added maintainer provenance notes in `docs/maintainers/skills-import-2026-03-21.md` so the source repository for each imported skill group is documented for future maintenance.
|
|
- Regenerated maintainer-owned derived artifacts after the import:
|
|
- `README.md`
|
|
- `skills_index.json`
|
|
- `CATALOG.md`
|
|
- `data/catalog.json`
|
|
- `data/bundles.json`
|
|
- Verified the direct-`main` maintenance flow with:
|
|
- `npm run validate`
|
|
- `npm run index`
|
|
- `npm run catalog`
|
|
- `npm run chain`
|
|
|
|
# Maintenance Walkthrough - 2026-03-18
|
|
|
|
- Fixed issue `#344` by correcting `.claude-plugin/marketplace.json` so the marketplace plugin entry uses `source: "./"` instead of `"."`, matching Claude Code's relative-path schema requirement for marketplace entries.
|
|
- Added `tools/scripts/tests/claude_plugin_marketplace.test.js` and wired it into the local test suite so invalid marketplace `source` paths fail fast in CI/maintainer verification.
|
|
- Merged PRs `#333`, `#336`, `#338`, `#343`, `#340`, `#334`, and `#345` via GitHub squash merge after maintainer refresh of forked workflows and PR metadata.
|
|
- Closed PR `#337` and PR `#342` as superseded by `#338`, then closed issue `#339` manually after confirming the accepted fix path; issue `#335` auto-closed from the merged PR body.
|
|
- Closed issue `#344` with a follow-up comment after shipping the plugin marketplace fix on `main`, and left PR `#341` open with a blocking review comment because the submitted skill content is corrupted even though CI is green.
|
|
- Documented a new maintainer edge case in `.github/MAINTENANCE.md`: forked runs in `action_required`, `pr-policy` failures caused by stale PR bodies, the REST API fallback when `gh pr edit` fails with the Projects Classic GraphQL error, and the need to `close`/`reopen` a PR when a plain rerun does not pick up updated metadata.
|
|
- Refreshed the release-facing docs for `8.2.0` across `README.md`, `docs/users/getting-started.md`, `docs/users/walkthrough.md`, and `CHANGELOG.md`.
|
|
- Published release `v8.2.0` on `main` with:
|
|
- `npm run release:preflight`
|
|
- `npm run security:docs`
|
|
- `npm run release:prepare -- 8.2.0`
|
|
- `npm run release:publish -- 8.2.0`
|
|
|
|
# Maintenance Walkthrough - 2026-03-17
|
|
|
|
- Synced `main` after the six merged community PRs and re-verified all forked PR workflows through GitHub before final release prep.
|
|
- Reopened/approved forked GitHub Actions runs where needed, normalized missing PR quality checklists, and merged PRs `#331`, `#330`, `#326`, `#324`, `#325`, and `#329` with GitHub squash merge.
|
|
- Patched `skills/vibers-code-review/SKILL.md` on the contributor branch for PR `#325` so the skill had valid YAML frontmatter, a `When to Use` section, and explicit limitations; reran CI and merged after green checks.
|
|
- Closed issue `#327` with a release comment pointing to `#331`, and closed issue `#328` as a duplicate of `#269` with links to the README recovery guidance and `docs/users/windows-truncation-recovery.md`.
|
|
- Updated release-facing docs before cutting `v8.1.0`:
|
|
- `README.md`
|
|
- `docs/users/getting-started.md`
|
|
- `CHANGELOG.md`
|
|
- `walkthrough.md`
|
|
- Refreshed the README contributor acknowledgements to include the latest merged contributors from the maintenance batch.
|
|
- Release workflow to run for `8.1.0`:
|
|
- `npm run release:preflight`
|
|
- `npm run security:docs`
|
|
- `npm run release:prepare -- 8.1.0`
|
|
- `npm run release:publish -- 8.1.0`
|
|
|
|
# Maintenance Walkthrough - 2026-03-12
|
|
|
|
- Merged PRs `#277`, `#272`, `#275`, `#278`, and `#271` via GitHub squash merge after bringing contributor branches into a mergeable state and refreshing PR bodies against the quality checklist in `.github/MAINTENANCE.md`.
|
|
- Verified PR `#271` locally with `npm run validate:references` and `npm run test` before merge; confirmed `#269` auto-closed from the merged PR body.
|
|
- Added a user-facing Windows truncation recovery guide at `docs/users/windows-truncation-recovery.md`, linked it from `README.md`, `docs/users/faq.md`, `docs/users/getting-started.md`, and `docs/integrations/jetski-cortex.md`, and credited the workflow to issue `#274`.
|
|
- Updated `skills/metasploit-framework/SKILL.md` to remove the remote installer flow, require an existing Metasploit installation, and add the required offensive-skill warning.
|
|
- Refreshed `README.md` to remove stale `7.2.0` / `7.4.0` onboarding copy, align the star badge with the current milestone, and fix the TOC link for `## Contributing`.
|
|
- Normalized the active English docs (`README.md`, user guides, Kiro guide, and evergreen maintainer docs) to the current `7.6.0` / `1,250+ skills` state and removed emoji from H2 headers where maintenance rules require clean anchors.
|
|
- Ran the required maintenance validations after the direct fixes:
|
|
- `npm run validate`
|
|
- `npm run validate:references`
|
|
- `npm run chain`
|
|
- `npm run catalog`
|
|
- Final release prep, issue closure comments, and verification were completed on `main`.
|
|
|
|
# Maintenance Walkthrough - 2026-03-13
|
|
|
|
- Fixed `tools/scripts/update_readme.py` so normal `npm run readme` runs preserve the existing `registry-sync` star/timestamp values instead of rewriting them on every execution, which was causing non-deterministic PR drift failures in CI.
|
|
- Updated `tools/scripts/sync_repo_metadata.py` to expose the same explicit `--refresh-volatile` behavior for live star/timestamp refreshes, keeping release/metadata refresh flows available without destabilizing contributor PR checks.
|
|
- Updated `.github/workflows/ci.yml` so generated registry drift is informational on pull requests but still strict on `main`, with auto-sync remaining the canonical path for shared artifacts after merge.
|
|
- Updated `.github/MAINTENANCE.md`, `docs/maintainers/ci-drift-fix.md`, and `docs/maintainers/merging-prs.md` to document the lower-friction merge flow: validate source changes on PRs, keep `main` for generated conflicts, and let `main` auto-sync the final artifact set.
|
|
- Verified the fix with:
|
|
- `python3 tools/scripts/update_readme.py --dry-run`
|
|
- `python3 tools/scripts/sync_repo_metadata.py --dry-run`
|
|
- `npm run readme`
|
|
- `npm run validate:references`
|
|
- Added `tools/config/generated-files.json` as the single contract for derived registry artifacts so CI, maintainer scripts, and docs share the same file list.
|
|
- Added scripted workflow entrypoints: `npm run pr:preflight`, `npm run release:preflight`, `npm run release:prepare -- X.Y.Z`, and `npm run release:publish -- X.Y.Z`.
|
|
- Split PR CI into `pr-policy`, `source-validation`, and `artifact-preview` so PRs stay source-only, policy failures are explicit, and generated drift is previewed separately from source validation.
|
|
- Updated `CONTRIBUTING.md` and `.github/PULL_REQUEST_TEMPLATE.md` so contributors are told not to commit derived files and to enable `Allow edits from maintainers`.
|
|
|
|
# Maintenance Walkthrough - 2026-03-14
|
|
|
|
- Added root Claude Code plugin marketplace support via `.claude-plugin/plugin.json` and `.claude-plugin/marketplace.json`, exposing the repository as a single plugin entry that points at the existing `skills/` tree.
|
|
- Updated the user onboarding trinity (`README.md`, `docs/users/getting-started.md`, `docs/users/faq.md`) so Claude Code users can install via `/plugin marketplace add sickn33/antigravity-awesome-skills` in addition to the existing `npx` installer flow.
|
|
- Merged PRs `#302`, `#301`, `#299`, `#297`, `#296`, `#287`, `#298`, and `#293` via GitHub squash merge after maintainer preflight, including a maintained follow-up commit on the contributor branch for `#298` and a maintainer conflict-resolution refresh on `#293`.
|
|
- Verified the issue-driven fixes locally before merge:
|
|
- `#301`: `python3 -m py_compile skills/notebooklm/scripts/browser_utils.py`
|
|
- `#299`: `node -c tools/bin/install.js`
|
|
- Verified the skill/docs PRs locally before merge:
|
|
- `#297`, `#296`, `#287`, `#298`: `npm run validate`
|
|
- `#293`, `#298`: `npm run validate:references`
|
|
- Closed issues `#288`, `#300`, `#286`, and `#281` from the merged fixes and release notes flow; documented `#294` as a release follow-up because the support already exists in the current catalog.
|
|
- Removed stale Windows `core.symlinks=true` / Developer Mode guidance from the user docs after the `#299` installer fix, keeping the Windows path on the standard clone/install flow.
|
|
- Ran the post-merge maintainer sync on `main`:
|
|
- `npm run chain`
|
|
- `npm run catalog`
|
|
- Refreshed `CHANGELOG.md`, `README.md`, `docs/users/getting-started.md`, `docs/users/faq.md`, and the contributor acknowledgements to prepare the single `7.8.0` release cut.
|
|
|
|
# Maintenance Walkthrough - 2026-03-21 Initial Import Batch
|
|
|
|
- Imported the missing external skill coverage identified from `travisvn/awesome-claude-skills`, `anthropics/skills`, `coreyhaines31/marketingskills`, `AgriciDaniel/claude-seo`, and `kepano/obsidian-skills`, bringing the indexed registry to `1,304` skills on `main`.
|
|
- Added maintainer attribution notes in `docs/maintainers/skills-import-2026-03-21.md` and refreshed the generated registry artifacts after the import batch.
|
|
- Re-aligned the public documentation surface to the current repository state:
|
|
- `README.md`
|
|
- `package.json`
|
|
- `docs/users/getting-started.md`
|
|
- `docs/users/usage.md`
|
|
- `docs/users/claude-code-skills.md`
|
|
- `docs/users/gemini-cli-skills.md`
|
|
- `docs/users/visual-guide.md`
|
|
- `docs/users/bundles.md`
|
|
- `docs/users/kiro-integration.md`
|
|
- `docs/integrations/jetski-cortex.md`
|
|
- `docs/maintainers/repo-growth-seo.md`
|
|
- `docs/maintainers/skills-update-guide.md`
|
|
- Updated the changelog `Unreleased` section so the post-`v8.4.0` main branch state documents both the imported skill families and the docs/About realignment.
|
|
- Automated the recurring docs metadata maintenance by extending `tools/scripts/sync_repo_metadata.py`, wiring it into `npm run chain`, and adding a regression test so future skill-count/version updates propagate through the curated docs surface without manual patching.
|
|
- Added a remote GitHub About sync path (`npm run sync:github-about`) backed by `gh repo edit` + `gh api .../topics` so the public repository metadata can be refreshed from the same source of truth on demand.
|
|
- Added maintainer automation for repo-state hygiene: `sync:contributors` updates the README contributor list from GitHub contributors, `check:stale-claims`/`audit:consistency` catch drift in count-sensitive docs, and `sync:repo-state` now chains the local maintainer sweep into a single command.
|
|
- Hardened automation surfaces beyond the local CLI: `main` CI now runs the unified repo-state sync, tracked web artifacts are refreshed through `sync:web-assets`, release verification now uses a deterministic `sync:release-state` path plus `npm pack --dry-run`, the npm publish workflow reruns those checks before publishing, and a weekly `Repo Hygiene` GitHub Actions workflow now sweeps slow drift on `main`.
|
|
- Added two maintainer niceties on top of the hardening work: `check:warning-budget` freezes the accepted `135` validation warnings so they cannot silently grow, and `audit:maintainer` prints a read-only health snapshot of warning budget, consistency drift, and git cleanliness.
|
|
|
|
# Maintenance Walkthrough - 2026-07-16 Android Overheating Diagnostics
|
|
|
|
- Audited the cached third-party `adb-performance` skill and rejected a direct import because its linked source repository is unavailable, its license cannot be verified, and it mixes weak snapshot heuristics with unguarded device mutations.
|
|
- Added the clean-room canonical `diagnose-android-overheating` skill, grounded in current Android and AOSP documentation.
|
|
- Replaced generic “optimization” commands with a read-only-first evidence workflow, controlled comparisons, OEM-aware interpretation, confidence labels, privacy handling, explicit approval gates, rollback requirements, and a hardware-safety stop.
|
|
- Added `references/evidence-and-interpretation.md` for symptom-specific ADB evidence, thermal status interpretation, correlation rules, Batterystats capture discipline, and bugreport privacy.
|
|
|
|
# Maintenance Walkthrough - 2026-07-16 Tessl Workspace Repair
|
|
|
|
- Corrected the Skill Review workflow and trusted review helper to use the token-visible `antigravity-awesome-skills` Tessl workspace instead of the renamed repository slug.
|
|
- Added a repository-variable override so future Tessl workspace migrations can be handled through `TESSL_WORKSPACE` without another workflow patch.
|
|
- Updated the review command regression test to lock the corrected workspace argument.
|
|
|
|
# Maintenance Walkthrough - 2026-07-16 Tessl Credit Guard
|
|
|
|
- Added a deterministic fingerprint over the changed `SKILL.md` content and active review policy.
|
|
- Reuse a previously successful review for identical content, avoiding Tessl setup and another charged review after unrelated PR pushes or base refreshes.
|
|
- Route an explicit Tessl credit/quota failure to `manual-review-required` with exact-head attestation; unrelated Tessl failures still fail closed.
|
|
- Added regression coverage for fingerprint invalidation, GitHub Actions cache wiring, quota classification, and truthful review outcomes.
|
|
# Maintenance Walkthrough - 2026-07-17 Legacy Redirect Infrastructure
|
|
|
|
- Preserved the Google Search Console HTML verification file on the legacy Pages path and the Bing Webmaster Tools meta token on the legacy root redirect.
|
|
- Made redirect generation follow the current `skills_index.json` count while retaining the curated sitemap-count lock and exact route-set validation.
|
|
- Added `pages:redirect-verify` for byte-exact managed-tree validation plus bounded or full live route probing.
|
|
- Versioned the redirect manifest contract as schema `3`, including webmaster-verification evidence consumed by the protected sync.
|
|
- Added explicit source-repository provenance to the live manifest and used that change to exercise the complete protected auto-sync cycle.
|
|
- Documented the protected cross-repository synchronization contract for `sickn33/sickn33.github.io`.
|
|
- Added regression coverage for webmaster tokens, reserved-path collisions, dynamic skill counts, local drift, stale files, and live manifest/route verification.
|
|
|
|
# Maintenance Walkthrough - 2026-07-22 Security Findings and Windows Preview
|
|
|
|
- Remediated the live dependency advisories for `fast-uri`, `brace-expansion`, and `body-parser` in their affected lockfiles.
|
|
- Hardened AAS Core cache ancestry, transaction durability, bounded MCP manifest state, exact-search behavior, redirect-tree reads, release-PR selection, and maintainer merge authorization.
|
|
- Expanded skill-review fingerprints and workflow triggers to cover bundled support files, and tightened unsafe guidance in the affected canonical skills.
|
|
- Fixed native Windows ACL inspection for AAS preview by making PowerShell path handling explicit and returning bounded phase/path diagnostics for unresolved ACL identities.
|
|
- Added regression coverage for every confirmed code-path finding and documented the Windows 10/11 Codex CLI preview contract from discussion `#956`.
|