diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6b41738..3e9f942 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -3,8 +3,6 @@ name: Release SkillConform on: push: tags: ["v*"] - issues: - types: [opened] workflow_dispatch: inputs: version: @@ -22,9 +20,6 @@ concurrency: jobs: publish: - if: >- - github.event_name != 'issues' || - (github.actor == 'GenRamzi' && github.event.issue.title == 'release: skillconform 0.3.0') name: Publish version and create release runs-on: ubuntu-latest steps: @@ -66,12 +61,7 @@ jobs: NODE package_version="$(node -p "require('./package.json').version")" - if [[ "${GITHUB_EVENT_NAME:-}" == "issues" ]]; then - if [[ "${GITHUB_ACTOR:-}" != "GenRamzi" || "${package_version}" != "0.3.0" ]]; then - echo "Issue-triggered release is restricted to GenRamzi and package version 0.3.0" >&2 - exit 1 - fi - elif [[ "${GITHUB_REF_TYPE:-}" == "tag" ]]; then + if [[ "${GITHUB_REF_TYPE:-}" == "tag" ]]; then expected="v${package_version}" if [[ "$GITHUB_REF_NAME" != "$expected" ]]; then echo "Tag/version mismatch: tag=$GITHUB_REF_NAME package=$package_version" >&2 diff --git a/README.md b/README.md index 9caa8b4..360637b 100644 --- a/README.md +++ b/README.md @@ -18,7 +18,7 @@ Agent Skills are portable folders built around `SKILL.md`. The reference validat SkillConform scanning seven Agent Skills and returning a clean pass

-> Status: `v0.3.0` development line on `main`. The CLI, library API, and GitHub Action are ready for early adopters; published registry releases may lag `main`. Static compatibility and security results are evidence for review, not runtime certification. +> Status: `v0.3.0` is the latest public release on npm and GitHub. The CLI, library API, and GitHub Action are ready for early adopters. Static compatibility and security results are evidence for review, not runtime certification. ## Quick start @@ -151,7 +151,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: GenRamzi/skillconform@v0.1.1 + - uses: GenRamzi/skillconform@v0.3.0 with: path: skills mode: audit diff --git a/docs/codex-for-oss-application.md b/docs/codex-for-oss-application.md index 42ebb47..b8ec145 100644 --- a/docs/codex-for-oss-application.md +++ b/docs/codex-for-oss-application.md @@ -13,8 +13,8 @@ Why this repository instead of the maintainer's other projects: SkillConform has ## Current evidence - Apache-2.0 public repository. -- Public GitHub releases exist, including `v0.1.1`. -- `main` is the `0.3.0` development line. +- Public GitHub releases exist, including stable `v0.3.0` published on 2026-09-23. +- `skillconform@0.3.0` is published publicly on npm through GitHub OIDC trusted publishing with provenance. - CI covers Node 20, 22, and 24 plus a SARIF smoke test. - The project exposes a CLI, TypeScript API, GitHub Action, capability inventory, compatibility matrix, deterministic security rules, and regression policies. - Issue templates explicitly invite compatibility evidence and deterministic regression cases. @@ -24,7 +24,7 @@ Why this repository instead of the maintainer's other projects: SkillConform has ## Draft: why is this repository eligible? (<=500 characters) -SkillConform is an Apache-2.0 CLI, library and GitHub Action for deterministic conformance, security review, capability inventory and cross-agent compatibility checks for Agent Skills. It has public releases, active issue triage, CI across Node 20/22/24, SARIF output, and profiles for Claude, OpenAI and Gemini. I am the primary maintainer. Adoption is early; I am applying on ecosystem relevance and active maintenance, not inflated metrics. +SkillConform is an Apache-2.0 CLI, library and GitHub Action for deterministic conformance, security review, capability inventory and cross-agent compatibility checks for Agent Skills. v0.3.0 is published on npm with GitHub provenance, with CI on Node 20/22/24, SARIF output, and profiles for Claude, OpenAI and Gemini. I am the primary maintainer; adoption is early and I am not inflating usage metrics. ## Draft: how would API credits be used? (<=500 characters) diff --git a/docs/launch-kit.md b/docs/launch-kit.md index 769bbea..c7a9a81 100644 --- a/docs/launch-kit.md +++ b/docs/launch-kit.md @@ -65,11 +65,11 @@ The project is early, so reports from real repositories are more useful than sta ## LinkedIn draft -I have released **SkillConform v0.1.1**, an open-source quality and security tool for portable Agent Skills. +I have released **SkillConform v0.3.0**, an open-source quality, conformance, capability, compatibility, and security tool for portable Agent Skills. Agent Skills are easy to share, but a `SKILL.md` folder can also contain broken references, credentials, risky shell instructions, excessive permissions, and policy regressions. SkillConform adds deterministic checks, stable rule IDs, regression expectations, GitHub Actions integration, and SARIF output without requiring an API key or executing the inspected scripts. -The first release is available as an npm CLI and GitHub Action. I am inviting maintainers to test it against real skill repositories and report false positives, missing rules, and integration gaps. +The release is available as an npm CLI and GitHub Action. I am inviting maintainers to test it against real skill repositories and report false positives, missing rules, compatibility gaps, and integration needs. ## X / Bluesky thread diff --git a/docs/releasing.md b/docs/releasing.md index 370dd98..9455a4d 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -30,4 +30,4 @@ The workflow re-runs type checks, tests, self-tests, a warning-level audit of th ## Why the workflow changed -The September 23, 2026 `0.3.0` release attempts passed all repository validation and failed only at token-authenticated `npm publish`. Trusted publishing removes the long-lived token dependency and binds publishing to this repository and workflow. +The September 23, 2026 `0.3.0` release attempts initially passed all repository validation and failed only at token-authenticated `npm publish`. After the npm trusted publisher was configured, `v0.3.0` published successfully through GitHub OIDC with provenance and a matching GitHub Release. The permanent workflow now keeps only tag and explicit manual-dispatch release paths.