Repository navigation
feat: vendor skills from full-stack-skills/stitch-skills - #1
Merged
Merged
Conversation
Skill bodies' single source of truth is now the stitch-skills package (v1.1.0); this repository carries the vendored snapshot pinned by skills.lock.json plus the vendor tooling and sync guardrails: - add skills.lock.json (43 skills pinned to the v1.1.0 commit) and scripts/vendor/skill_vendor.py (update/check) with self-tests - CI: skills-check verifies digests offline and upstream pins online and rejects skill edits that bypass the source package; skills-sync refreshes the snapshot via repository_dispatch, daily schedule, or manual trigger (opens PRs with gh CLI to keep the workflow action inventory closed) - skills/ content now includes the package-side license normalization (Apache-2.0 frontmatter line, attribution blocks, LICENSE full text) - READMEs document the vendor mechanism and replace the stale snapshot-provenance sentence
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
目的
技能本体单一事实源上移到 full-stack-skills/stitch-skills（先合那边的 PR #2，tag
v1.1.0已打在 f50f92b）。本仓 main 保持含技能的完整可安装态，通过锁文件 vendor。变更
skills.lock.json：43 个技能钉在 v1.1.0 的 commit f50f92b，逐技能 SHA-256scripts/vendor/skill_vendor.py（update/check）+ 6 个自测（含篡改/上游移动/缺技能变异检验）skills-check（离线摘要 + 在线 ref/内容校验 + 禁直改守卫）；skills-sync（dispatch/每日/手动 → gh CLI 开同步 PR，不引入第三方 action，保持钉版清单封闭）skills/内容变化：源仓许可证规范化下发（43 个技能补license: Apache-2.0frontmatter 行、2 个上游归属声明块、2 份 LICENSE 全文）——无技能名变更，无行为变化门禁
272 tests OK（含 6 个 vendor 自测）、validate_distribution（43 skills / 0.7.8）OK、validate_skills OK、scan_secrets OK、vendor check 在线对 GitHub 远端 OK。
合并顺序
skill_vendor.py update）SKILLS_SYNC_TOKEN（跨 org PAT）