From f838eaf5a18bdcc49fe7800733cfdbd93eb713f6 Mon Sep 17 00:00:00 2001 From: sea-snake Date: Fri, 6 Nov 2026 12:58:34 +0100 Subject: [PATCH 1/2] fix(ci): validate every changed skill, and trim the II description `skill-validator check` accepts exactly one path and exits 3 on more, so the PR job validated nothing whenever a PR touched two or more skills: the report came back empty and the gate, which only failed on exit code 1, went green. Each path now gets its own invocation, and the gate fails on any code other than 0 (clean) or 2 (warnings). That hole is how internet-identity's 1029-character description reached main, where skills/ is checked as a single path and the 1024-character limit failed the run, so the site was never deployed. Two words out of the description brings it to 1014. Co-Authored-By: Claude Opus 5 --- .github/workflows/_checks.yml | 31 +++++++++++++++++++++++++------ skills/internet-identity/SKILL.md | 2 +- 2 files changed, 26 insertions(+), 7 deletions(-) diff --git a/.github/workflows/_checks.yml b/.github/workflows/_checks.yml index a3100cf8..0ba7f682 100644 --- a/.github/workflows/_checks.yml +++ b/.github/workflows/_checks.yml @@ -65,14 +65,30 @@ jobs: - name: Build site run: npm run build + # `skill-validator check` takes exactly one path and exits 3 (usage error) + # when handed more, so every path is checked in its own invocation. Exit + # codes: 0 clean, 1 errors, 2 warnings, 3 usage error. An error anywhere + # wins over a warning; anything other than 0 or 2 fails the job below. - name: Run skill-validator checks id: skill-validator if: steps.changed.outputs.found == 'true' run: | set +e - # TODO: re-enable link checks once https://github.com/agent-ecosystem/skill-validator/issues/45 is resolved - report=$(skill-validator check ${{ steps.changed.outputs.paths }} --skip links -o markdown 2>/dev/null) - exit_code=$? + report="" + exit_code=0 + for path in ${{ steps.changed.outputs.paths }}; do + # TODO: re-enable link checks once https://github.com/agent-ecosystem/skill-validator/issues/45 is resolved + out=$(skill-validator check "$path" --skip links -o markdown 2>/dev/null) + code=$? + report="${report}${out}"$'\n' + case "$code" in + 0) ;; + 1) exit_code=1 ;; + *) [ "$exit_code" -eq 0 ] && exit_code=$code ;; + esac + # Re-run with annotations sent to stdout/stderr for GitHub to process + skill-validator check "$path" --skip links --emit-annotations > /dev/null + done echo "$report" >> "$GITHUB_STEP_SUMMARY" delimiter=$(openssl rand -hex 8) { @@ -81,8 +97,6 @@ jobs: echo "${delimiter}" } >> "$GITHUB_OUTPUT" echo "exit_code=$exit_code" >> "$GITHUB_OUTPUT" - # Re-run with annotations sent to stdout/stderr for GitHub to process - skill-validator check ${{ steps.changed.outputs.paths }} --skip links --emit-annotations > /dev/null exit 0 - name: Run project-specific checks @@ -132,8 +146,13 @@ jobs: No skill files were changed in this PR — validation skipped. + # Warnings (skill-validator exit 2) are acceptable; everything non-zero + # beyond that fails, so a usage error can never read as a pass. - name: Fail on validation errors - if: steps.changed.outputs.found == 'true' && (steps.skill-validator.outputs.exit_code == '1' || steps.check-project.outputs.exit_code == '1') + if: | + steps.changed.outputs.found == 'true' + && ((steps.skill-validator.outputs.exit_code != '0' && steps.skill-validator.outputs.exit_code != '2') + || steps.check-project.outputs.exit_code != '0') run: | echo "::error::Validation found errors" exit 1 diff --git a/skills/internet-identity/SKILL.md b/skills/internet-identity/SKILL.md index 1f7a3713..9a469a64 100644 --- a/skills/internet-identity/SKILL.md +++ b/skills/internet-identity/SKILL.md @@ -1,6 +1,6 @@ --- name: internet-identity -description: "Add Internet Identity sign-in to a frontend or canister: passkey and OpenID (Google, Apple, Microsoft) sign-in with @icp-sdk/auth, sending users to an organization's SSO with ssoDomain, the client lifecycle, and local development. It also covers the primary origin an app's principals are permanently tied to: electing it, setting derivationOrigin, the ii-alternative-origins and ii-derivation-origin documents, and the ii-app-metadata document that names the app on the sign-in screen. Use when adding sign-in, login, auth, passkeys or Internet Identity to an app, when an app gains a custom domain or a sibling app, or when the same user arrives as a different principal on two origins. For a verified email or name in the backend use internet-identity-attributes; for web push use internet-identity-notifications; to set up an organization's own SSO use internet-identity-sso. Do NOT use for wallet integration or ICRC signer flows (use wallet-integration) or for an agent or CLI signing in as a user (use agent-web-identity)." +description: "Add Internet Identity sign-in to a frontend or canister: passkey and OpenID (Google, Apple, Microsoft) sign-in with @icp-sdk/auth, sending users to an organization's SSO with ssoDomain, the client lifecycle, and local development. Also covers the primary origin an app's principals are permanently tied to: electing it, setting derivationOrigin, the ii-alternative-origins and ii-derivation-origin documents, and the ii-app-metadata document that names the app on the sign-in screen. Use when adding sign-in, login, auth, passkeys or Internet Identity to an app, when an app gains a custom domain or a sibling app, or when the same user arrives as a different principal on two origins. For a verified email or name in the backend use internet-identity-attributes; for web push use internet-identity-notifications; to set up an organization's own SSO use internet-identity-sso. Do NOT use for wallet or ICRC signer flows (use wallet-integration) or for an agent or CLI signing in as a user (use agent-web-identity)." license: Apache-2.0 compatibility: "icp-cli >= 0.2.4, Node.js >= 22" metadata: From 5aab1b86e7d7b3a700ada5b1e8db3e5976dfe5ee Mon Sep 17 00:00:00 2001 From: sea-snake Date: Fri, 6 Nov 2026 13:02:50 +0100 Subject: [PATCH 2/2] fix(ci): never let a warning outrank an unvalidated skill The aggregation only raised the exit code from 0, so a warning on one skill pinned it at 2 and a later usage error could not lift it: codes 2 then 3 aggregated to 2 and the gate passed with a skill unvalidated, which is the failure this change set out to close. Errors, other non-zero codes and warnings are now tracked separately and resolved in that order. Co-Authored-By: Claude Opus 5 --- .github/workflows/_checks.yml | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/.github/workflows/_checks.yml b/.github/workflows/_checks.yml index 0ba7f682..18cb1f96 100644 --- a/.github/workflows/_checks.yml +++ b/.github/workflows/_checks.yml @@ -67,15 +67,19 @@ jobs: # `skill-validator check` takes exactly one path and exits 3 (usage error) # when handed more, so every path is checked in its own invocation. Exit - # codes: 0 clean, 1 errors, 2 warnings, 3 usage error. An error anywhere - # wins over a warning; anything other than 0 or 2 fails the job below. + # codes: 0 clean, 1 errors, 2 warnings, 3 usage error. The aggregate takes + # an error over any other code and any other code over a warning, so a + # warning on one skill can never hide a skill that was not validated. + # Anything other than 0 or 2 fails the job below. - name: Run skill-validator checks id: skill-validator if: steps.changed.outputs.found == 'true' run: | set +e report="" - exit_code=0 + had_error=0 + had_warning=0 + had_other=0 for path in ${{ steps.changed.outputs.paths }}; do # TODO: re-enable link checks once https://github.com/agent-ecosystem/skill-validator/issues/45 is resolved out=$(skill-validator check "$path" --skip links -o markdown 2>/dev/null) @@ -83,12 +87,22 @@ jobs: report="${report}${out}"$'\n' case "$code" in 0) ;; - 1) exit_code=1 ;; - *) [ "$exit_code" -eq 0 ] && exit_code=$code ;; + 1) had_error=1 ;; + 2) had_warning=1 ;; + *) had_other=$code ;; esac # Re-run with annotations sent to stdout/stderr for GitHub to process skill-validator check "$path" --skip links --emit-annotations > /dev/null done + if [ "$had_error" -ne 0 ]; then + exit_code=1 + elif [ "$had_other" -ne 0 ]; then + exit_code=$had_other + elif [ "$had_warning" -ne 0 ]; then + exit_code=2 + else + exit_code=0 + fi echo "$report" >> "$GITHUB_STEP_SUMMARY" delimiter=$(openssl rand -hex 8) {