@1aboveio/skills 0.0.0-stage → 1.0.0

package/skills/cicd/cloud-deploy/references/config-templates.md

@@ -0,0 +1,257 @@
+# Cloud Deploy Configuration Templates
+
+Load this file when setting up Cloud Deploy pipelines, Skaffold configs, or
+cloudbuild.yaml for a new service. Copy and adapt the templates below.
+
+## clouddeploy.yaml (Two Pipelines)
+
+```yaml
+# =============================================================================
+# DEV PIPELINE (triggered by dev branch)
+# =============================================================================
+apiVersion: deploy.cloud.google.com/v1
+kind: DeliveryPipeline
+metadata:
+  name: {service}-pipeline-dev
+description: {Service} dev pipeline (dev branch → dev env)
+serialPipeline:
+  stages:
+    - targetId: {service}-dev
+      profiles: ["dev"]
+      strategy:
+        standard:
+          predeploy:
+            actions: ["run-migrations"]
+          postdeploy:
+            actions: ["run-seed"]
+          verify: true
+---
+# =============================================================================
+# RELEASE PIPELINE (triggered by master branch)
+# =============================================================================
+apiVersion: deploy.cloud.google.com/v1
+kind: DeliveryPipeline
+metadata:
+  name: {service}-pipeline-release
+description: {Service} release pipeline (master branch → staging → prod)
+serialPipeline:
+  stages:
+    - targetId: {service}-staging
+      profiles: ["staging"]
+      strategy:
+        standard:
+          predeploy:
+            actions: ["run-migrations"]
+          postdeploy:
+            actions: ["run-seed"]
+          verify: true
+    - targetId: {service}-prod
+      profiles: ["prod"]
+      strategy:
+        standard:
+          predeploy:
+            actions: ["run-migrations"]
+          postdeploy:
+            actions: ["run-seed"]
+---
+# =============================================================================
+# TARGETS
+# =============================================================================
+apiVersion: deploy.cloud.google.com/v1
+kind: Target
+metadata:
+  name: {service}-dev
+description: Development environment
+requireApproval: false
+run:
+  location: projects/$PROJECT_ID/locations/$LOCATION
+deployParameters:
+  ENV: "dev"
+---
+apiVersion: deploy.cloud.google.com/v1
+kind: Target
+metadata:
+  name: {service}-staging
+description: Staging environment
+requireApproval: false
+run:
+  location: projects/$PROJECT_ID/locations/$LOCATION
+deployParameters:
+  ENV: "staging"
+---
+apiVersion: deploy.cloud.google.com/v1
+kind: Target
+metadata:
+  name: {service}-prod
+description: Production environment
+requireApproval: false  # Set to true if manual approval needed before prod deploy
+run:
+  location: projects/$PROJECT_ID/locations/$LOCATION
+deployParameters:
+  ENV: "prod"
+```
+
+## cloudbuild.yaml (Single File with Branch Detection)
+
+```yaml
+# GitFlow branching:
+#   - dev branch → {service}-pipeline-dev → dev environment
+#   - master branch → {service}-pipeline-release → staging → prod
+
+substitutions:
+  _FF_API_KEY_SECRET: "ff-api-key"
+  _DATABASE_URL_SECRET_DEV: "database-url-{service}-dev"
+  _DATABASE_URL_SECRET_STAGING: "database-url-{service}-staging"
+  _DATABASE_URL_SECRET_PROD: "database-url-{service}-prod"
+  _VPC_NETWORK_DEV: "default"
+  _VPC_SUBNET_DEV: "default"
+  _VPC_NETWORK_PROD: "prod"
+  _VPC_SUBNET_PROD: "prod"
+
+steps:
+  - id: "test-{service}"
+    # ... unit tests ...
+
+  - id: "build-{service}"
+    # ... docker build ...
+
+  - id: "push-{service}"
+    # ... docker push ...
+
+  # Create jobs based on branch
+  - id: "create-jobs"
+    name: "gcr.io/google.com/cloudsdktool/cloud-sdk"
+    waitFor: ["push-{service}"]
+    entrypoint: "bash"
+    args:
+      - "-c"
+      - |
+        set -e
+        if [ "$BRANCH_NAME" = "dev" ]; then
+          gcloud run jobs deploy {service}-job-dev --image=... --set-env-vars=ENV=dev
+        else
+          gcloud run jobs deploy {service}-job-staging --image=... --set-env-vars=ENV=staging
+          gcloud run jobs deploy {service}-job-prod --image=... --set-env-vars=ENV=prod
+        fi
+
+  - id: "apply-clouddeploy"
+    # ... apply clouddeploy.yaml ...
+
+  # Create release based on branch
+  - id: "create-release"
+    name: "gcr.io/google.com/cloudsdktool/cloud-sdk"
+    waitFor: ["apply-clouddeploy"]
+    entrypoint: "bash"
+    args:
+      - "-c"
+      - |
+        set -e
+
+        # Add timestamp for unique release names on rebuild
+        TIMESTAMP=$$(date +%H%M%S)
+        # Get commit message for release description
+        COMMIT_MSG=$$(git log -1 --pretty=%s | head -c 100)
+
+        if [ "$BRANCH_NAME" = "dev" ]; then
+          PIPELINE="{service}-pipeline-dev"
+          RELEASE_NAME="{service}-dev-${SHORT_SHA}-$$TIMESTAMP"
+        else
+          PIPELINE="{service}-pipeline-release"
+          RELEASE_NAME="{service}-release-${SHORT_SHA}-$$TIMESTAMP"
+        fi
+
+        gcloud deploy releases create "$$RELEASE_NAME" \
+          --delivery-pipeline="$$PIPELINE" \
+          --region=${LOCATION} \
+          --description="$$COMMIT_MSG (branch: $BRANCH_NAME)" \
+          --skaffold-file=skaffold.yaml \
+          --images={service}=${LOCATION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/{service}:${SHORT_SHA}
+```
+
+## skaffold.yaml
+
+```yaml
+apiVersion: skaffold/v4beta11
+kind: Config
+metadata:
+  name: {service}
+build:
+  artifacts:
+    - image: {service}
+      context: .
+      docker:
+        dockerfile: Dockerfile
+deploy:
+  cloudrun:
+    projectid: "{{.PROJECT_ID}}"
+    region: "{{.LOCATION}}"
+customActions:
+  - name: run-migrations
+    containers:
+      - name: migrate
+        image: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
+        command: ["/bin/sh", "-c"]
+        args: ["gcloud run jobs execute {service}-job-$ENV --args=migrate --region=$CLOUD_DEPLOY_LOCATION --wait"]
+  - name: run-seed
+    containers:
+      - name: seed
+        image: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
+        command: ["/bin/sh", "-c"]
+        args: ["gcloud run jobs execute {service}-job-$ENV --args=seed --region=$CLOUD_DEPLOY_LOCATION --wait"]
+profiles:
+  - name: dev
+    manifests:
+      kustomize:
+        paths:
+          - deploy/overlays/dev
+    verify:
+      - name: tests
+        container:
+          name: tests
+          image: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
+          command: ["/bin/sh", "-c"]
+          args: ["gcloud run jobs execute {service}-job-$ENV --args=test --region=$CLOUD_DEPLOY_LOCATION --wait"]
+  - name: staging
+    manifests:
+      kustomize:
+        paths:
+          - deploy/overlays/staging
+    verify:
+      - name: tests
+        container:
+          name: tests
+          image: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
+          command: ["/bin/sh", "-c"]
+          args: ["gcloud run jobs execute {service}-job-$ENV --args=test --region=$CLOUD_DEPLOY_LOCATION --wait"]
+  - name: prod
+    manifests:
+      kustomize:
+        paths:
+          - deploy/overlays/prod
+```
+
+## Cloud Build Triggers Setup
+
+```bash
+# Dev trigger (dev branch → dev env)
+gcloud builds triggers create github \
+  --name="{service}-dev" \
+  --repo-name="REPO_NAME" \
+  --repo-owner="OWNER" \
+  --branch-pattern="^dev$" \
+  --build-config="backend/{service}/cloudbuild.yaml" \
+  --region=$LOCATION
+
+# Release trigger (master branch → staging → prod)
+gcloud builds triggers create github \
+  --name="{service}-release" \
+  --repo-name="REPO_NAME" \
+  --repo-owner="OWNER" \
+  --branch-pattern="^master$" \
+  --build-config="backend/{service}/cloudbuild.yaml" \
+  --region=$LOCATION
+```
+
+Note: Both triggers use the same `cloudbuild.yaml` file. The `$BRANCH_NAME`
+variable is automatically set by Cloud Build to detect which branch triggered
+the build.

package/skills/cicd/cloud-deploy/release-check.mjs

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+const WEEK_MS = 7 * DAY_MS;
+const here = dirname(fileURLToPath(import.meta.url));
+
+function readJson(path, fallback = {}) {
+  try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return fallback; }
+}
+
+function frontmatterValue(text, key) {
+  const frontmatter = /^---\n([\s\S]*?)\n---/.exec(text)?.[1] ?? '';
+  const match = new RegExp('^' + key + ':\\s*([^\\n]+)$', 'm').exec(frontmatter);
+  return match?.[1].trim().replace(/^['"]|['"]$/g, '') ?? null;
+}
+
+function repositoryOf(source) {
+  const value = String(source ?? '').trim();
+  const match = /^(?:git@github\.com:|https:\/\/github\.com\/)?([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?$/.exec(value);
+  return match?.[1] ?? null;
+}
+
+function stableVersion(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(String(value ?? '').trim());
+  return match ? match.slice(1).map(Number) : null;
+}
+
+function newer(left, right) {
+  for (let index = 0; index < 3; index += 1) {
+    if (left[index] !== right[index]) return left[index] > right[index];
+  }
+  return false;
+}
+
+function writeCache(path, value) {
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(value));
+  } catch { /* A read-only cache must not block skill use. */ }
+}
+
+function main(now = Date.now()) {
+  if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
+  const name = frontmatterValue(skill, 'name');
+  const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));
+  if (!name || !localVersion) return;
+
+  const lock = readJson(join(process.env.HOME || homedir(), '.agents', '.skill-lock.json'));
+  const entry = lock.skills?.[name];
+  const repository = repositoryOf(entry?.sourceUrl || entry?.source);
+  if (!repository) return;
+
+  const cacheRoot = process.env.XDG_CACHE_HOME || join(process.env.HOME || homedir(), '.cache');
+  const cachePath = join(cacheRoot, '1aboveio-skills', 'release-check.json');
+  const all = readJson(cachePath);
+  const cache = all[repository] && typeof all[repository] === 'object' ? all[repository] : {};
+
+  if (!cache.lastCheck || now - cache.lastCheck >= DAY_MS) {
+    const result = spawnSync('gh', ['api', 'repos/' + repository + '/releases/latest', '--jq', '.tag_name'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 1500,
+    });
+    cache.lastCheck = now;
+    if (result.status === 0 && stableVersion(result.stdout)) cache.latestTag = result.stdout.trim();
+    else delete cache.latestTag;
+    all[repository] = cache;
+    writeCache(cachePath, all);
+  }
+
+  const latestVersion = stableVersion(cache.latestTag);
+  if (!latestVersion || !newer(latestVersion, localVersion)) return;
+  if (cache.notifiedTag === cache.latestTag && cache.notifiedAt && now - cache.notifiedAt < WEEK_MS) return;
+
+  cache.notifiedTag = cache.latestTag;
+  cache.notifiedAt = now;
+  all[repository] = cache;
+  writeCache(cachePath, all);
+  const command = `npx skills@1.5.23 add '${repository}#${cache.latestTag}' --global --agent universal claude-code --skill ${name} --yes`;
+  process.stdout.write(
+    `UPDATE_AVAILABLE: A newer 1AboveIO skills release (${cache.latestTag}) is available; this skill is `
+      + `v${localVersion.join('.')}. Ask once whether to refresh ${name}. On approval run \`${command}\`. `
+      + 'The refreshed instructions apply next session. Either way, continue the current task and do not ask again this session.\n',
+  );
+}
+
+try { main(); } catch { /* Update checks are advisory and always fail silent. */ }

package/skills/cicd/docker/LICENSE

@@ -0,0 +1,3 @@
+MIT License
+
+Copyright (c) 2026 1AboveIO

package/skills/cicd/docker/SKILL.md

@@ -0,0 +1,151 @@
+---
+name: docker
+description: Docker/Podman container architecture and build patterns. Read when designing or reviewing containerization, Dockerfile structure, multi-stage builds, PyPI mirror support, or docker-compose setup for Python/uv projects, and when a Dockerfile's dependency install misses the layer cache on every build (build args such as a commit SHA or version declared too early) or an image build is slow in CI.
+release-version: 0.36.0
+---
+**Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
+# Docker Build Patterns
+
+## Overview
+
+This skill covers Docker build patterns for Python projects using uv, with support for:
+- Multi-stage builds for smaller images
+- PyPI mirror configuration (for China/corporate mirrors)
+- Podman as drop-in replacement for Docker
+- docker-compose integration
+- Keeping dependency layers cached across builds (any language)
+
+## Makefile Pattern
+
+Auto-detect podman or docker, load env vars, and pass build args:
+
+```makefile
+.PHONY: build rebuild
+
+# Auto-detect compose tool (prefer podman-compose, fallback to docker compose)
+COMPOSE_CMD := $(shell command -v podman-compose >/dev/null 2>&1 && echo "podman-compose" || echo "docker compose")
+# Export .env vars for build arg substitution (podman-compose doesn't auto-load .env)
+COMPOSE := set -a && . ./.env && set +a && $(COMPOSE_CMD)
+
+# Auto-detect container build tool (prefer podman, fallback to docker)
+BUILD_CMD := $(shell command -v podman >/dev/null 2>&1 && echo "podman" || echo "docker")
+
+# Load UV_DEFAULT_INDEX from .env for build args
+UV_DEFAULT_INDEX := $(shell grep -E '^UV_DEFAULT_INDEX=' .env 2>/dev/null | cut -d= -f2)
+
+build:  ## Build Docker image
+	$(BUILD_CMD) build --build-arg UV_DEFAULT_INDEX=$(UV_DEFAULT_INDEX) -t app-local:latest .
+
+rebuild:  ## Rebuild Docker image (no cache)
+	$(BUILD_CMD) build --no-cache --build-arg UV_DEFAULT_INDEX=$(UV_DEFAULT_INDEX) -t app-local:latest .
+```
+
+## Dockerfile Pattern (Multi-stage with uv)
+
+```dockerfile
+# Stage 1: Build dependencies
+FROM python:3.12-slim-bookworm AS builder
+
+# PyPI mirror (for China users): e.g., https://mirrors.aliyun.com/pypi/simple/
+ARG UV_DEFAULT_INDEX=
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /usr/local/bin/
+
+WORKDIR /opt/app
+COPY pyproject.toml uv.lock ./
+
+# Install third-party dependencies (creates .venv): the exact uv.lock pins,
+# hash-checked, downloaded through UV_DEFAULT_INDEX when set (PyPI otherwise).
+# `uv sync --frozen` would fetch from the lock's PyPI URLs and skip the mirror.
+RUN uv export --frozen --no-dev --no-emit-workspace --format requirements.txt \
+      -o /tmp/requirements.txt && \
+    uv venv /opt/app/.venv && \
+    VIRTUAL_ENV=/opt/app/.venv uv pip sync --require-hashes /tmp/requirements.txt
+
+# Stage 2: Runtime
+FROM python:3.12-slim-bookworm
+
+RUN useradd -m -d /opt/app -s /bin/bash app
+WORKDIR /opt/app
+
+# Copy virtual environment from builder
+COPY --from=builder --chown=app:app /opt/app/.venv /opt/app/.venv
+
+ENV PATH="/opt/app/.venv/bin:$PATH"
+USER app
+
+COPY --chown=app:app . .
+```
+
+## Build Args and the Layer Cache
+
+BuildKit adds every build arg declared so far in a stage to the cache key of each later
+`RUN` in that stage, even a `RUN` that never reads it. A per-build value (commit SHA,
+version, timestamp) declared above the dependency install busts that install on every
+build. Declare it in the narrowest stage, immediately before the step that uses it, after
+the installs:
+
+```dockerfile
+COPY package.json pnpm-lock.yaml ./
+RUN pnpm install --frozen-lockfile     # cacheable: no per-build ARG above it
+COPY . .
+ARG APP_BUILD_SHA                      # declared here, not at the top of the stage
+RUN pnpm build                         # RUN sees the arg as $APP_BUILD_SHA
+```
+
+A global `ARG` before the first `FROM` reaches a stage only where that stage re-declares
+it, so the re-declaration is the line that must sit after the installs. Verify by
+building twice with a different SHA: the install step must report `CACHED`. A mirror arg
+such as `UV_DEFAULT_INDEX` is stable per environment, so it may stay above the install.
+
+Exporting the image (`--load`, the docker exporter) also costs real time for a large
+image (~34 s observed). Drop it when nothing runs the image on the build host (push-only
+or cache-only builds). When the image must run locally, keep `--load` rather than
+switching to a builder that lacks your registry-mirror config.
+
+## docker-compose.yaml Pattern
+
+```yaml
+x-app-common: &app-common
+  image: ${APP_IMAGE:-app-local:latest}
+  build:
+    context: .
+    args:
+      UV_DEFAULT_INDEX: ${UV_DEFAULT_INDEX:-}
+  restart: unless-stopped
+  # ... rest of config
+```
+
+## .env Configuration
+
+```bash
+# PyPI Mirror (for users in China)
+# UV_DEFAULT_INDEX=https://mirrors.aliyun.com/pypi/simple/
+```
+
+## PyPI Mirror: Why Not `uv sync --frozen`
+
+`uv sync --frozen` downloads every package from the URL recorded in `uv.lock`
+(`files.pythonhosted.org`) and ignores `UV_DEFAULT_INDEX`, so the mirror is never used.
+Dropping `--frozen` is worse: `uv sync` against a different index can re-resolve and
+rewrite `uv.lock` inside the image, so the image no longer matches the lock.
+
+The template instead exports the lock's pins with their sha256 hashes and installs them
+with `uv pip sync --require-hashes`, which downloads through `UV_DEFAULT_INDEX` and
+rejects any file whose hash differs from `uv.lock`. `UV_DEFAULT_INDEX` replaces PyPI as
+the default index, so no `uv.toml` is needed. The same pattern for CI, with workspace
+members and a ready-made script: `python-backend`'s `references/uv-installs.md`.
+
+## Common Mirrors
+
+| Region | URL |
+|--------|-----|
+| China (Aliyun) | `https://mirrors.aliyun.com/pypi/simple/` |
+| China (Tsinghua) | `https://pypi.tuna.tsinghua.edu.cn/simple/` |
+| China (USTC) | `https://pypi.mirrors.ustc.edu.cn/simple/` |
+
+## Podman Notes
+
+- Podman is a drop-in replacement for Docker (same CLI)
+- `podman-compose` replaces `docker compose`
+- Podman doesn't auto-load `.env` files, hence the `set -a && . ./.env` pattern in Makefile
+- Rootless by default (better security)

package/skills/cicd/docker/release-check.mjs

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+const WEEK_MS = 7 * DAY_MS;
+const here = dirname(fileURLToPath(import.meta.url));
+
+function readJson(path, fallback = {}) {
+  try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return fallback; }
+}
+
+function frontmatterValue(text, key) {
+  const frontmatter = /^---\n([\s\S]*?)\n---/.exec(text)?.[1] ?? '';
+  const match = new RegExp('^' + key + ':\\s*([^\\n]+)$', 'm').exec(frontmatter);
+  return match?.[1].trim().replace(/^['"]|['"]$/g, '') ?? null;
+}
+
+function repositoryOf(source) {
+  const value = String(source ?? '').trim();
+  const match = /^(?:git@github\.com:|https:\/\/github\.com\/)?([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?$/.exec(value);
+  return match?.[1] ?? null;
+}
+
+function stableVersion(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(String(value ?? '').trim());
+  return match ? match.slice(1).map(Number) : null;
+}
+
+function newer(left, right) {
+  for (let index = 0; index < 3; index += 1) {
+    if (left[index] !== right[index]) return left[index] > right[index];
+  }
+  return false;
+}
+
+function writeCache(path, value) {
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(value));
+  } catch { /* A read-only cache must not block skill use. */ }
+}
+
+function main(now = Date.now()) {
+  if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
+  const name = frontmatterValue(skill, 'name');
+  const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));
+  if (!name || !localVersion) return;
+
+  const lock = readJson(join(process.env.HOME || homedir(), '.agents', '.skill-lock.json'));
+  const entry = lock.skills?.[name];
+  const repository = repositoryOf(entry?.sourceUrl || entry?.source);
+  if (!repository) return;
+
+  const cacheRoot = process.env.XDG_CACHE_HOME || join(process.env.HOME || homedir(), '.cache');
+  const cachePath = join(cacheRoot, '1aboveio-skills', 'release-check.json');
+  const all = readJson(cachePath);
+  const cache = all[repository] && typeof all[repository] === 'object' ? all[repository] : {};
+
+  if (!cache.lastCheck || now - cache.lastCheck >= DAY_MS) {
+    const result = spawnSync('gh', ['api', 'repos/' + repository + '/releases/latest', '--jq', '.tag_name'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 1500,
+    });
+    cache.lastCheck = now;
+    if (result.status === 0 && stableVersion(result.stdout)) cache.latestTag = result.stdout.trim();
+    else delete cache.latestTag;
+    all[repository] = cache;
+    writeCache(cachePath, all);
+  }
+
+  const latestVersion = stableVersion(cache.latestTag);
+  if (!latestVersion || !newer(latestVersion, localVersion)) return;
+  if (cache.notifiedTag === cache.latestTag && cache.notifiedAt && now - cache.notifiedAt < WEEK_MS) return;
+
+  cache.notifiedTag = cache.latestTag;
+  cache.notifiedAt = now;
+  all[repository] = cache;
+  writeCache(cachePath, all);
+  const command = `npx skills@1.5.23 add '${repository}#${cache.latestTag}' --global --agent universal claude-code --skill ${name} --yes`;
+  process.stdout.write(
+    `UPDATE_AVAILABLE: A newer 1AboveIO skills release (${cache.latestTag}) is available; this skill is `
+      + `v${localVersion.join('.')}. Ask once whether to refresh ${name}. On approval run \`${command}\`. `
+      + 'The refreshed instructions apply next session. Either way, continue the current task and do not ask again this session.\n',
+  );
+}
+
+try { main(); } catch { /* Update checks are advisory and always fail silent. */ }

package/skills/cicd/github-actions/LICENSE

@@ -0,0 +1,3 @@
+MIT License
+
+Copyright (c) 2026 1AboveIO