@hagicode/skillsbase 0.1.0-dev.11.1.4f10d19 → 0.1.0-dev.2.1.a322037

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 HagiCode
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -4,6 +4,7 @@
 
 [![npm version](https://img.shields.io/npm/v/%40hagicode%2Fskillsbase?logo=npm&color=cb3837)](https://www.npmjs.com/package/@hagicode/skillsbase)
 [![npm downloads](https://img.shields.io/npm/dm/%40hagicode%2Fskillsbase?logo=npm&color=2d8cf0)](https://www.npmjs.com/package/@hagicode/skillsbase)
+[![license](https://img.shields.io/badge/license-MIT-ffd43b)](./LICENSE)
 [![Node.js](https://img.shields.io/badge/node-%3E%3D22.12.0-339933?logo=node.js&logoColor=white)](https://nodejs.org/)
 
 `skillsbase` is a standalone Node.js CLI for bootstrapping and maintaining managed skills repositories.
@@ -122,4 +123,10 @@ The GitHub Actions workflow supports two npm authentication modes:
 - Fallback: `NPM_TOKEN` repository secret mapped to `NODE_AUTH_TOKEN`
 
 Before relying on trusted publishing, make sure the npm package settings for `@hagicode/skillsbase` trust the `HagiCode-org/skillsbase` repository.
+Use workflow filename `npm-publish.yml` in npm trusted publisher settings, not the full `.github/workflows/...` path.
+If the package has not been published before, that is still acceptable as long as the `hagicode` scope already exists and the publishing identity can create `@hagicode/skillsbase`.
 The npm docs currently require Node.js `>= 22.14.0` and npm `>= 11.5.1` for trusted publishing.
+
+## License
+
+MIT. See [LICENSE](./LICENSE).

package/README.zh-CN.md

@@ -122,4 +122,6 @@ GitHub Actions 发布流支持两种 npm 认证模式：
 - 兜底：仓库 `NPM_TOKEN` secret，经 `NODE_AUTH_TOKEN` 注入
 
 若使用 trusted publishing，需先在 npm 的 `@hagicode/skillsbase` 包设置中，将 `HagiCode-org/skillsbase` 配置为 trusted publisher。
+在 npm trusted publisher 设置里填写的 workflow filename 应为 `npm-publish.yml`，不要填完整的 `.github/workflows/...` 路径。
+如果这个包还没有首发，只要 npm 上已经存在 `hagicode` scope，且当前发布身份有权创建 `@hagicode/skillsbase`，也仍然可以正常发布。
 npm 官方当前要求 Node.js `>= 22.14.0` 且 npm `>= 11.5.1`。

package/dist/cli.mjs

@@ -822,10 +822,16 @@ async function writeGithubActions(repoPath, options = {}) {
 	if (kind === "workflow" || kind === "all") targets.push({
 		relativePath: path.join(".github", "workflows", "skills-sync.yml"),
 		template: path.join("workflows", "skills-sync.yml")
+	}, {
+		relativePath: path.join(".github", "workflows", "skills-manage.yml"),
+		template: path.join("workflows", "skills-manage.yml")
 	});
-	if (kind === "action" || kind === "all") targets.push({
+	if (kind === "workflow" || kind === "action" || kind === "all") targets.push({
 		relativePath: path.join(".github", "actions", "skillsbase-sync", "action.yml"),
 		template: path.join("actions", "skillsbase-sync", "action.yml")
+	}, {
+		relativePath: path.join(".github", "actions", "skillsbase-manage", "action.yml"),
+		template: path.join("actions", "skillsbase-manage", "action.yml")
 	});
 	if (targets.length === 0) throw new CliError(`Unsupported github_action kind: ${kind}`, { details: ["Supported values: workflow, action, all."] });
 	const items = [];

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@hagicode/skillsbase",
-  "version": "0.1.0-dev.11.1.4f10d19",
+  "version": "0.1.0-dev.2.1.a322037",
   "description": "Managed skills repository CLI",
+  "license": "MIT",
   "homepage": "https://github.com/HagiCode-org/skillsbase#readme",
   "bugs": {
     "url": "https://github.com/HagiCode-org/skillsbase/issues"

package/templates/actions/skillsbase-manage/action.yml

@@ -0,0 +1,96 @@
+# Managed by skillsbase CLI.
+
+name: skillsbase-manage
+description: Run a managed add, remove, or sync operation for a skillsbase repository
+
+inputs:
+  node-version:
+    description: Node.js version used for maintenance
+    required: false
+    default: "{{NODE_VERSION}}"
+  operation:
+    description: Maintenance operation to run (`add`, `remove`, or `sync`)
+    required: true
+  skill-name:
+    description: Skill name for `add` or `remove`
+    required: false
+    default: ""
+  source:
+    description: Optional source key for `add` or `remove`
+    required: false
+    default: ""
+  allow-missing-sources:
+    description: Skip missing local roots during the operation
+    required: false
+    default: "false"
+  run-tests:
+    description: Whether to run npm test after the maintenance command
+    required: false
+    default: "true"
+
+runs:
+  using: composite
+  steps:
+    - name: Setup Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ inputs.node-version }}
+        cache: npm
+
+    - name: Install dependencies
+      shell: bash
+      run: npm ci
+
+    - name: Upgrade npm
+      shell: bash
+      run: npm install --global npm@10.9.2
+
+    - name: Install skillsbase
+      shell: bash
+      run: npm install --global @hagicode/skillsbase
+
+    - name: Run maintenance command
+      shell: bash
+      env:
+        OPERATION: ${{ inputs.operation }}
+        SKILL_NAME: ${{ inputs.skill-name }}
+        SOURCE: ${{ inputs.source }}
+        ALLOW_MISSING_SOURCES: ${{ inputs.allow-missing-sources }}
+      run: |
+        set -euo pipefail
+
+        base_args=(--repo .)
+        if [[ "${ALLOW_MISSING_SOURCES}" == "true" ]]; then
+          base_args+=(--allow-missing-sources)
+        fi
+
+        case "${OPERATION}" in
+          add|remove)
+            if [[ -z "${SKILL_NAME}" ]]; then
+              echo "::error::skill-name is required when operation=${OPERATION}."
+              exit 1
+            fi
+
+            command=(skillsbase "${OPERATION}" "${SKILL_NAME}" "${base_args[@]}")
+            if [[ -n "${SOURCE}" ]]; then
+              command+=(--source "${SOURCE}")
+            fi
+            ;;
+          sync)
+            command=(skillsbase sync "${base_args[@]}")
+            ;;
+          *)
+            echo "::error::Unsupported operation: ${OPERATION}."
+            exit 1
+            ;;
+        esac
+
+        printf 'Running:'
+        printf ' %q' "${command[@]}"
+        printf '\n'
+        "${command[@]}"
+
+    - name: Run tests
+      if: ${{ inputs.run-tests == 'true' }}
+      shell: bash
+      run: npm test

package/templates/docs/maintainer-workflow.md

@@ -2,15 +2,26 @@
 
 # Maintainer Workflow
 
-The maintainer flow is `init -> add -> sync -> github_action`.
+The maintainer flow is `init -> add/remove -> sync -> github_action`.
 
 ## Lifecycle
 
 1. `skillsbase init`
-2. `skillsbase add <skill-name>`
+2. `skillsbase add <skill-name>` or `skillsbase remove <skill-name>`
 3. `skillsbase sync`
 4. `skillsbase github_action --kind all`
 
+## GitHub Maintenance Path
+
+Use `.github/workflows/skills-manage.yml` only for explicit non-interactive maintenance from GitHub UI.
+
+- `operation` chooses `add`, `remove`, or `sync`
+- `skill-name` is required for `add` and `remove`
+- `source` is optional and maps to `--source`
+- `allow-missing-sources` maps to `--allow-missing-sources`
+- `run-tests` controls the post-operation `npm test`
+- The workflow does not commit, push, or open pull requests
+
 ## Notes
 
 - `sources.yaml` is the single source of truth.
@@ -18,3 +29,4 @@ The maintainer flow is `init -> add -> sync -> github_action`.
 - `.skill-source.json` records source and conversion metadata.
 - `skillsbase sync --check` validates drift without writing files.
 - If a source root is unavailable, use `skillsbase sync --allow-missing-sources` to skip it.
+- Local CLI commands remain the primary maintainer path.

package/templates/workflows/skills-manage.yml

@@ -0,0 +1,54 @@
+# Managed by skillsbase CLI.
+
+name: Skills Manage
+
+on:
+  workflow_dispatch:
+    inputs:
+      operation:
+        description: Operation to run (`add`, `remove`, or `sync`)
+        required: true
+        type: choice
+        default: sync
+        options:
+          - add
+          - remove
+          - sync
+      skill-name:
+        description: Skill name for `add` or `remove`
+        required: false
+        type: string
+      source:
+        description: Optional source key for `add` or `remove`
+        required: false
+        type: string
+      allow-missing-sources:
+        description: Skip missing local roots during the operation
+        required: false
+        type: boolean
+        default: false
+      run-tests:
+        description: Run `npm test` after the maintenance command
+        required: false
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+
+jobs:
+  manage:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Run skillsbase maintenance
+        uses: ./.github/actions/skillsbase-manage
+        with:
+          node-version: {{NODE_VERSION}}
+          operation: ${{ inputs.operation }}
+          skill-name: ${{ inputs.skill-name }}
+          source: ${{ inputs.source }}
+          allow-missing-sources: ${{ inputs.allow-missing-sources }}
+          run-tests: ${{ inputs.run-tests }}

package/templates/workflows/skills-sync.yml

@@ -23,23 +23,8 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
+      - name: Run skillsbase validation
+        uses: ./.github/actions/skillsbase-sync
         with:
           node-version: {{NODE_VERSION}}
-          cache: npm
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Upgrade npm
-        run: npm install --global npm@10.9.2
-
-      - name: Install skillsbase
-        run: npm install --global @hagicode/skillsbase
-
-      - name: Run tests
-        run: npm test
-
-      - name: Validate managed repository state
-        run: skillsbase sync --check --repo .
+          run-tests: "true"