@olegkoval/agent-skills 1.54.0 → 1.54.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.github/prompts/nas-actions-migration.prompt.md +11 -2
- package/adapters/claude/olko-github-pr/skills/nas-actions-migration/SKILL.md +11 -2
- package/adapters/cursor/olko-github-pr/skills/nas-actions-migration/SKILL.md +11 -2
- package/adapters/grok/olko-github-pr/skills/nas-actions-migration/SKILL.md +11 -2
- package/package.json +1 -1
- package/plugins/olko-apple-kit/.claude-plugin/plugin.json +1 -1
- package/plugins/olko-creative/.claude-plugin/plugin.json +1 -1
- package/plugins/olko-garmin-kit/.claude-plugin/plugin.json +1 -1
- package/plugins/olko-git-tools/.claude-plugin/plugin.json +1 -1
- package/plugins/olko-github-pr/.claude-plugin/plugin.json +1 -1
- package/plugins/olko-github-pr/skills/nas-actions-migration/SKILL.md +11 -2
- package/plugins/olko-obsidian/.claude-plugin/plugin.json +1 -1
- package/plugins/olko-product/.claude-plugin/plugin.json +1 -1
- package/plugins/olko-reflection/.claude-plugin/plugin.json +1 -1
- package/plugins/olko-release/.claude-plugin/plugin.json +1 -1
- package/plugins/olko-skill-meta/.claude-plugin/plugin.json +1 -1
- package/plugins/olko-web-ops/.claude-plugin/plugin.json +1 -1
|
@@ -48,9 +48,18 @@ Use when asked to move Actions/CI jobs to a NAS, copy the Roazon/Funda Radar run
|
|
|
48
48
|
|| github.event.pull_request.head.repo.full_name == github.repository
|
|
49
49
|
```
|
|
50
50
|
|
|
51
|
-
Guard each job independently. Never rely on a downstream job's guard to protect an unguarded dependency.
|
|
51
|
+
Guard each job independently. Never rely on a downstream job's guard to protect an unguarded dependency. If the hosted fallback should continue running fork PR checks while NAS mode excludes them, use the three-part guard:
|
|
52
52
|
|
|
53
|
-
|
|
53
|
+
```yaml
|
|
54
|
+
if: >-
|
|
55
|
+
vars.CI_RUNNER != 'nas'
|
|
56
|
+
|| github.event_name != 'pull_request'
|
|
57
|
+
|| github.event.pull_request.head.repo.full_name == github.repository
|
|
58
|
+
```
|
|
59
|
+
|
|
60
|
+
Add `workflow_dispatch` to a workflow's `on:` triggers if the provisioning/verification instructions dispatch it manually. Add exact toolchain setup because runner images may not contain Node, Bun, browsers, Docker, or compatible system libraries.
|
|
61
|
+
|
|
62
|
+
5. **Document provisioning and rollback.** Provide the target repo's exact runner name, label, container/image, dedicated work directory, ephemeral/restart settings, required tool installation, safe secret storage, and health check. For persistent `myoung34/github-runner` containers, use a narrowly scoped fine-grained PAT with repository Administration read/write in the NAS secret store; pass it as `ACCESS_TOKEN` only via a root-readable env file and set `UNSET_CONFIG_VARS=true`. Verify the selected image's entrypoint supports this option; it must unset `ACCESS_TOKEN` and other setup credentials after registration and before starting the listener. Add a preflight check before running downloaded or repository-controlled tooling to fail if `ACCESS_TOKEN` reached job steps. Do not print, commit, message, or substitute a short-lived registration token for a restart-persistent credential. Never reuse another repo's `/_work` or token.
|
|
54
63
|
|
|
55
64
|
Document rollback as deleting the opt-in variable, which routes eligible jobs back to `ubuntu-latest`. State that this fallback still depends on GitHub Actions billing being available.
|
|
56
65
|
|
|
@@ -59,9 +59,18 @@ Use when asked to move Actions/CI jobs to a NAS, copy the Roazon/Funda Radar run
|
|
|
59
59
|
|| github.event.pull_request.head.repo.full_name == github.repository
|
|
60
60
|
```
|
|
61
61
|
|
|
62
|
-
Guard each job independently. Never rely on a downstream job's guard to protect an unguarded dependency.
|
|
62
|
+
Guard each job independently. Never rely on a downstream job's guard to protect an unguarded dependency. If the hosted fallback should continue running fork PR checks while NAS mode excludes them, use the three-part guard:
|
|
63
63
|
|
|
64
|
-
|
|
64
|
+
```yaml
|
|
65
|
+
if: >-
|
|
66
|
+
vars.CI_RUNNER != 'nas'
|
|
67
|
+
|| github.event_name != 'pull_request'
|
|
68
|
+
|| github.event.pull_request.head.repo.full_name == github.repository
|
|
69
|
+
```
|
|
70
|
+
|
|
71
|
+
Add `workflow_dispatch` to a workflow's `on:` triggers if the provisioning/verification instructions dispatch it manually. Add exact toolchain setup because runner images may not contain Node, Bun, browsers, Docker, or compatible system libraries.
|
|
72
|
+
|
|
73
|
+
5. **Document provisioning and rollback.** Provide the target repo's exact runner name, label, container/image, dedicated work directory, ephemeral/restart settings, required tool installation, safe secret storage, and health check. For persistent `myoung34/github-runner` containers, use a narrowly scoped fine-grained PAT with repository Administration read/write in the NAS secret store; pass it as `ACCESS_TOKEN` only via a root-readable env file and set `UNSET_CONFIG_VARS=true`. Verify the selected image's entrypoint supports this option; it must unset `ACCESS_TOKEN` and other setup credentials after registration and before starting the listener. Add a preflight check before running downloaded or repository-controlled tooling to fail if `ACCESS_TOKEN` reached job steps. Do not print, commit, message, or substitute a short-lived registration token for a restart-persistent credential. Never reuse another repo's `/_work` or token.
|
|
65
74
|
|
|
66
75
|
Document rollback as deleting the opt-in variable, which routes eligible jobs back to `ubuntu-latest`. State that this fallback still depends on GitHub Actions billing being available.
|
|
67
76
|
|
|
@@ -59,9 +59,18 @@ Use when asked to move Actions/CI jobs to a NAS, copy the Roazon/Funda Radar run
|
|
|
59
59
|
|| github.event.pull_request.head.repo.full_name == github.repository
|
|
60
60
|
```
|
|
61
61
|
|
|
62
|
-
Guard each job independently. Never rely on a downstream job's guard to protect an unguarded dependency.
|
|
62
|
+
Guard each job independently. Never rely on a downstream job's guard to protect an unguarded dependency. If the hosted fallback should continue running fork PR checks while NAS mode excludes them, use the three-part guard:
|
|
63
63
|
|
|
64
|
-
|
|
64
|
+
```yaml
|
|
65
|
+
if: >-
|
|
66
|
+
vars.CI_RUNNER != 'nas'
|
|
67
|
+
|| github.event_name != 'pull_request'
|
|
68
|
+
|| github.event.pull_request.head.repo.full_name == github.repository
|
|
69
|
+
```
|
|
70
|
+
|
|
71
|
+
Add `workflow_dispatch` to a workflow's `on:` triggers if the provisioning/verification instructions dispatch it manually. Add exact toolchain setup because runner images may not contain Node, Bun, browsers, Docker, or compatible system libraries.
|
|
72
|
+
|
|
73
|
+
5. **Document provisioning and rollback.** Provide the target repo's exact runner name, label, container/image, dedicated work directory, ephemeral/restart settings, required tool installation, safe secret storage, and health check. For persistent `myoung34/github-runner` containers, use a narrowly scoped fine-grained PAT with repository Administration read/write in the NAS secret store; pass it as `ACCESS_TOKEN` only via a root-readable env file and set `UNSET_CONFIG_VARS=true`. Verify the selected image's entrypoint supports this option; it must unset `ACCESS_TOKEN` and other setup credentials after registration and before starting the listener. Add a preflight check before running downloaded or repository-controlled tooling to fail if `ACCESS_TOKEN` reached job steps. Do not print, commit, message, or substitute a short-lived registration token for a restart-persistent credential. Never reuse another repo's `/_work` or token.
|
|
65
74
|
|
|
66
75
|
Document rollback as deleting the opt-in variable, which routes eligible jobs back to `ubuntu-latest`. State that this fallback still depends on GitHub Actions billing being available.
|
|
67
76
|
|
|
@@ -59,9 +59,18 @@ Use when asked to move Actions/CI jobs to a NAS, copy the Roazon/Funda Radar run
|
|
|
59
59
|
|| github.event.pull_request.head.repo.full_name == github.repository
|
|
60
60
|
```
|
|
61
61
|
|
|
62
|
-
Guard each job independently. Never rely on a downstream job's guard to protect an unguarded dependency.
|
|
62
|
+
Guard each job independently. Never rely on a downstream job's guard to protect an unguarded dependency. If the hosted fallback should continue running fork PR checks while NAS mode excludes them, use the three-part guard:
|
|
63
63
|
|
|
64
|
-
|
|
64
|
+
```yaml
|
|
65
|
+
if: >-
|
|
66
|
+
vars.CI_RUNNER != 'nas'
|
|
67
|
+
|| github.event_name != 'pull_request'
|
|
68
|
+
|| github.event.pull_request.head.repo.full_name == github.repository
|
|
69
|
+
```
|
|
70
|
+
|
|
71
|
+
Add `workflow_dispatch` to a workflow's `on:` triggers if the provisioning/verification instructions dispatch it manually. Add exact toolchain setup because runner images may not contain Node, Bun, browsers, Docker, or compatible system libraries.
|
|
72
|
+
|
|
73
|
+
5. **Document provisioning and rollback.** Provide the target repo's exact runner name, label, container/image, dedicated work directory, ephemeral/restart settings, required tool installation, safe secret storage, and health check. For persistent `myoung34/github-runner` containers, use a narrowly scoped fine-grained PAT with repository Administration read/write in the NAS secret store; pass it as `ACCESS_TOKEN` only via a root-readable env file and set `UNSET_CONFIG_VARS=true`. Verify the selected image's entrypoint supports this option; it must unset `ACCESS_TOKEN` and other setup credentials after registration and before starting the listener. Add a preflight check before running downloaded or repository-controlled tooling to fail if `ACCESS_TOKEN` reached job steps. Do not print, commit, message, or substitute a short-lived registration token for a restart-persistent credential. Never reuse another repo's `/_work` or token.
|
|
65
74
|
|
|
66
75
|
Document rollback as deleting the opt-in variable, which routes eligible jobs back to `ubuntu-latest`. State that this fallback still depends on GitHub Actions billing being available.
|
|
67
76
|
|
package/package.json
CHANGED
|
@@ -58,9 +58,18 @@ Use when asked to move Actions/CI jobs to a NAS, copy the Roazon/Funda Radar run
|
|
|
58
58
|
|| github.event.pull_request.head.repo.full_name == github.repository
|
|
59
59
|
```
|
|
60
60
|
|
|
61
|
-
Guard each job independently. Never rely on a downstream job's guard to protect an unguarded dependency.
|
|
61
|
+
Guard each job independently. Never rely on a downstream job's guard to protect an unguarded dependency. If the hosted fallback should continue running fork PR checks while NAS mode excludes them, use the three-part guard:
|
|
62
62
|
|
|
63
|
-
|
|
63
|
+
```yaml
|
|
64
|
+
if: >-
|
|
65
|
+
vars.CI_RUNNER != 'nas'
|
|
66
|
+
|| github.event_name != 'pull_request'
|
|
67
|
+
|| github.event.pull_request.head.repo.full_name == github.repository
|
|
68
|
+
```
|
|
69
|
+
|
|
70
|
+
Add `workflow_dispatch` to a workflow's `on:` triggers if the provisioning/verification instructions dispatch it manually. Add exact toolchain setup because runner images may not contain Node, Bun, browsers, Docker, or compatible system libraries.
|
|
71
|
+
|
|
72
|
+
5. **Document provisioning and rollback.** Provide the target repo's exact runner name, label, container/image, dedicated work directory, ephemeral/restart settings, required tool installation, safe secret storage, and health check. For persistent `myoung34/github-runner` containers, use a narrowly scoped fine-grained PAT with repository Administration read/write in the NAS secret store; pass it as `ACCESS_TOKEN` only via a root-readable env file and set `UNSET_CONFIG_VARS=true`. Verify the selected image's entrypoint supports this option; it must unset `ACCESS_TOKEN` and other setup credentials after registration and before starting the listener. Add a preflight check before running downloaded or repository-controlled tooling to fail if `ACCESS_TOKEN` reached job steps. Do not print, commit, message, or substitute a short-lived registration token for a restart-persistent credential. Never reuse another repo's `/_work` or token.
|
|
64
73
|
|
|
65
74
|
Document rollback as deleting the opt-in variable, which routes eligible jobs back to `ubuntu-latest`. State that this fallback still depends on GitHub Actions billing being available.
|
|
66
75
|
|