@rhize/skill-forge 0.21.0 → 0.21.1

package/README.md

@@ -241,3 +241,59 @@ findings, gate decisions or installed skills. Static reports keep actual host lo
 truncation unknown; rough token estimates are not measured usage. Comparisons show covered
 skills and description/body deltas when both reports contain the new evidence. See
 [the audit command](docs/commands/audit.md) for metric definitions and unavailable-resource handling.
+
+## CI environment documentation contract
+
+CI checks tracked application, operational script and test JavaScript/TypeScript against this
+table using a deterministic AST scanner. It reads variable names, never secret values, and
+does not generate prose or call a model. Source-hash-bound exceptions cover reviewed injected
+environment aliases and test subprocess forwarding; forwarding may inherit additional host
+variables and is not claimed to be a finite allowlist.
+
+| Variable | Purpose | Requirement |
+| --- | --- | --- |
+| `SKILL_FORGE_HOME` | Override local Skill Forge state directory; tests use isolated fixture homes. | Optional. |
+| `SKILL_FORGE_LICENSE` | Provide the optional license key through the existing license resolver. | Conditional on licensed features and current beta policy. |
+| `DEBUG` | Set to `skill-forge` for CLI error diagnostics. | Optional. |
+| `PATH` | Discover agent CLIs and optional safety tooling. | Required host execution environment. |
+| `PATHEXT` | Windows executable extensions for tool discovery. | Optional; Windows defaults apply. |
+| `VERCEL_OIDC_TOKEN` | Authenticate explicitly invoked skills.sh discovery/API requests. | Conditional on those commands; CI fixtures use fake inputs. |
+| `SKILLSPECTOR_PROVIDER` | Identify the optional SkillSpector provider for readiness reporting. | Optional. |
+| `OPENAI_API_KEY` | Presence check for the optional OpenAI SkillSpector provider. | Conditional on external provider use; not supplied to CI. |
+| `ANTHROPIC_API_KEY` | Presence check for the optional Anthropic SkillSpector provider. | Conditional on external provider use; not supplied to CI. |
+| `NVIDIA_INFERENCE_KEY` | Presence check for the optional NVIDIA SkillSpector provider. | Conditional on external provider use; not supplied to CI. |
+| `HOME` | Test subprocess home override to isolate user installations. | Required test fixture setting. |
+| `USERPROFILE` | Windows-compatible test subprocess home override. | Required test fixture setting. |
+
+## CI cost and release boundaries
+
+Main pushes and PRs run Linux Node24 CI, preserving **build before test**. Superseded checks
+cancel, with a ten-minute job limit. Narrative Markdown, root docs and agent state directories
+trigger no run; bundled `assets/**` prompts, workflow instructions and `test/fixtures/**`
+regression inputs remain tested, including Markdown. Feature pushes do not duplicate PR builds. Docs-only tips receive no CI check result.
+
+The repository's TypeScript7 package has no JavaScript compiler API. A separate CI-only
+TypeScript5.9.3 lockfile supplies the AST documentation scanner; runtime dependencies remain
+unchanged. Scanner helpers are copied byte-for-byte from the recorded Infra revision in
+`.github/ci/source.json`, with local hash verification. This subset deliberately preserves
+the native build-before-test workflow rather than replacing it with an application pipeline.
+
+Weekly grouped minor/patch dependency updates run the same checks; application major updates remain
+separate, and nothing auto-merges. No Copilot or LLM is required by CI. The existing explicit
+`v*` tag release retains OIDC trusted publishing, build/test checks and Node24, pins npm11.6.2,
+and serializes publication without cancellation with a fifteen-minute limit. GitHub does not
+apply file-path filters to tag events; creating a release tag remains a separate release action.
+
+CI acceptance (2026-09-27): [reviewed PR run](https://github.com/Rhize-Media/skill-forge/actions/runs/36345897118) and [main control run](https://github.com/Rhize-Media/skill-forge/actions/runs/36346111479). This separate narrative-only README change is the push/PR docs-filter acceptance case; settled run results are recorded in the cross-repository hardening report.
+
+### CI parser update policy
+
+Dependabot holds semantic-major updates only for `typescript` in `.github/ci-tools`.
+The documentation scanner requires the TypeScript 5 compiler API (`createSourceFile`
+and `ScriptTarget`); TypeScript 7.0.2 does not export that API. A parser migration
+requires a reviewed compatibility change. Weekly grouped minor/patch parser updates
+continue through CI. Application dependency updates and Actions updates retain their
+existing policies. This is an explicit compatibility and CI-cost policy, not a fix
+for the unresolved historical Dependabot HTTP 400 PR-creation errors.
+
+Splitting the npm entries retains the root limit of two open PRs and adds one for the parser: up to three combined, versus the previous shared limit of two.