@sitar_fiercer4c/skills 0.1.0 → 0.1.2

package/README.md

@@ -8,6 +8,14 @@ Installing the package copies every skill into the `.claude/skills` directory of
 
 You need an npm account that has been added as a collaborator on this private package.
 
+npm 12 and later block dependency install scripts unless the project allows them. Add this to the project's `package.json` before installing:
+
+```json
+"allowScripts": { "@sitar_fiercer4c/skills": true }
+```
+
+Use this name-only entry rather than `npm install-scripts approve`. By default that command pins the entry to the installed version (`@sitar_fiercer4c/skills@0.1.0`), which blocks the copy again after the next release. npm 11 ignores the field.
+
 ```sh
 npm login                       # or add a read-only token to .npmrc (see below)
 npm install -D @sitar_fiercer4c/skills
@@ -23,7 +31,7 @@ For CI, add this to the project's `.npmrc` and set `NPM_TOKEN` to a read-only to
 
 ### If install scripts are disabled
 
-With `--ignore-scripts`, pnpm, or bun, the postinstall copy may not run. Copy the skills manually from the project root:
+With `--ignore-scripts`, npm 12+ without the `allowScripts` entry, pnpm, or bun, the postinstall copy doesn't run. Copy the skills manually from the project root:
 
 ```sh
 npx @sitar_fiercer4c/skills
@@ -65,11 +73,15 @@ npm skips the copy when the installed version is unchanged. To restore the skill
 
 Each skill lives in `skills/<name>/` with a `SKILL.md`. `evals/` folders are kept in the repo but excluded from the published package.
 
-To publish, load the token from `.env.local` and run:
+## Releasing
 
-```sh
-set -a && . ./.env.local && set +a
-npm version patch
-npm publish
-git push --follow-tags
-```
+Releases are automatic. When a PR that changes `skills/`, `bin/` or `package.json` merges into `main`, the [Publish workflow](.github/workflows/publish.yml):
+
+1. Picks the version: the version in `package.json` if it has no `v<version>` tag yet, otherwise the next patch.
+2. Packs the package and checks that installing it copies every skill into `.claude/skills`.
+3. Pushes the version commit and `v<version>` tag to `main`.
+4. Publishes to npm using trusted publishing (no npm token in the repo).
+
+For a minor or major release, set the new version in `package.json` in your PR. To check the workflow without publishing, run it manually from the Actions tab with **dry run** checked.
+
+Trusted publishing is configured on npmjs.com under the package's Settings → Trusted Publisher (GitHub Actions, repository `thenextepisode-stealth/skills`, workflow `publish.yml`).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sitar_fiercer4c/skills",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Claude Code agent skills, installed into the project's .claude/skills directory",
   "license": "UNLICENSED",
   "repository": {

package/skills/using-git-worktrees/SKILL.md

@@ -154,7 +154,7 @@ Ready to implement <feature-name>
 | Directory not ignored | Add to .gitignore + commit |
 | Permission error on create | Sandbox fallback, work in place |
 | Tests fail during baseline | Report failures + ask |
-| No package.json/Cargo.toml | Skip dependency install |
+| No package.json, Cargo.toml, requirements.txt, pyproject.toml or go.mod | Skip dependency install |
 
 ## Common Rationalizations