@softspark/ai-toolkit 4.2.3 → 4.2.5

package/app/hooks/revert-guard.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# revert-guard.sh — Block git revert/restore on files edited in this session.
+#
+# Fires on: PreToolUse
+# Matcher: Bash
+# Skipped when TOOLKIT_HOOK_PROFILE=minimal.
+#
+# Constitution Art. VI.2 ("Fix Every Found Bug"): when a session has produced
+# edits, a `git checkout/restore/reset --hard/clean -fd` on those files is
+# almost always discarding work-in-progress instead of fixing the root cause.
+# Block it unless the user explicitly opted in.
+#
+# Escape hatch: set CLAUDE_REVERT_OK=1 (per-call) to bypass.
+# Exit codes:
+#   0  allow command
+#   2  block (per Claude Code hooks spec)
+
+# shellcheck source=_profile-check.sh
+source "$(dirname "$0")/_profile-check.sh"
+# shellcheck source=_locate-toolkit.sh
+source "$(dirname "$0")/_locate-toolkit.sh"
+# shellcheck source=_hook-io.sh
+source "$(dirname "$0")/_hook-io.sh"
+
+INPUT=$(cat)
+COMMAND=$(hook_command)
+
+[ -z "$COMMAND" ] && exit 0
+[ "${CLAUDE_REVERT_OK:-0}" = "1" ] && exit 0
+[ -z "$TOOLKIT_DIR" ] && exit 0
+command -v python3 >/dev/null 2>&1 || exit 0
+
+# Strip leading words so we can match the git verb.
+# Only act on commands whose first token is `git`.
+read -r FIRST _rest <<<"$COMMAND"
+[ "$FIRST" = "git" ] || exit 0
+
+# Helper: emit block message on stderr and exit 2.
+_block() {
+    local reason="$1"
+    local detail="$2"
+    cat >&2 <<EOF
+revert-guard: BLOCKED — $reason
+Constitution Art. VI.2: do not revert work-in-progress. Fix the root cause instead.
+
+Affected: $detail
+
+If you really need to discard changes, re-run with:
+    CLAUDE_REVERT_OK=1 $COMMAND
+EOF
+    exit 2
+}
+
+# git reset --hard / git clean -fd: clobber-style, scope = all session edits.
+if printf '%s' "$COMMAND" | grep -Eq 'reset[[:space:]]+(-+[A-Za-z-]+[[:space:]]+)*--hard|clean[[:space:]]+-[A-Za-z]*[df]'; then
+    edited=$(python3 "$TOOLKIT_DIR/scripts/session_state.py" list 2>/dev/null | head -10)
+    if [ -n "$edited" ]; then
+        _block "destructive 'git reset --hard' / 'git clean' with session edits in tree" "$edited"
+    fi
+    exit 0
+fi
+
+# git checkout / git restore: only block when `--` separator is present
+# (file-restore form). Bare `git checkout branch-name` is allowed.
+if printf '%s' "$COMMAND" | grep -Eq '(checkout|restore)([[:space:]].*)?[[:space:]]--[[:space:]]'; then
+    files=$(printf '%s' "$COMMAND" | awk -F' -- ' '{print $2}')
+    [ -z "$files" ] && exit 0
+    blocked=""
+    for f in $files; do
+        # Resolve relative paths against $PWD.
+        case "$f" in
+            /*) abs="$f" ;;
+            *)  abs="$PWD/$f" ;;
+        esac
+        if python3 "$TOOLKIT_DIR/scripts/session_state.py" was-edited "$abs" >/dev/null 2>&1; then
+            blocked="$blocked $f"
+        fi
+    done
+    if [ -n "$blocked" ]; then
+        _block "restoring file(s) edited in this session" "$blocked"
+    fi
+fi
+
+exit 0

package/app/hooks/search-tracker.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# search-tracker.sh — Clear search-required flag when a search tool runs.
+#
+# Fires on: PostToolUse
+# Matcher: mcp__rag-mcp__smart_query|mcp__rag-mcp__hybrid_search_kb|mcp__rag-mcp__crag_search|mcp__rag-mcp__multi_hop_search|WebSearch|WebFetch
+# Non-blocking: always exits 0.
+# Skipped when TOOLKIT_HOOK_PROFILE=minimal.
+#
+# Paired with user-prompt-submit.sh (sets the flag) and stop-search-check.sh
+# (blocks Stop when flag still present). Together they implement the Step 0
+# "search before answering" rule from global CLAUDE.md.
+
+# shellcheck source=_profile-check.sh
+source "$(dirname "$0")/_profile-check.sh"
+
+FLAG="$HOME/.softspark/ai-toolkit/state/search-required.flag"
+rm -f "$FLAG" 2>/dev/null
+exit 0

package/app/hooks/session-start.sh

@@ -8,9 +8,21 @@
 echo "MANDATORY: Before answering ANY technical question, apply ALL rules from your CLAUDE.md files (global + project). Follow the exact order of operations defined there. Do NOT skip mandatory steps even if you think you already know the answer."
 echo "REMINDER: When writing features or fixing bugs, ensure tests cover the changes. When modifying API, config, or setup, update relevant documentation. Propose these steps to the user — do not silently skip them."
 
+# shellcheck source=_locate-toolkit.sh
+source "$(dirname "$0")/_locate-toolkit.sh"
+
+# 1a. Reset per-session edit state (used by revert-guard, test-cohesion, quality-gate)
+SESSION_ID_INPUT=""
+if [ ! -t 0 ]; then
+    STDIN_PAYLOAD="$(cat)"
+    SESSION_ID_INPUT="$(printf '%s' "$STDIN_PAYLOAD" | jq -r '.session_id // empty' 2>/dev/null)"
+fi
+if [ -n "$TOOLKIT_DIR" ] && command -v python3 >/dev/null 2>&1; then
+    python3 "$TOOLKIT_DIR/scripts/session_state.py" reset \
+        ${SESSION_ID_INPUT:+--session-id "$SESSION_ID_INPUT"} >/dev/null 2>&1 || true
+fi
+
 # 2. Check for updates (cached, max once per 24h, non-blocking)
-TOOLKIT_DIR="$(npm root -g 2>/dev/null)/@softspark/ai-toolkit"
-[ ! -d "$TOOLKIT_DIR" ] && TOOLKIT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
 VERSION_MSG=$(python3 "$TOOLKIT_DIR/scripts/version_check.py" 2>/dev/null)
 if [ -n "$VERSION_MSG" ]; then
     echo "$VERSION_MSG"

package/app/hooks/stop-search-check.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# stop-search-check.sh — Block Stop when search-first rule was skipped.
+#
+# Fires on: Stop
+# Matcher: all
+# Skipped when TOOLKIT_HOOK_PROFILE=minimal.
+#
+# If user-prompt-submit.sh set the search-required flag and no search tool
+# was invoked (search-tracker.sh would have cleared it), this hook continues
+# the conversation with a JSON `decision: block` payload so Claude reads the
+# reminder and calls smart_query() before the next response.
+#
+# Override (one-off): CLAUDE_SKIP_SEARCH_FIRST=1
+
+# shellcheck source=_profile-check.sh
+source "$(dirname "$0")/_profile-check.sh"
+# shellcheck source=_hook-io.sh
+source "$(dirname "$0")/_hook-io.sh"
+# shellcheck source=_search-capability.sh
+source "$(dirname "$0")/_search-capability.sh"
+
+[ "${CLAUDE_SKIP_SEARCH_FIRST:-0}" = "1" ] && exit 0
+
+FLAG="$HOME/.softspark/ai-toolkit/state/search-required.flag"
+[ -f "$FLAG" ] || exit 0
+
+if ! ai_toolkit_has_search_provider; then
+    rm -f "$FLAG" 2>/dev/null
+    exit 0
+fi
+
+# Read the original prompt (line 2 of the flag file) for the reminder.
+PROMPT_PREVIEW=$(sed -n '2p' "$FLAG" 2>/dev/null | head -c 200)
+rm -f "$FLAG" 2>/dev/null  # one-shot; do not loop forever
+
+hook_emit_block "Stop" "Step 0 violated: you responded to a technical prompt without calling smart_query() or hybrid_search_kb() first. Per global CLAUDE.md GOLDEN RULE: search KB BEFORE answering. Prompt was: \"${PROMPT_PREVIEW}...\". Now: call the search tool, then continue your reply. Override (one-off): CLAUDE_SKIP_SEARCH_FIRST=1."
+exit 0

package/app/hooks/test-cohesion-map.json

@@ -0,0 +1,77 @@
+[
+    {
+        "match": "app/hooks/quality-gate.sh",
+        "tests": ["tests/test_hooks.bats"],
+        "runner": "bats"
+    },
+    {
+        "match": "app/hooks/quality-check.sh",
+        "tests": ["tests/test_hooks.bats"],
+        "runner": "bats"
+    },
+    {
+        "match": "app/hooks/revert-guard.sh",
+        "tests": ["tests/test_revert_guard_hook.bats"],
+        "runner": "bats"
+    },
+    {
+        "match": "app/hooks/test-cohesion.sh",
+        "tests": ["tests/test_test_cohesion_hook.bats"],
+        "runner": "bats"
+    },
+    {
+        "match": "app/hooks/config-desync-guard.sh",
+        "tests": ["tests/test_config_desync_guard.bats"],
+        "runner": "bats"
+    },
+    {
+        "match": "app/hooks/instructions-audit.sh",
+        "tests": ["tests/test_instructions_audit.bats"],
+        "runner": "bats"
+    },
+    {
+        "match": "app/hooks/user-prompt-submit.sh",
+        "tests": ["tests/test_hooks.bats"],
+        "runner": "bats"
+    },
+    {
+        "match": "app/hooks/*.sh",
+        "tests": ["tests/test_hooks.bats", "tests/test_hooks_per_editor.bats"],
+        "runner": "bats"
+    },
+    {
+        "match": "app/hooks.json",
+        "tests": ["tests/test_hooks.bats", "tests/test_merge_hooks_statusline.bats", "tests/test_hooks_per_editor.bats"],
+        "runner": "bats"
+    },
+    {
+        "match": "scripts/merge-hooks.py",
+        "tests": ["tests/test_merge_hooks_statusline.bats", "tests/test_inject_hook.bats"],
+        "runner": "bats"
+    },
+    {
+        "match": "scripts/session_state.py",
+        "tests": ["tests/test_session_state.bats"],
+        "runner": "bats"
+    },
+    {
+        "match": "scripts/test_cohesion.py",
+        "tests": ["tests/test_test_cohesion_resolver.bats"],
+        "runner": "bats"
+    },
+    {
+        "match": "scripts/inject_hook_cli.py",
+        "tests": ["tests/test_inject_hook.bats"],
+        "runner": "bats"
+    },
+    {
+        "match": "scripts/inject_rule_cli.py",
+        "tests": ["tests/test_inject.bats"],
+        "runner": "bats"
+    },
+    {
+        "match": "scripts/validate.py",
+        "tests": ["tests/test_validate.bats", "tests/test_validate_negative.bats"],
+        "runner": "bats"
+    }
+]

package/app/hooks/test-cohesion.sh

@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+# test-cohesion.sh — Run related tests after edits, block if they fail.
+#
+# Fires on: PostToolUse
+# Matcher: Edit|MultiEdit|Write
+# Skipped when TOOLKIT_HOOK_PROFILE=minimal or CLAUDE_HOOK_BOOTSTRAP=1.
+#
+# Constitution Art. VI.3 ("Tests and Docs Follow Behavior"): when source code
+# changes, the matching tests must pass before the agent can continue. This
+# hook resolves a per-project test-cohesion map and runs only the related
+# test files (NOT the full suite).
+#
+# Map lookup (first found wins):
+#   1. $PWD/.claude/test-cohesion-map.json (project-local)
+#   2. $TOOLKIT_DIR/app/hooks/test-cohesion-map.json (toolkit default)
+#
+# Escape hatches:
+#   CLAUDE_HOOK_BOOTSTRAP=1   bypass (used when editing the hook itself)
+#   CLAUDE_SKIP_COHESION=1    one-off bypass
+#
+# Exit codes:
+#   0  no map / no match / tests passed
+#   2  related test command failed
+
+# shellcheck source=_profile-check.sh
+source "$(dirname "$0")/_profile-check.sh"
+# shellcheck source=_locate-toolkit.sh
+source "$(dirname "$0")/_locate-toolkit.sh"
+# shellcheck source=_hook-io.sh
+source "$(dirname "$0")/_hook-io.sh"
+
+[ "${CLAUDE_HOOK_BOOTSTRAP:-0}" = "1" ] && exit 0
+[ "${CLAUDE_SKIP_COHESION:-0}" = "1" ] && exit 0
+
+INPUT=$(cat)
+FILE_PATH=$(hook_file_path)
+
+[ -z "$FILE_PATH" ] && exit 0
+[ -z "$TOOLKIT_DIR" ] && exit 0
+command -v python3 >/dev/null 2>&1 || exit 0
+
+REPO_ROOT="$PWD"
+# Prefer git repo root when available; fall back to PWD.
+if command -v git >/dev/null 2>&1; then
+    git_root=$(git rev-parse --show-toplevel 2>/dev/null)
+    [ -n "$git_root" ] && REPO_ROOT="$git_root"
+fi
+
+# Resolve symlinks on both sides so the cohesion-map glob can match files
+# under symlinked roots (e.g. /tmp -> /private/tmp on macOS).
+REAL_FILE=$(python3 -c "import os,sys; print(os.path.realpath(sys.argv[1]))" "$FILE_PATH" 2>/dev/null)
+REAL_REPO=$(python3 -c "import os,sys; print(os.path.realpath(sys.argv[1]))" "$REPO_ROOT" 2>/dev/null)
+[ -z "$REAL_FILE" ] && REAL_FILE="$FILE_PATH"
+[ -z "$REAL_REPO" ] && REAL_REPO="$REPO_ROOT"
+
+COMMANDS=$(python3 "$TOOLKIT_DIR/scripts/test_cohesion.py" resolve \
+    --changed-paths "$REAL_FILE" --repo-root "$REAL_REPO" 2>/dev/null)
+[ -z "$COMMANDS" ] && exit 0
+
+# Run each resolved command. Block on first failure.
+LOG_DIR="$HOME/.softspark/ai-toolkit/state"
+mkdir -p "$LOG_DIR" 2>/dev/null
+LOG_FILE="$LOG_DIR/test-cohesion-last.log"
+
+cd "$REAL_REPO" || exit 0
+FAILED=""
+while IFS= read -r cmd; do
+    [ -z "$cmd" ] && continue
+    if ! bash -c "$cmd" >"$LOG_FILE" 2>&1; then
+        FAILED="$cmd"
+        break
+    fi
+done <<<"$COMMANDS"
+
+if [ -n "$FAILED" ]; then
+    cat >&2 <<EOF
+test-cohesion: BLOCKED — tests for ${FILE_PATH} failed.
+Constitution Art. VI.3: tests must pass before continuing.
+
+Command:
+    $FAILED
+
+Last log (truncated):
+$(tail -20 "$LOG_FILE")
+
+Fix the failing test OR update it to match the new behavior (Art. VI.3).
+Override (one-off): CLAUDE_SKIP_COHESION=1
+EOF
+    exit 2
+fi
+
+[ "${AI_TOOLKIT_HOOK_FORMAT:-}" = "json" ] || echo "test-cohesion: related tests passed for ${FILE_PATH}"
+exit 0

package/app/hooks/track-usage.sh

@@ -11,7 +11,9 @@ STATS_FILE="${HOME}/.softspark/ai-toolkit/stats.json"
 
 # Read prompt from stdin (Claude Code passes JSON with .prompt field)
 INPUT=$(cat)
-PROMPT_TEXT=$(echo "$INPUT" | jq -r '.prompt // empty' 2>/dev/null)
+# shellcheck source=_hook-io.sh
+source "$(dirname "$0")/_hook-io.sh"
+PROMPT_TEXT=$(hook_prompt)
 [ -z "$PROMPT_TEXT" ] && exit 0
 
 # Only track if prompt starts with a slash command

package/app/hooks/user-prompt-submit.sh

@@ -7,21 +7,48 @@
 
 # shellcheck source=_profile-check.sh
 source "$(dirname "$0")/_profile-check.sh"
+# shellcheck source=_hook-io.sh
+source "$(dirname "$0")/_hook-io.sh"
+# shellcheck source=_search-capability.sh
+source "$(dirname "$0")/_search-capability.sh"
 
 # Read prompt from stdin (Claude Code passes JSON with .prompt field)
 INPUT=$(cat)
-PROMPT_TEXT=$(echo "$INPUT" | jq -r '.prompt // empty' 2>/dev/null)
+PROMPT_TEXT=$(hook_prompt)
 LOWERED="$(printf '%s' "$PROMPT_TEXT" | tr '[:upper:]' '[:lower:]')"
 
-echo "STOP. Execute Step 0 before responding: check your CLAUDE.md for search-first rules. If search-first rules exist, call the required search tool NOW — before any other tool or text output. If you skip this step, the user will interrupt you."
+# Heuristic search-required flag (paired with search-tracker.sh + Stop check).
+# Set only when a search provider is detectable or strict mode is requested.
+# Cleared by search-tracker.sh after smart_query / hybrid_search_kb / web runs.
+PROMPT_LEN=${#PROMPT_TEXT}
+STATE_DIR="$HOME/.softspark/ai-toolkit/state"
+FLAG="$STATE_DIR/search-required.flag"
+mkdir -p "$STATE_DIR" 2>/dev/null
+if [ "$PROMPT_LEN" -gt 30 ] && \
+   [ "${CLAUDE_SKIP_SEARCH_FIRST:-0}" != "1" ] && \
+   ai_toolkit_has_search_provider; then
+    printf '%s\n%s\n' "$(date -u +%s)" "$PROMPT_TEXT" > "$FLAG" 2>/dev/null
+else
+    rm -f "$FLAG" 2>/dev/null
+fi
+
+if ai_toolkit_has_search_provider; then
+    CONTEXT_MSG="STOP. Execute Step 0 before responding: check your CLAUDE.md for search-first rules. If search-first rules exist and a search tool is available, call the required search tool NOW — before any other tool or text output."
+else
+    CONTEXT_MSG="Search-first note: no ai-toolkit search provider was detected, so search-first enforcement is advisory only. Use available local evidence; do not call unavailable RAG/MCP tools."
+fi
 
 if printf '%s' "$LOWERED" | grep -Eq 'architecture|design|migration|deploy|rollback|refactor|plugin|workflow'; then
-    echo "UserPromptSubmit: task looks architectural or multi-step. Use plan mode, define success criteria, and validate before marking done."
+    CONTEXT_MSG="$CONTEXT_MSG
+UserPromptSubmit: task looks architectural or multi-step. Use plan mode, define success criteria, and validate before marking done."
 elif printf '%s' "$LOWERED" | grep -Eq 'bug|error|fail|failing|incident|outage|debug'; then
-    echo "UserPromptSubmit: debugging request detected. Gather evidence first, then propose the smallest safe fix and targeted tests."
+    CONTEXT_MSG="$CONTEXT_MSG
+UserPromptSubmit: debugging request detected. Gather evidence first, then propose the smallest safe fix and targeted tests."
 else
-    echo "UserPromptSubmit: apply KB-first research, keep changes minimal, and update tests/docs when behavior changes."
+    CONTEXT_MSG="$CONTEXT_MSG
+UserPromptSubmit: apply KB-first research, keep changes minimal, and update tests/docs when behavior changes."
 fi
 
-exit 0
+hook_emit_context "$CONTEXT_MSG"
 
+exit 0

package/app/hooks.json

@@ -39,7 +39,7 @@
                 "hooks": [
                     {
                         "type": "command",
-                        "command": "bash ~/.softspark/ai-toolkit/hooks/notify-waiting.sh"
+                        "command": "\"$HOME/.softspark/ai-toolkit/hooks/notify-waiting.sh\""
                     }
                 ]
             }
@@ -84,6 +84,16 @@
                         "command": "\"$HOME/.softspark/ai-toolkit/hooks/commit-quality.sh\""
                     }
                 ]
+            },
+            {
+                "_source": "ai-toolkit",
+                "matcher": "Bash",
+                "hooks": [
+                    {
+                        "type": "command",
+                        "command": "\"$HOME/.softspark/ai-toolkit/hooks/revert-guard.sh\""
+                    }
+                ]
             }
         ],
         "UserPromptSubmit": [
@@ -128,6 +138,26 @@
                         "command": "\"$HOME/.softspark/ai-toolkit/hooks/governance-capture.sh\""
                     }
                 ]
+            },
+            {
+                "_source": "ai-toolkit",
+                "matcher": "Edit|MultiEdit|Write",
+                "hooks": [
+                    {
+                        "type": "command",
+                        "command": "\"$HOME/.softspark/ai-toolkit/hooks/test-cohesion.sh\""
+                    }
+                ]
+            },
+            {
+                "_source": "ai-toolkit",
+                "matcher": "mcp__rag-mcp__smart_query|mcp__rag-mcp__hybrid_search_kb|mcp__rag-mcp__crag_search|mcp__rag-mcp__multi_hop_search|mcp__rag-mcp__verify_answer|WebSearch|WebFetch",
+                "hooks": [
+                    {
+                        "type": "command",
+                        "command": "\"$HOME/.softspark/ai-toolkit/hooks/search-tracker.sh\""
+                    }
+                ]
             }
         ],
         "Stop": [
@@ -160,6 +190,16 @@
                         "command": "\"$HOME/.softspark/ai-toolkit/hooks/quality-gate.sh\""
                     }
                 ]
+            },
+            {
+                "_source": "ai-toolkit",
+                "matcher": "",
+                "hooks": [
+                    {
+                        "type": "command",
+                        "command": "\"$HOME/.softspark/ai-toolkit/hooks/stop-search-check.sh\""
+                    }
+                ]
             }
         ],
         "TaskCompleted": [
@@ -243,6 +283,30 @@
                     }
                 ]
             }
+        ],
+        "InstructionsLoaded": [
+            {
+                "_source": "ai-toolkit",
+                "matcher": "",
+                "hooks": [
+                    {
+                        "type": "command",
+                        "command": "\"$HOME/.softspark/ai-toolkit/hooks/instructions-audit.sh\""
+                    }
+                ]
+            }
+        ],
+        "ConfigChange": [
+            {
+                "_source": "ai-toolkit",
+                "matcher": "user_settings",
+                "hooks": [
+                    {
+                        "type": "command",
+                        "command": "\"$HOME/.softspark/ai-toolkit/hooks/config-desync-guard.sh\""
+                    }
+                ]
+            }
         ]
     },
     "statusLine": {

package/app/skills/ci/SKILL.md

@@ -88,7 +88,7 @@ Use `ci-cd-patterns` skill for pipeline templates and best practices.
 - GitHub Actions YAML parses `on:` as a reserved word only when unquoted. Writing `"on":` (quoted) produces a valid-looking file whose workflow **never triggers**. YAML anchors in this field also silently break.
 - GitLab CI's `rules:` and `only:/except:` are mutually exclusive at the job level. Mixing them fails parse on pipeline run but not at `git push` time — test with `gitlab-ci-lint` before committing.
 - `secrets.*` in GitHub Actions is undefined in workflows triggered from **forked** PRs (security boundary). Jobs that need secrets must gate on `github.event.pull_request.head.repo.full_name == github.repository` or use `pull_request_target` carefully.
-- `actions/checkout@v4` defaults to `fetch-depth: 1` (shallow). Commands that need history (`git log`, `git describe`, conventional-commit tools) fail with misleading errors — set `fetch-depth: 0` for those jobs.
+- `actions/checkout@v6` defaults to `fetch-depth: 1` (shallow). Commands that need history (`git log`, `git describe`, conventional-commit tools) fail with misleading errors — set `fetch-depth: 0` for those jobs.
 
 ## When NOT to Use
 

package/app/skills/ci/templates/github-actions-node.yml

@@ -14,10 +14,10 @@ jobs:
         node-version: [18, 20, 22]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'

package/app/skills/ci/templates/github-actions-python.yml

@@ -14,7 +14,7 @@ jobs:
         python-version: ["3.11", "3.12", "3.13"]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5

package/app/skills/ci-cd-patterns/SKILL.md

@@ -23,8 +23,8 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: 20
           cache: "npm"
@@ -39,8 +39,8 @@ jobs:
       matrix:
         node-version: [18, 20, 22]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
           cache: "npm"
@@ -55,8 +55,8 @@ jobs:
     runs-on: ubuntu-latest
     needs: test
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: 20
           cache: "npm"
@@ -73,7 +73,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
@@ -90,7 +90,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: test
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v3
         with:

package/app/skills/csharp-patterns/SKILL.md

@@ -417,7 +417,7 @@ dotnet_diagnostic.CA1848.severity = warning
 ### CI (GitHub Actions)
 ```yaml
 steps:
-  - uses: actions/checkout@v4
+  - uses: actions/checkout@v6
   - uses: actions/setup-dotnet@v4
     with: { dotnet-version: '9.0.x' }
   - run: dotnet restore

package/app/skills/docker-devops/SKILL.md

@@ -157,8 +157,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: '20'
           cache: 'npm'
@@ -172,7 +172,7 @@ jobs:
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Deploy to production
         run: |
           # Deploy commands
@@ -192,7 +192,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: actions/setup-python@v5
         with:
           python-version: '3.12'