skillgauntlet 1.3.7 → 1.3.8

package/lib/submit.js

@@ -92,15 +92,36 @@ function prBody(pkg) {
   ].join('\n');
 }
 
+// A fork that was just created is not always cloneable at once; try a few times, a few seconds apart.
+function cloneWithRetry(exec, url, dir, { tries = 5, waitMs = 3000 } = {}) {
+  let last;
+  for (let i = 0; i < tries; i += 1) {
+    try {
+      exec('git', ['clone', '--depth', '1', '-c', 'credential.helper=', '-c', 'credential.https://github.com.helper=!gh auth git-credential', url, dir]);
+      return;
+    } catch (err) {
+      last = err;
+      fs.rmSync(dir, { recursive: true, force: true });
+      if (i < tries - 1) Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, waitMs);
+    }
+  }
+  throw last;
+}
+
 // Fork, branch, commit, push, open. Every GitHub call goes through `exec` so tests can fake them.
-export function openPullRequest({ pkgDir, pkg, gh, exec = defaultExec, say: out = say }) {
+export function openPullRequest({ pkgDir, pkg, gh, exec = defaultExec, say: out = say, cloneWait = 3000 }) {
   const work = fs.mkdtempSync(path.join(os.tmpdir(), 'sg-pr-'));
   try {
     out(t('submitForking', { upstream: UPSTREAM }));
     exec('gh', ['repo', 'fork', UPSTREAM, '--clone=false']);
     out(t('submitPreparing'));
     const repoDir = path.join(work, 'repo');
-    exec('git', ['clone', '--depth', '1', `https://github.com/${UPSTREAM}.git`, repoDir]);
+    const forkUrl = `https://github.com/${gh.user}/${UPSTREAM.split('/')[1]}.git`;
+    // The branch is made from the contributor's own fork, not from upstream's main. A fork made before upstream gained
+    // workflow files lacks them, and pushing a branch built on upstream's main would then "create" those workflows in
+    // the fork, which GitHub refuses for a token without the `workflow` scope (the default gh sign-in has none). A branch
+    // made on the fork adds only the submission, and the pull request's diff against upstream is still just that.
+    cloneWithRetry(exec, forkUrl, repoDir, { waitMs: cloneWait });
     const g = (...a) => exec('git', ['-C', repoDir, ...a]);
     const branch = `submit/${slug(pkg.files.meta.skill)}-${pkg.files.meta.submission.host.id}-${pkg.path[2].split('-')[0].toLowerCase()}`;
     g('checkout', '-b', branch);
@@ -115,8 +136,7 @@ export function openPullRequest({ pkgDir, pkg, gh, exec = defaultExec, say: out
     const ident = ['-c', `user.name=${gh.user}`, '-c', `user.email=${gh.id}+${gh.user}@users.noreply.github.com`];
     g(...ident, 'commit', '-q', '-F', msg);
     out(t('submitPushing'));
-    g('remote', 'add', 'fork', `https://github.com/${gh.user}/${UPSTREAM.split('/')[1]}.git`);
-    g('-c', 'credential.helper=', '-c', 'credential.https://github.com.helper=!gh auth git-credential', 'push', '-q', 'fork', branch);
+    g('-c', 'credential.helper=', '-c', 'credential.https://github.com.helper=!gh auth git-credential', 'push', '-q', 'origin', branch);
     out(t('submitOpening'));
     const body = path.join(work, 'body.md');
     fs.writeFileSync(body, prBody(pkg));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillgauntlet",
-  "version": "1.3.7",
+  "version": "1.3.8",
   "description": "Check an agent skill before you install it: context cost, permission surface, code risk, instruction hijacking, description quality, trigger rate and gain.",
   "type": "module",
   "bin": {