skills-layer 0.1.7 → 0.1.8

package/.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

package/.github/workflows/ci.yml

@@ -0,0 +1,22 @@
+name: CLI package CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          package-manager-cache: false
+      - run: npm run typecheck
+      - run: npm run test:coverage

package/.github/workflows/publish.yml

@@ -0,0 +1,24 @@
+name: Publish skills-layer to npm
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+          package-manager-cache: false
+      - run: npm run typecheck
+      - run: npm run test:coverage
+      - run: npm publish --access public --provenance

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,18 @@
+# Code Of Conduct
+
+We want Skills Layer CLI to be a respectful, practical, and welcoming project for users and contributors.
+
+## Expected Behavior
+
+- Be respectful and constructive.
+- Assume good intent while being precise about risks and tradeoffs.
+- Keep security reports private until they are resolved or responsibly disclosed.
+- Avoid harassment, insults, discrimination, or repeated disruptive behavior.
+
+## Scope
+
+This applies to repository issues, pull requests, discussions, and related project communication.
+
+## Enforcement
+
+Maintainers may edit, hide, or remove content and may restrict participation when behavior harms users, contributors, or project safety.

package/CONTRIBUTING.md

@@ -0,0 +1,24 @@
+# Contributing
+
+Thanks for helping improve Skills Layer CLI.
+
+This public repository is intentionally limited to the CLI, MCP setup, local agent integration, packaging, docs, and package-level tests. Do not submit backend service code, Cloud admin tooling, Guardian scoring internals, credentials, or private release material here.
+
+## Local Checks
+
+Run these from the repository root before opening a pull request:
+
+```bash
+npm run typecheck
+npm run test:coverage
+```
+
+The package has no runtime dependencies and no npm lifecycle scripts. Please keep it that way unless a public CLI feature has a clear need.
+
+## Pull Request Checklist
+
+- Keep user-facing CLI output readable and agent-friendly.
+- Preserve predictable `--json` behavior for agent workflows.
+- Avoid leaking internal service details or private operational commands.
+- Update README/help text when behavior changes.
+- Add focused tests for changed behavior.

package/SECURITY.md

@@ -0,0 +1,18 @@
+# Security Policy
+
+This repository contains the open-source Skills Layer CLI and local integration surface only. Skills Layer Cloud, marketplace services, Guardian scoring internals, and hosted backend code are not part of this repository.
+
+## Reporting A Vulnerability
+
+Please do not open public issues for active vulnerabilities.
+
+Use GitHub private vulnerability reporting for this repository when available, or email `hello@skills-layer.com` with a short non-sensitive summary and a way to contact you securely.
+
+Include:
+
+- affected package version
+- operating system and Node.js version
+- steps to reproduce
+- impact and any suggested mitigation
+
+We prioritize issues that could expose credentials, bypass Guardian checks, corrupt local installs, or mislead users about the source of a package.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skills-layer",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "private": false,
   "type": "module",
   "description": "Open-source CLI and local agent integration layer for Skills Layer Cloud.",
@@ -18,6 +18,11 @@
     "skills-layer": "bin/skills-layer.js"
   },
   "files": [
+    "CODE_OF_CONDUCT.md",
+    "CONTRIBUTING.md",
+    "SECURITY.md",
+    ".github/dependabot.yml",
+    ".github/workflows/*.yml",
     "bin/skills-layer.js",
     "public/skills-layer-public.mjs",
     "scripts/skills-layer.mjs",