* chore: remove cargo-dist, use native fetch for npm installer
* fix: harden npm scripts — spawnSync, signal handling, binary-exists check
* fix: address PR review comments
- Add null body guard for fetch response
- Fix PowerShell Expand-Archive path quoting vulnerability
- Sanitize error output to prevent ANSI escape injection
- Add proxy support limitation note
- Fix upgrade bug: use .version marker so npm update downloads new binary
- Downgrade changeset from minor to patch (chore, not feature)
- Update AGENTS.md: remove stale cargo-dist reference from labels
* fix: use flat archives for consistent tar/zip extraction
Both tar.gz and zip archives now contain files at root (no nested
directory). Removes --strip-components 1 from install.js since it is
no longer needed. This makes extraction consistent across platforms.
---------
Co-authored-by: jpoehnelt-bot <jpoehnelt-bot@users.noreply.github.com>
The Lint Skills job uses uvx to run agentskills validate, but uv
is not pre-installed on GitHub Actions runners. Add astral-sh/setup-uv
action and a skills path filter to the changes detection.
Split x86_64-unknown-linux-gnu out of the build matrix into a dedicated
build-linux job. The smoketest now depends only on build-linux, running
as soon as that single build completes. The remaining cross-platform
builds (macOS, Windows, aarch64-linux) depend on the smoketest, so they
are skipped entirely if the smoketest fails — saving CI minutes.
Co-authored-by: jpoehnelt-bot <jpoehnelt-bot@users.noreply.github.com>
Previously, get_or_create_key() unconditionally wrote the encryption key
to ~/.config/gws/.encryption_key on first run, even when the OS keyring
was available. This left the key material on disk as a plain file,
making credentials portable by copying the config directory.
Changes:
- Extract save_key_file() helper to deduplicate file-writing logic
- On keyring read success: delete stale .encryption_key (migration)
- On NoEntry + existing file: migrate key into keyring, then delete file
- On NoEntry + new key: try keyring first, only write file as fallback
Fixes#344
Co-authored-by: jpoehnelt-bot <jpoehnelt-bot@users.noreply.github.com>
When actions were SHA-pinned in #341, the tool name was lost. The
original uses: taiki-e/install-action@cargo-llvm-cov passed the tool
name as the tag. After pinning to a SHA, the tool input must be
specified explicitly via with: tool: cargo-llvm-cov.
Co-authored-by: jpoehnelt-bot <jpoehnelt-bot@users.noreply.github.com>
Remove RUSTC_WRAPPER from global env and set it per-job only after the
sccache-action succeeds. When GitHub's cache API is unavailable, CI now
falls through to a plain (uncached) cargo build instead of failing.
Co-authored-by: jpoehnelt-bot <jpoehnelt-bot@users.noreply.github.com>
- Add dorny/paths-filter to detect .rs, Cargo.toml/Lock, flake.nix/lock changes
- Gate test, lint, nix, skills, and build jobs behind change detection
- Remove duplicate coverage job (already in coverage.yml with Codecov upload)
- Main pushes always run all jobs unconditionally
Co-authored-by: jpoehnelt-bot <jpoehnelt-bot@users.noreply.github.com>
* feat: Implement hourly cron and manual trigger for the generate-skills workflow to auto-sync skills via pull requests and downgrade CI drift check to a warning.
* chore: regenerate skills [skip ci]
---------
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
clawhub CLI requires explicit `clawhub login --token` call rather
than reading the CLAWHUB_TOKEN env var directly. Split the publish
step into separate authenticate and sync steps.
Justin Poehnelt