-
Notifications
You must be signed in to change notification settings - Fork 2
feat: Handle skills as resources #31
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -6,13 +6,17 @@ on: | |
| - main | ||
| paths: | ||
| - ".github/workflows/check_mcp_server.yml" | ||
| - "catalog/**" | ||
| - "mcp-server/**" | ||
| - "skills/**" | ||
| pull_request: | ||
| branches: | ||
| - main | ||
| paths: | ||
| - ".github/workflows/check_mcp_server.yml" | ||
| - "catalog/**" | ||
| - "mcp-server/**" | ||
| - "skills/**" | ||
|
|
||
| jobs: | ||
| lint: | ||
|
|
@@ -24,5 +28,14 @@ jobs: | |
| - name: Checkout | ||
| uses: actions/checkout@v3 | ||
|
|
||
| - name: Set up Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: '22' | ||
|
Comment on lines
+31
to
+34
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
# Locate and display the relevant workflow section
ls -la .github/workflows/check_mcp_server.yml
nl -ba .github/workflows/check_mcp_server.yml | sed -n '1,120p'
# Search for other uses of actions/setup-node in the repo (pinning patterns)
rg -n "uses:\s*actions/setup-node@" -S .github/workflows || true
rg -n "zizmor|unpinned|pin(ed)? action" -S .github/workflows .github || trueRepository: txpipe/metis Length of output: 204 🏁 Script executed: #!/bin/bash
set -euo pipefail
file=".github/workflows/check_mcp_server.yml"
echo "== Workflow file =="
# Show first ~120 lines with line numbers (no nl dependency)
awk '{printf "%5d %s\n", NR, $0}' "$file" | sed -n '1,140p'
echo "== Search for actions/setup-node usage =="
rg -n "uses:\s*actions/setup-node@" .github/workflows || true
rg -n "uses:\s*actions/" .github/workflows | head -n 200 || true
echo "== Search for unpinned/mutable action references patterns =="
rg -n "uses:\s*[^@]+@[vV]([0-9]+|\w+)" .github/workflows .github || true
rg -n "zizmor|unpinned|pin(ed)? action" .github/workflows .github || trueRepository: txpipe/metis Length of output: 8394 Pin
Suggested fix- - name: Set up Node.js
- uses: actions/setup-node@v4
+ - name: Set up Node.js
+ uses: actions/setup-node@<full_commit_sha>
with:
node-version: '22'🧰 Tools🪛 zizmor (1.25.2)[error] 32-32: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI Agents |
||
|
|
||
| - name: Generate skill catalog | ||
| working-directory: . | ||
| run: node catalog/scripts/generate-skill-catalog.mjs | ||
|
|
||
| - name: Clippy check lints | ||
| run: cargo clippy -- -D warnings | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -6,13 +6,17 @@ on: | |
| - main | ||
| paths: | ||
| - ".github/workflows/test_mcp_server.yml" | ||
| - "catalog/**" | ||
| - "mcp-server/**" | ||
| - "skills/**" | ||
| pull_request: | ||
| branches: | ||
| - main | ||
| paths: | ||
| - ".github/workflows/test_mcp_server.yml" | ||
| - "catalog/**" | ||
| - "mcp-server/**" | ||
| - "skills/**" | ||
|
|
||
| jobs: | ||
| lint: | ||
|
|
@@ -24,5 +28,14 @@ jobs: | |
| - name: Checkout | ||
| uses: actions/checkout@v3 | ||
|
|
||
| - name: Set up Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: '22' | ||
|
Comment on lines
+31
to
+34
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
rg -nP 'uses:\s*[^@\s]+/[^@\s]+@(?![0-9a-f]{40}\b)' .github/workflowsRepository: txpipe/metis Length of output: 2792 Pin
🧰 Tools🪛 zizmor (1.25.2)[error] 32-32: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI Agents |
||
|
|
||
| - name: Generate skill catalog | ||
| working-directory: . | ||
| run: node catalog/scripts/generate-skill-catalog.mjs | ||
|
|
||
| - name: Test | ||
| run: cargo test | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| import { readFileSync, writeFileSync } from "node:fs"; | ||
| import { dirname, resolve } from "node:path"; | ||
| import { fileURLToPath } from "node:url"; | ||
|
|
||
| const scriptDir = dirname(fileURLToPath(import.meta.url)); | ||
| const catalogDir = resolve(scriptDir, ".."); | ||
| const manifestPath = resolve(catalogDir, "skill-catalog.manifest.json"); | ||
| const outputPath = resolve(catalogDir, "skill-catalog.json"); | ||
|
|
||
| const manifest = JSON.parse(readFileSync(manifestPath, "utf8")); | ||
|
|
||
| if (manifest.schemaVersion !== "supernode.skillCatalogManifest/v1") { | ||
| throw new Error( | ||
| `unsupported skill catalog manifest schema: ${manifest.schemaVersion}`, | ||
| ); | ||
| } | ||
|
|
||
| const seen = new Set(); | ||
| const skills = manifest.skills.map(({ contentPath, ...skill }) => { | ||
| if (!skill.id || seen.has(skill.id)) { | ||
| throw new Error(`invalid or duplicate skill id: ${skill.id}`); | ||
| } | ||
| seen.add(skill.id); | ||
|
|
||
| if (!contentPath) { | ||
| throw new Error(`missing contentPath for skill: ${skill.id}`); | ||
| } | ||
|
|
||
| return { | ||
| ...skill, | ||
| content: readFileSync(resolve(catalogDir, contentPath), "utf8"), | ||
| }; | ||
| }); | ||
|
|
||
| const catalog = { | ||
| schemaVersion: "supernode.skillCatalog/v1", | ||
| skills, | ||
| }; | ||
|
|
||
| writeFileSync(outputPath, `${JSON.stringify(catalog, null, 2)}\n`); |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| #!/usr/bin/env bash | ||
| set -euo pipefail | ||
|
|
||
| ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" | ||
| REGISTRY="${REGISTRY:-oci.supernode.store}" | ||
| CATALOG_TAG="${CATALOG_TAG:-0.1.0}" | ||
|
|
||
| node "${ROOT_DIR}/catalog/scripts/generate-skill-catalog.mjs" | ||
|
|
||
| oras push \ | ||
| "${REGISTRY}/extension-catalog:${CATALOG_TAG}" \ | ||
| "${ROOT_DIR}/catalog/extension-catalog.json:application/vnd.supernode.extension-catalog.v1+json" | ||
|
|
||
| oras push \ | ||
| "${REGISTRY}/skill-catalog:${CATALOG_TAG}" \ | ||
| "${ROOT_DIR}/catalog/skill-catalog.json:application/vnd.supernode.skill-catalog.v1+json" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: txpipe/metis
Length of output: 2413
Pin
actions/setup-nodeto a commit SHA (avoid@v4tags)..github/workflows/build_mcp_server.ymlusesactions/setup-node@v4at line 48, which weakens supply-chain guarantees under strict CI policies.🔧 Suggested hardening
🧰 Tools
🪛 zizmor (1.25.2)
[error] 48-48: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents