Ship staged skill release - #166
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Restore the template to the governed path
This moves skill-sections-template.json into references/templates/, while the repository control file still mandates skills/ceratops-skill-lifecycle/scripts/templates/skill-sections-template.json as its exact location. The resulting tree violates a blocking repository invariant; either retain the template at the governed path or update the governing instruction as part of the same change.
AGENTS.md reference: AGENTS.md:L51-L55
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| shutil.copytree( | ||
| source, | ||
| destination, | ||
| ignore=shutil.ignore_patterns(*IGNORED_NAMES), | ||
| dirs_exist_ok=True, |
There was a problem hiding this comment.
When a declared payload is a directory containing a symlink, only the directory itself is checked before copytree follows the nested link and copies its target as a regular file. A compatible repository can therefore make bootstrap copy arbitrary files outside repo_root into an installed skill, and the later staged-tree validation cannot detect the escape because the link has already been dereferenced. Walk and reject links/reparse points throughout the payload tree before copying, as the managed runtime builder does.
Useful? React with 👍 / 👎.
| deploy_path = repo_root / DEPLOY_RELATIVE | ||
| deploy_path.parent.mkdir(parents=True, exist_ok=True) | ||
| deploy_path.write_text( |
There was a problem hiding this comment.
If the target worktree contains deploy as a symlink to an external directory and deploy.yml is absent, the leaf-only snapshot check accepts it and this write follows the parent link, creating or overwriting deploy.yml outside the selected worktree. Validate that every mutable target and its existing ancestors resolve beneath repo_root before applying or rolling back materialization.
AGENTS.md reference: AGENTS.md:L20-L25
Useful? React with 👍 / 👎.
| _collect_declared_pytest_nodes(repo_root, checks) | ||
| dirty = sorted(_dirty_paths(repo_root)) | ||
| baseline_dirty = {path: _snapshot(repo_root, path) for path in dirty} |
There was a problem hiding this comment.
For a declared test whose module import or pytest collection hook modifies a tracked file, --collect-only performs that mutation before _dirty_paths and the target snapshots are recorded. The helper consequently classifies collection-created changes as pre-existing state and preserves them through verification, defeating its promise to record the caller's original baseline. Snapshot first and reject any repository delta caused by collection.
Useful? React with 👍 / 👎.
1 participant
Staged skill lifecycle release branch.