Addressing PR comments - #100
Conversation
There was a problem hiding this comment.
Pull request overview
Updates the agent-skill documentation to correctly record the upstream skill-lib commit SHA used when vendoring the manifest/ skill, preventing future maintainers from chasing an incorrect upstream reference.
Changes:
- Updated the documented vendored-from SHA for
manifest/from546b45btod6e4d78in.agents/skills/README.md.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 38b9ee6460
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - `meta-module-build/` — metadata-first module scaffolding | ||
| - `manifest/` — living-spec generator for `CLAUDE.md` (vendored from | ||
| `The-Interdependency/skill-lib@546b45b`). Generates the mechanical facts | ||
| `The-Interdependency/skill-lib@d6e4d78`). Generates the mechanical facts |
There was a problem hiding this comment.
This points the manifest skill provenance at an earlier re-vendor commit, but the merge commit that introduced the skill has a later ci(manifest) step that says the checksum is identical to skill-lib@546b45b and that it bumped the source ref. Since manifest/SKILL.md tells reviewers to verify generate.py.sha256 against the recorded SHA, recording d6e4d78 sends future updates/audits to the wrong upstream version and reintroduces the provenance mismatch this README entry was meant to prevent.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Summary
- Restored the
manifest/skill provenance entry to the final vendoring SHA,The-Interdependency/skill-lib@546b45b, addressing the review feedback thatd6e4d78pointed at the earlier re-vendor source rather than the later recorded source ref. - Committed the fix as
4ab2e48(fix(docs): restore manifest vendoring SHA) and created a follow-up PR.
Testing
- ✅
cd .agents/skills/manifest && sha256sum -c generate.py.sha256 - ✅
python .agents/skills/manifest/generate.py --pyproject backend/pyproject.toml --check - ✅
git diff --check
Codex
AI
changed the title
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 158af8d86b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - `meta-module-build/` — metadata-first module scaffolding | ||
| - `manifest/` — living-spec generator for `CLAUDE.md` (vendored from | ||
| `The-Interdependency/skill-lib@546b45b`). Generates the mechanical facts | ||
| `The-Interdependency/skill-lib@d6e4d78`). Generates the mechanical facts |
There was a problem hiding this comment.
The merge commit that introduced this skill first mentions d6e4d78, but its final ci(manifest) step says the pinned checksum is identical to skill-lib@546b45b and the README introduced by that merge recorded 546b45b. Since manifest/SKILL.md tells maintainers to verify the vendored generate.py.sha256 against the recorded source SHA, changing this line to the earlier re-vendor commit sends future audits to the wrong upstream artifact.
Useful? React with 👍 / 👎.
No description provided.