cicd: Scaffold community skills repo

.agents/plugins/marketplace.json

@@ -0,0 +1,20 @@
+{
+  "name": "community-skills",
+  "interface": {
+    "displayName": "Community Skills"
+  },
+  "plugins": [
+    {
+      "name": "community-skills",
+      "source": {
+        "source": "url",
+        "url": "https://github.com/ForgeUtah/Skills.git"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_INSTALL"
+      },
+      "category": "Developer Tools"
+    }
+  ]
+}

.claude-plugin/marketplace.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://code.claude.com/schemas/marketplace.json",
+  "name": "community-skills",
+  "owner": {
+    "name": "Community Skills Contributors",
+    "url": "https://github.com/ForgeUtah/Skills"
+  },
+  "plugins": [
+    {
+      "name": "community-skills",
+      "source": "./",
+      "description": "Community-contributed Agent Skills across categories: DevOps, design, databases, tools, and general skills."
+    }
+  ]
+}

.claude-plugin/plugin.json

@@ -0,0 +1,8 @@
+{
+  "name": "community-skills",
+  "description": "Community-contributed Agent Skills across categories: DevOps, design, databases, tools, and general skills.",
+  "version": "0.1.0",
+  "author": {
+    "name": "Community Skills Contributors"
+  }
+}

.codex-plugin/plugin.json

@@ -0,0 +1,6 @@
+{
+  "name": "community-skills",
+  "version": "0.1.0",
+  "description": "Community-contributed Agent Skills across categories: DevOps, design, databases, tools, and general skills.",
+  "skills": "./skills/"
+}

.cursor-plugin/marketplace.json

@@ -0,0 +1,13 @@
+{
+  "name": "community-skills",
+  "owner": {
+    "name": "Community Skills Contributors"
+  },
+  "plugins": [
+    {
+      "name": "community-skills",
+      "source": "./",
+      "description": "Community-contributed Agent Skills across categories: DevOps, design, databases, tools, and general skills."
+    }
+  ]
+}

.cursor-plugin/plugin.json

@@ -0,0 +1,13 @@
+{
+  "name": "community-skills",
+  "version": "0.1.0",
+  "description": "Community-contributed Agent Skills across categories: DevOps, design, databases, tools, and general skills.",
+  "author": {
+    "name": "Community Skills Contributors"
+  },
+  "homepage": "https://github.com/ForgeUtah/Skills",
+  "repository": "https://github.com/ForgeUtah/Skills",
+  "license": "MIT",
+  "keywords": ["community-skills", "devops", "design", "database", "tools", "agents", "skills"],
+  "skills": "./skills/"
+}

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10

.github/workflows/ci.yml

@@ -0,0 +1,37 @@
+name: CI
+on:
+  pull_request: {}
+  push:
+    branches: [main]
+  workflow_dispatch: {}
+
+concurrency:
+  group: ci-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: verify-skills-repo
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 1
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Lint skill frontmatter and required sections
+        run: node scripts/verify-skills.mjs
+      - name: Validate plugin manifests against their schema shape
+        run: node scripts/verify-manifests.mjs
+      - name: Validate portable skill eval fixtures
+        run: node scripts/verify-evals.mjs
+      - name: Fail on internal markdown links to missing files
+        run: node scripts/check-internal-links.mjs
+      - name: Lint markdown files
+        run: npx --yes markdownlint-cli2 --config .markdownlint.jsonc "**/*.md" "!node_modules"
+      - name: Lint JavaScript scripts
+        run: npx oxlint@latest scripts/

.gitignore

@@ -0,0 +1,4 @@
+node_modules/
+coverage/
+*.log
+.DS_Store

.markdownlint.jsonc

@@ -0,0 +1,7 @@
+{
+  "default": true,
+  "MD013": false,
+  "MD033": false,
+  "MD041": false,
+  "MD060": false
+}

CODEOWNERS

@@ -0,0 +1,3 @@
+# Every change requires review from a code owner before it can merge to main.
+# main is protected: no direct pushes, PRs only.
+* @Soypete @clintberry

CONTRIBUTING.md

@@ -0,0 +1,50 @@
+# Contributing
+
+Thank you for contributing a skill to the community repo!
+
+## Ground rules
+
+- **Skills document existing behavior.** If a skill names a command, endpoint,
+  flag, or type that does not exist, the code wins. Update the skill.
+- **Prefer retrieval over pre-training.** Point agents at the authoritative
+  source (docs, READMEs, code) rather than duplicating details that can drift.
+- **No absolute local paths.** This repo is public. Never reference a personal
+  or machine-specific path. Use repo-relative paths and product names only.
+- **No screenshots.** Reference a live resource instead.
+- **Every skill carries two sections** in its `SKILL.md`:
+  `## Validation commands` (how a user verifies the guidance) and
+  `## Realistic usage boundaries` (what the skill does not cover).
+- **Every skill needs eval cases** in `evals/evals.json` — at least two
+  prompt-only, portable cases with expectations.
+
+## Adding or changing a skill
+
+1. Read the source of truth for the subject matter. Verify every command,
+   endpoint, and flag against the code.
+2. Place your skill in the right category under `skills/`:
+   - `skills/skills/` — meta-skills, skill development
+   - `skills/devops/` — CI/CD, infrastructure, deployment
+   - `skills/design/` — UI/UX, design systems, frontend
+   - `skills/db/` — SQL, NoSQL, data modeling
+   - `skills/tools/` — general-purpose development tools
+   - If none of these fit, add a new top-level directory under `skills/`.
+3. Create `SKILL.md` with `name` (lowercase-hyphen, matching folder name) and
+   `description` frontmatter. Keep it roughly 130-340 lines.
+4. Add at least two portable eval cases in `evals/evals.json`.
+5. Add a row to the Skills table in `README.md`.
+6. Run the verification suite before committing:
+
+   ```bash
+   node scripts/verify-skills.mjs
+   node scripts/verify-manifests.mjs
+   node scripts/check-internal-links.mjs
+   node scripts/verify-evals.mjs
+   ```
+
+## Licensing
+
+This repository is **MIT** licensed. Do not add third-party code or content
+that is not MIT-compatible.
+
+`main` is protected — no direct pushes. Every change lands through a pull
+request approved by a code owner (see `CODEOWNERS`).

GO-PUBLIC.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Flip the community skills repo to public and lock main down.
+#
+# Run this when you and Clint have reviewed the repo on GitHub and are happy
+# for it to be public.
+set -euo pipefail
+
+REPO=ForgeUtah/Skills
+
+echo "==> 1/3  Making $REPO public"
+gh repo edit "$REPO" --visibility public --accept-visibility-change-consequences
+
+echo "==> 2/3  Protecting main (no direct pushes, PR + code owner review)"
+gh api -X PUT "repos/$REPO/branches/main/protection" --input - <<'JSON'
+{
+  "required_status_checks": null,
+  "enforce_admins": false,
+  "required_pull_request_reviews": {
+    "required_approving_review_count": 1,
+    "require_code_owner_reviews": true,
+    "dismiss_stale_reviews": true
+  },
+  "restrictions": null,
+  "allow_force_pushes": false,
+  "allow_deletions": false
+}
+JSON
+
+echo "==> 3/3  Verifying"
+gh repo view "$REPO" --json visibility,licenseInfo \
+  --jq '"visibility: \(.visibility)   licence: \(.licenseInfo.name)"'
+gh api "repos/$REPO/branches/main/protection" \
+  --jq '"code owner review required: \(.required_pull_request_reviews.require_code_owner_reviews)   force pushes: \(.allow_force_pushes.enabled)"'
+
+echo
+echo "Done. main now requires a PR approved by @Soypete or @clintberry."

README.md

@@ -1,2 +1,132 @@
 # Skills
-Community built skills
+
+Community built skills. See [CONTRIBUTING.md](CONTRIBUTING.md) and the
+category directories under [`skills/`](skills/) to get started.
+
+A collection of [Agent Skills](https://github.com/agentskills/agentskills) contributed by the
+community. These skills are portable across Claude Code, Cursor, opencode, Pi,
+and Codex — write once, use in any coding agent that supports the Agent Skills
+format.
+
+Skills are organized by category:
+
+| Category | Directory | What you'll find |
+|----------|-----------|------------------|
+| Skills | [`skills/skills/`](skills/skills/) | Meta-skills, skill development, and agent skill tooling |
+| DevOps | [`skills/devops/`](skills/devops/) | CI/CD, infrastructure, deployment, platform tooling |
+| Design | [`skills/design/`](skills/design/) | UI/UX, design systems, frontend architecture |
+| Databases | [`skills/db/`](skills/db/) | SQL, NoSQL, data modeling, migrations |
+| Tools | [`skills/tools/`](skills/tools/) | General-purpose development tools and utilities |
+
+## Installing
+
+### Copyable setup prompt
+
+Paste this prompt into the coding agent you want to configure:
+
+```text
+Install the Community Skills from https://github.com/ForgeUtah/Skills.git.
+First inspect which harness you are running (Claude Code, Cursor, OpenCode,
+Pi, or Codex) and its documented user/project skill directory. Clone the
+repository to a temporary directory, review the skills/ folders, then copy or
+symlink each folder containing SKILL.md into that harness's skill directory.
+Preserve existing skills, do not overwrite a same-named skill without asking,
+and do not copy .git metadata. After installation, verify that all SKILL.md
+files have name and description frontmatter and report the destination and
+the installed skill names. Do not print secrets or modify project files
+outside the selected skill directory.
+```
+
+### Claude Code
+
+Install from the plugin marketplace:
+
+```text
+/plugin marketplace add ForgeUtah/Skills
+/plugin install community-skills@community-skills
+```
+
+### Codex
+
+```text
+codex plugin marketplace add ForgeUtah/Skills
+codex plugin add community-skills@community-skills
+```
+
+### opencode
+
+Clone this repo and symlink or copy the skill folders into
+`~/.config/opencode/skills/` (or the project's `.opencode/skills/`).
+
+### Pi
+
+Pi loads the same Agent Skills directories. Clone this repo and either add
+the repository's `skills/` directory to `~/.pi/agent/skills/`, or configure
+the clone in Pi's settings:
+
+```json
+{
+  "skills": ["/path/to/community-skills/skills"]
+}
+```
+
+For a project-local install, use `.pi/skills/` or configure the repository's
+`skills/` directory in `.pi/settings.json`. Pi also discovers the skills
+through `~/.agents/skills/` and project `.agents/skills/` directories.
+
+### Cursor
+
+Add via **Settings > Rules > Add Rule > Remote Rule (GitHub)** with
+`ForgeUtah/Skills`, or copy the skill folders into `~/.cursor/skills/`.
+
+### Clone / Copy
+
+Clone this repo and copy the skill folders into the appropriate directory for
+your agent:
+
+| Agent | Skill Directory | Docs |
+|-------|-----------------|------|
+| Claude Code | `~/.claude/skills/` | [docs](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview) |
+| Cursor | `~/.cursor/skills/` | [docs](https://cursor.com/docs/context/skills) |
+| opencode | `~/.config/opencode/skills/` | [docs](https://opencode.ai/docs/skills/) |
+| Pi | `~/.pi/agent/skills/` or `~/.agents/skills/` | [docs](https://pi.dev/docs/latest/skills) |
+| Codex | `~/.codex/skills/` | [docs](https://developers.openai.com/codex/skills/) |
+
+## Contributing a skill
+
+See [CONTRIBUTING.md](CONTRIBUTING.md). I use the
+[OpenAI Skill Creator](https://developers.openai.com/plugins/build/skills) to
+scaffold new skills — it generates the correct frontmatter, sections, and eval
+fixtures. Short version:
+
+1. Skills document existing behavior — they never invent APIs.
+2. Place your skill in the matching category under `skills/`.
+3. Every skill needs a `SKILL.md` with `name` and `description` frontmatter.
+4. Add at least two eval cases in `evals/evals.json`.
+5. Run the verification suite before opening a PR.
+6. If no existing category fits, add a new top-level directory under `skills/`.
+
+## What makes a good skill
+
+- **Focused scope** — one skill should cover one product, tool, or domain.
+- **Retrieval-first** — point agents at authoritative docs rather than
+  duplicating details that can drift.
+- **No absolute paths** — reference repos by product name and relative paths.
+- **Portable** — work in any harness that supports Agent Skills.
+- **Tested** — each skill carries eval cases so contributors can validate changes.
+
+## Validation
+
+The suite is self-checking and enforced by CI (`.github/workflows/ci.yml`)
+on every pull request and push to `main`. Run before opening a PR:
+
+```bash
+node scripts/verify-skills.mjs          # frontmatter, name=dir, required sections
+node scripts/verify-manifests.mjs       # every plugin manifest parses as JSON
+node scripts/check-internal-links.mjs   # every internal markdown link resolves
+node scripts/verify-evals.mjs           # every skill has eval cases
+```
+
+## License
+
+MIT. See [LICENSE](LICENSE).

SECURITY.md

@@ -0,0 +1,13 @@
+# Security policy
+
+Do not report security issues in public issues. Until a dedicated security
+contact is configured, contact the repository owners privately through GitHub:
+`@Soypete` or `@colinso`.
+
+Do not include secrets, access tokens, private endpoints, personal data, or
+production identifiers in reports or pull requests.
+
+Skills must fail closed when they encounter missing authorization, ambiguous
+scope, malformed tool input, or unavailable dependencies. They must not direct
+an agent to bypass access controls, expose credentials, or persist raw private
+content.