From 45b8513a19fb2bfa0faca483c0490635999b3933 Mon Sep 17 00:00:00 2001 From: Michael Magan Date: Sun, 23 Aug 2026 09:53:58 -0700 Subject: [PATCH 1/6] Add ClawHub publish workflow Keeps the clawhub.ai charming-cli skill listing in sync with skills/charming-cli/SKILL.md using ClawHub's own reusable skill-publish workflow. Dry-runs on PRs touching skills/**, publishes for real on GitHub Release. --- .github/workflows/clawhub-publish.yml | 41 +++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 .github/workflows/clawhub-publish.yml diff --git a/.github/workflows/clawhub-publish.yml b/.github/workflows/clawhub-publish.yml new file mode 100644 index 0000000..1abe04b --- /dev/null +++ b/.github/workflows/clawhub-publish.yml @@ -0,0 +1,41 @@ +name: ClawHub publish + +# Keeps clawhub.ai's charming-cli skill listing pointed at the version in +# skills/charming-cli/SKILL.md. Uses ClawHub's own reusable workflow +# (openclaw/clawhub/.github/workflows/skill-publish.yml), which fingerprints +# the skill folder and no-ops when content is unchanged — safe to run on +# every release even if the skill itself didn't change. +# +# Skills have no OIDC/trusted-publisher option yet (the reusable workflow +# errors on a real publish without a token), so this uses CLAWHUB_TOKEN, +# a token from `clawhub login` + `clawhub token`, scoped to the tambo-labs +# publisher. + +on: + pull_request: + branches: [main] + paths: + - skills/** + release: + types: [published] + workflow_dispatch: + +permissions: + contents: read + +jobs: + dry-run: + if: github.event_name == 'pull_request' + uses: openclaw/clawhub/.github/workflows/skill-publish.yml@87ca030c30f3cfb78ab15c8e66b5ff1469c8f9c8 # v0.23.3 + with: + owner: tambo-labs + dry_run: true + + publish: + if: github.event_name != 'pull_request' + uses: openclaw/clawhub/.github/workflows/skill-publish.yml@87ca030c30f3cfb78ab15c8e66b5ff1469c8f9c8 # v0.23.3 + with: + owner: tambo-labs + dry_run: false + secrets: + clawhub_token: ${{ secrets.CLAWHUB_TOKEN }} From 9d980df813538806995a5883a6e7d4f18a583318 Mon Sep 17 00:00:00 2001 From: Michael Magan Date: Sun, 23 Aug 2026 09:56:50 -0700 Subject: [PATCH 2/6] Declare npm install for the charming binary in the ClawHub skill metadata.openclaw.requires.bins only checks presence; it never installed anything. Adds an install entry so OpenClaw can install the CLI via npm when it's missing. --- skills/charming-cli/SKILL.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/skills/charming-cli/SKILL.md b/skills/charming-cli/SKILL.md index 452a8ab..a074a40 100644 --- a/skills/charming-cli/SKILL.md +++ b/skills/charming-cli/SKILL.md @@ -8,6 +8,11 @@ metadata: requires: bins: - charming + install: + - kind: node + package: usecharming + bins: + - charming --- # Charming CLI From f3558c9ebbdfd1df2c673f58a418fa4362bee312 Mon Sep 17 00:00:00 2001 From: Michael Magan Date: Sun, 23 Aug 2026 09:58:33 -0700 Subject: [PATCH 3/6] Grant id-token: write so the ClawHub reusable workflow can start Reusable-workflow job permissions can't exceed what the caller grants; skill-publish.yml requests id-token: write for its own source-verification step, which the caller wasn't providing. --- .github/workflows/clawhub-publish.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/clawhub-publish.yml b/.github/workflows/clawhub-publish.yml index 1abe04b..0cd9cda 100644 --- a/.github/workflows/clawhub-publish.yml +++ b/.github/workflows/clawhub-publish.yml @@ -10,6 +10,11 @@ name: ClawHub publish # errors on a real publish without a token), so this uses CLAWHUB_TOKEN, # a token from `clawhub login` + `clawhub token`, scoped to the tambo-labs # publisher. +# +# id-token: write is required even though ClawHub itself doesn't use OIDC: +# the reusable workflow verifies its own source via GitHub OIDC claims +# before running, and a reusable-workflow job's permissions can't exceed +# what the caller grants. on: pull_request: @@ -22,6 +27,7 @@ on: permissions: contents: read + id-token: write jobs: dry-run: From 44ff85b5d211b37cafdb2d34b2d3be2cdea24319 Mon Sep 17 00:00:00 2001 From: Michael Magan Date: Sun, 23 Aug 2026 10:01:53 -0700 Subject: [PATCH 4/6] Call the clawhub CLI directly instead of ClawHub's reusable workflow Org policy requires every action pinned to a full commit SHA. ClawHub's own skill-publish.yml reusable workflow references actions/checkout and actions/upload-artifact by tag internally, which fails that check and blocks the run before any job starts. Hand-rolling the checkout/setup steps (already SHA-pinned, matching this repo's other workflows) and calling clawhub CLI via npx avoids depending on their workflow's own pinning. --- .github/workflows/clawhub-publish.yml | 53 ++++++++++++++++----------- 1 file changed, 31 insertions(+), 22 deletions(-) diff --git a/.github/workflows/clawhub-publish.yml b/.github/workflows/clawhub-publish.yml index 0cd9cda..61e19b8 100644 --- a/.github/workflows/clawhub-publish.yml +++ b/.github/workflows/clawhub-publish.yml @@ -1,20 +1,20 @@ name: ClawHub publish # Keeps clawhub.ai's charming-cli skill listing pointed at the version in -# skills/charming-cli/SKILL.md. Uses ClawHub's own reusable workflow -# (openclaw/clawhub/.github/workflows/skill-publish.yml), which fingerprints -# the skill folder and no-ops when content is unchanged — safe to run on +# skills/charming-cli/SKILL.md. `clawhub skill sync` fingerprints skill +# folders and only publishes new or changed ones, so it's safe to run on # every release even if the skill itself didn't change. # -# Skills have no OIDC/trusted-publisher option yet (the reusable workflow -# errors on a real publish without a token), so this uses CLAWHUB_TOKEN, -# a token from `clawhub login` + `clawhub token`, scoped to the tambo-labs -# publisher. +# This repo requires every `uses:` action pinned to a full commit SHA +# (org policy: sha_pinning_required). ClawHub's own reusable workflow +# (openclaw/clawhub/.github/workflows/skill-publish.yml) fails that check — +# it calls actions/checkout and actions/upload-artifact by tag internally, +# which we don't control — so this calls the clawhub CLI directly instead +# of using their reusable workflow. # -# id-token: write is required even though ClawHub itself doesn't use OIDC: -# the reusable workflow verifies its own source via GitHub OIDC claims -# before running, and a reusable-workflow job's permissions can't exceed -# what the caller grants. +# Skills have no OIDC/trusted-publisher option yet, so this uses +# CLAWHUB_TOKEN, a token from `clawhub login` + `clawhub token`, scoped to +# the tambo-labs publisher. on: pull_request: @@ -27,21 +27,30 @@ on: permissions: contents: read - id-token: write jobs: dry-run: if: github.event_name == 'pull_request' - uses: openclaw/clawhub/.github/workflows/skill-publish.yml@87ca030c30f3cfb78ab15c8e66b5ff1469c8f9c8 # v0.23.3 - with: - owner: tambo-labs - dry_run: true + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v6.0.0 + with: + node-version: 22 + + - run: npx --yes clawhub@0.23.3 skill sync --root skills --owner tambo-labs --dry-run --json publish: if: github.event_name != 'pull_request' - uses: openclaw/clawhub/.github/workflows/skill-publish.yml@87ca030c30f3cfb78ab15c8e66b5ff1469c8f9c8 # v0.23.3 - with: - owner: tambo-labs - dry_run: false - secrets: - clawhub_token: ${{ secrets.CLAWHUB_TOKEN }} + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v6.0.0 + with: + node-version: 22 + + - run: npx --yes clawhub@0.23.3 skill sync --root skills --owner tambo-labs --all + env: + CLAWHUB_TOKEN: ${{ secrets.CLAWHUB_TOKEN }} From fa003028594e2749ad02100f696ded579fb8159b Mon Sep 17 00:00:00 2001 From: Michael Magan Date: Sun, 23 Aug 2026 10:03:24 -0700 Subject: [PATCH 5/6] Fix command: clawhub sync, not clawhub skill sync sync is a top-level command, not under the skill subcommand group; skill's own subcommands are publish/verify/tag/rename/merge. Default scan already finds skills/charming-cli with no --root override needed, confirmed with a local dry run. --- .github/workflows/clawhub-publish.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/clawhub-publish.yml b/.github/workflows/clawhub-publish.yml index 61e19b8..e19ea40 100644 --- a/.github/workflows/clawhub-publish.yml +++ b/.github/workflows/clawhub-publish.yml @@ -39,7 +39,7 @@ jobs: with: node-version: 22 - - run: npx --yes clawhub@0.23.3 skill sync --root skills --owner tambo-labs --dry-run --json + - run: npx --yes clawhub@0.23.3 sync --owner tambo-labs --dry-run --json publish: if: github.event_name != 'pull_request' @@ -51,6 +51,6 @@ jobs: with: node-version: 22 - - run: npx --yes clawhub@0.23.3 skill sync --root skills --owner tambo-labs --all + - run: npx --yes clawhub@0.23.3 sync --owner tambo-labs --all env: CLAWHUB_TOKEN: ${{ secrets.CLAWHUB_TOKEN }} From 425d95c4d419bc44cb785556f3fb4eee476d8f7d Mon Sep 17 00:00:00 2001 From: Michael Magan Date: Sun, 23 Aug 2026 10:44:04 -0700 Subject: [PATCH 6/6] Rename skill folder and republish under the charming org MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The ClawHub org got created as @charming, not @tambo-labs — the skill was manually published there as slug 'charming'. clawhub sync derives the slug from the folder name, so skills/charming-cli/ is renamed to skills/charming/ (and the SKILL.md name field to match) to keep automated syncs pointed at the same listing instead of creating an orphaned charming-cli one. --- .github/workflows/clawhub-publish.yml | 15 ++++++++------- README.md | 2 +- skills/{charming-cli => charming}/SKILL.md | 2 +- 3 files changed, 10 insertions(+), 9 deletions(-) rename skills/{charming-cli => charming}/SKILL.md (99%) diff --git a/.github/workflows/clawhub-publish.yml b/.github/workflows/clawhub-publish.yml index e19ea40..146e303 100644 --- a/.github/workflows/clawhub-publish.yml +++ b/.github/workflows/clawhub-publish.yml @@ -1,9 +1,10 @@ name: ClawHub publish -# Keeps clawhub.ai's charming-cli skill listing pointed at the version in -# skills/charming-cli/SKILL.md. `clawhub skill sync` fingerprints skill -# folders and only publishes new or changed ones, so it's safe to run on -# every release even if the skill itself didn't change. +# Keeps clawhub.ai's charming skill listing pointed at the version in +# skills/charming/SKILL.md. `clawhub sync` fingerprints skill folders +# (deriving the slug from the folder name) and only publishes new or +# changed ones, so it's safe to run on every release even if the skill +# itself didn't change. # # This repo requires every `uses:` action pinned to a full commit SHA # (org policy: sha_pinning_required). ClawHub's own reusable workflow @@ -14,7 +15,7 @@ name: ClawHub publish # # Skills have no OIDC/trusted-publisher option yet, so this uses # CLAWHUB_TOKEN, a token from `clawhub login` + `clawhub token`, scoped to -# the tambo-labs publisher. +# the charming publisher (clawhub.ai/settings?view=organizations). on: pull_request: @@ -39,7 +40,7 @@ jobs: with: node-version: 22 - - run: npx --yes clawhub@0.23.3 sync --owner tambo-labs --dry-run --json + - run: npx --yes clawhub@0.23.3 sync --owner charming --dry-run --json publish: if: github.event_name != 'pull_request' @@ -51,6 +52,6 @@ jobs: with: node-version: 22 - - run: npx --yes clawhub@0.23.3 sync --owner tambo-labs --all + - run: npx --yes clawhub@0.23.3 sync --owner charming --all env: CLAWHUB_TOKEN: ${{ secrets.CLAWHUB_TOKEN }} diff --git a/README.md b/README.md index f4fe9e8..dc40559 100644 --- a/README.md +++ b/README.md @@ -59,7 +59,7 @@ An hourly GitHub workflow checks the live Charming OpenAPI document. When the co ## Agent skill -The portable skill lives at `skills/charming-cli/SKILL.md`. +The portable skill lives at `skills/charming/SKILL.md`. ## Contributing diff --git a/skills/charming-cli/SKILL.md b/skills/charming/SKILL.md similarity index 99% rename from skills/charming-cli/SKILL.md rename to skills/charming/SKILL.md index a074a40..d27b58b 100644 --- a/skills/charming-cli/SKILL.md +++ b/skills/charming/SKILL.md @@ -1,5 +1,5 @@ --- -name: charming-cli +name: charming description: Build, inspect, update, and call hosted personal apps with the Charming CLI. Use when a user wants to create or manage an interactive personal app hosted by Charming. license: MIT compatibility: Requires the charming CLI, Node.js 22 or newer, and network access to charm.ing.