Repository navigation
fix: 同步上游健康巡检 #213 两轮已审查的市场引用 - #227
Merged
Merged
Conversation
Collections install only their declared children: the client copies each selected child path at the pinned ref. Yet `outdated` compared the whole upstream repository, so CLI sources, end-to-end tests and changesets forced repins. Compare the declared child paths plus root license/notice files instead; undeclared upstream skills are still reported as `new-skill`. A pin kept on purpose after review was reported again every week, so the tracking issue could never close. A reviewed `upstream-health-hold.json` beside `entry.json` now reports its listed `upstream-path-change`/`outdated` findings as `held` (not actionable) while the pin and the installed-scope content at the reviewed upstream head are unchanged. Otherwise the findings return with an actionable `stale-hold`. Broken, unreachable, `new-skill` and `unpinned` findings cannot be held. CI tests require every hold to be well-formed and to match its entry's `source.ref`. A network error while checking a reviewed head stays `unreachable`. `outdated` rows in the tracking issue now link to the GitHub compare view. The summary JSON reports the held count, and the closing comment mentions remaining holds. Both READMEs document the comparison scope, the hold format and the links. Validation: 42 upstream-health, 10 collection-generator, 51 catalog-metadata and 19 i18n tests pass. Catalog metadata, i18n (0 errors, 106 existing warnings) and translation-freshness checks pass. actionlint and `git diff --check` are clean. A live run over 111 entries reports no broken or unknown entries, and humanlayer-skills is no longer `outdated`. A temporary geo-optimizer hold turned both of its findings into `held` with `actionable: false`; it is not committed. Refs #213.
The weekly upstream-health run for #213 reported 28 entries on 2026-10-19: 27 outdated pins, three undeclared collection children and one moved source path. Review each installed-scope diff, then either repin or record a reviewed hold. Repin 24 pointers to the reviewed heads. Add the new children rpi (humanlayer-skills), chief-of-staff (mattpocock-skills) and wecomcli-pptx (wecom-cli) with reviewed bilingual summaries. Synchronize the sidecars: provenance and compliance refs, review timestamps, observed versions, license evidence and external-dependency disclosures. Newly disclosed: brainstorming's default logo telemetry, the automatic hooks and Python 3 requirement of planning-with-files, archify's opt-in edit of the agent's global rules file, taste-skill's public image APIs and CDN resources, and the online knowledge-base sync in wechatpay-skills. Record MIT license evidence for humanlayer-skills, and drop unsupported domain and tool counts from the dingtalk-cli summary. Keep three pins on reviewed holds. geo-optimizer: upstream moved the workflow outside the installed subtree. marketingskills and nuwa-skill: the new heads add sponsor or self-promotion to agent-facing content. The watch finding is left to #221, which already pins watch 1.1.2 on main. The manifest version is not bumped here because main has moved past this base; bump it when this change lands on main. The per-entry review is recorded in `docs/upstream-health-213-remediation.md`. Validation: 122 unit tests pass. Catalog metadata (--require-complete), i18n and translation-freshness checks pass with 0 errors; warnings drop from 106 to 104 with none new. All nine pinned collections reproduce. On 2026-10-19 the online health check covered 111 entries and found nothing broken, unknown or actionable beyond the four held findings. Several upstreams have moved since; their newer heads are left for the next round. `git diff --check` is clean. Stacked on #222. Refs #213.
## Summary This is the follow-up round for #213. It reviews the upstream changes that landed after the 2026-10-19 review in #227. On the #227 baseline, the online check on 2026-10-27 reported 21 outdated pins, two stale holds (marketingskills and nuwa-skill) and the still-valid geo-optimizer hold. Each installed-scope diff was reviewed: the source path or the declared child paths, together with the root LICENSE/NOTICE/COPYING files. Each entry was then repinned or put on a reviewed hold. The per-entry decisions and compare links are in the new "Follow-up review (2026-10-27)" section of `docs/upstream-health-213-remediation.md`. **Stacked on #227**, which is stacked on #222. Retarget to `main` once both merge. ## Changes - **16 repins.** These cover archify, banana, brainstorming, dingtalk-cli, follow-builders, frontend-slides, himalaya, impeccable, larksuite-cli, last30days, mattpocock-skills, planning-with-files(-zh), redbookskills, reverse-engineer-anything and taste-skill. For each one, `entry.json` and the catalog sidecar stay in sync: refs, compliance, review timestamps, observed versions, license evidence and compatibility requirements. No children were added or removed. - **License and versions.** - archify: upstream relicensed from MIT to Apache-2.0. The earlier MIT grants stay in LICENSE-MIT and NOTICE upstream. - Upstream versions recorded: banana 3.1.0, impeccable 4.8.0, last30days 3.31.0, planning-with-files 3.25.2 and reverse-engineer-anything revision 50 (opaque). - **New or corrected external-dependency disclosures**, following the repository policy: - banana: Python 3.11+ (was "Python 3"), Gemini billing including thinking tokens, Search-grounding retention, and local writes outside the workspace. - himalaya: the separately installed CLI, the operator's mail account and credentials, and send/delete without a built-in confirmation. - frontend-slides: the bundled PDF helper's Playwright and Chromium download, and the web-font hosts. - impeccable: the optional OpenAI image-API fallback (operator's key) and the unsandboxed, non-blocking hook. Downloads must now match SHA-256 digests shipped in the pinned skill. - last30days: the Bright Data CLI and credits for Amazon, the grok build audit and its cache, and the Arctic Shift archive. - reverse-engineer-anything: environment bundles on AgentEnv and Docker, Frida and debugger tooling, and the authorization gates for recording and instrumentation. - dingtalk-cli children: placeholder A2UI reply cards, AI-table roles and members, and standalone mind maps. mattpocock-skills' chief-of-staff summary now mentions its dated wiki folder. - **Holds** (`upstream-health-hold.json`): - `marketingskills` (refreshed): the referral promotion and the paid "Verified Partner" placements are unchanged at the new head. The new conversion-tracking child carries the same partner messaging. - `nuwa-skill` (refreshed): only the README banner was removed. SKILL.md still recommends the author's other projects whenever a request goes beyond the skill's scope. - `agent-reach` (new): the 1.6.0 rebuild defaults to an anti-detection browser for logged-in channels and copies site cookies from a connected Chrome. The installed SKILL.md is also an unrendered template. - `wecom-cli` (new): the new wecomcli-sheet scripts and workflow are adapted without attribution from the source-available xlsx skill in anthropics/skills, while the repository declares MIT. - `geo-optimizer`: unchanged and still valid. - **Left out on purpose.** - watch: outdated here only because this base predates #221, which already pins the current head on `main`. - Manifest version: not bumped, for the same reason as #227. ## Review decisions worth a second look - **agent-reach hold.** Defaulting to a stealth browser is a judgment call. The review notes list what a bump would need to disclose if the default is accepted. - **wecom-cli hold.** The new C shim matches the market's own `skills/xlsx` except for two dashes in comments, and the recalculation macro matches it exactly. The market ships that content under its own third-party notice. The blocker is the unattributed MIT labeling, not the macro or shim behavior, which a later bump must disclose. - **marketingskills `new-skill`.** Holds cover only `upstream-path-change` and `outdated`, so the two new children stay actionable while the pin is held. The finding clears only when the sponsor content is removed or accepted, or when the checker lets a hold cover undeclared children. - **Pre-existing, for the next review.** At the current wecom-cli pin, wecomcli-pptx's `anti-ai-slop.md` names the source-available pptx skill in anthropics/skills as one source of a reworded checklist. ## Validation All run on 2026-10-27 against the reviewed heads: - Unit tests: 122 pass. By suite: i18n 19, catalog-metadata 51, collection generator 10, upstream health 42. - Validators: `validate_catalog_metadata.py --require-complete`, `validate-i18n.py` and `translate.py --check` pass with 0 errors. The 104 earlier warnings are unchanged, and none is new. - Collections: `gen-collection-children.py --check` reproduces all nine pinned collections. - Online health check on this branch: covered 111 entries, with nothing broken or unknown. Six `held` findings cover the five holds. The remaining actionable findings are marketingskills `new-skill` and the watch pin, which is current on `main`. - Online health check on this branch merged with `main` (`aa6a1a6`): covered 112 entries, with agent/video-director resolving again. Only the held findings and marketingskills `new-skill` remain. Two transient TLS failures in that run passed when rechecked individually. - `git diff --check` is clean. - Sensitive-token scan: passed (run privately by the maintainer). Third-party programs and live account services were not executed. Refs #213.
yi-ge
added a commit
that referenced
this pull request
Oct 28, 2026
## Why `upstream-health-hold.json` could only cover `upstream-path-change` and `outdated`. When the upstream head of a held collection adds children that `children` does not declare, the `new-skill` finding stays actionable even after maintainers have reviewed those children and decided not to declare them, so the tracking issue (#213) can never close. `skills/marketingskills` is in this state today: its two new upstream children were reviewed in the 2026-10-27 round (#227), but nothing can hold the finding. ## What changes - `new-skill` is now a holdable status (`HOLDABLE = ("upstream-path-change", "new-skill", "outdated")`). - A hold that lists `new-skill` also checks the undeclared children: - the set of undeclared child paths at branch head must equal the set at the reviewed `head`; otherwise `stale-hold: undeclared children changed since <head> (added …; removed …)`; - the staleness diff adds those undeclared child paths to the installed scope (declared children plus root `LICENSE*`/`NOTICE*`/`COPYING*`), so any change inside them gives `stale-hold: upstream changed within the installed scope or undeclared children since <head>`; - a network error while listing children at the reviewed head is `unreachable`, not a stale hold. - Holds without `new-skill` compare the same scope and keep every existing message. The only wording change for them is the validation error for an unholdable status, which now lists `new-skill` among the holdable statuses. - The discovery filter moves into `undeclared_children()`, which the `new-skill` finding and the hold check share, so both always agree on what is undeclared. - The checker docstring, the tracking-issue guidance in `.github/workflows/upstream-health.yml`, `README.md` and `README.zh-CN.md` describe the extended hold. ## Tests New cases in `scripts/catalog/test_check_upstream_health.py`: - a valid `new-skill` hold is reported as `held`, and stays held after an unrelated upstream change; - a newly added undeclared child, and later the removal of the reviewed ones, make the hold stale; - a content change inside a held undeclared child makes the hold stale; - an `outdated`-only hold on a collection still ignores changes to undeclared children (existing behaviour); - a network error while listing children at the reviewed head stays `unreachable`. The validation test now accepts `new-skill` and still rejects broken, `unreachable`, `unpinned`, `held`, `stale-hold` and `ok`. ## Validation - `scripts/i18n/test_validate_i18n.py`: 19 tests pass. - `scripts/catalog/test_validate_catalog_metadata.py`: 51 tests pass. - `scripts/catalog/test_collection_generator.py`: 10 tests pass. - `scripts/catalog/test_check_upstream_health.py`: 47 tests pass (5 new). - `validate_catalog_metadata.py --require-complete` and `validate-i18n.py`: 0 errors, 103 existing warnings. `translate.py --check`, `actionlint` and `git diff --check` are clean. - Live run on `marketingskills` (entry and hold as on `main`, in a scratch copy, not committed): - with `new-skill` added to the 2026-10-27 hold, the result is `stale-hold`, because upstream has since moved from `17772c7` to `0cd9b3a` and changed declared children. The same hold without `new-skill` is also stale, so this is not caused by the new check. The two undeclared children are unchanged between those heads. - with the reviewed head set to a commit whose tree equals the current head, `new-skill` and `outdated` are both `held` and the summary reports `actionable: false`. ## Follow-up After this lands, the `marketingskills` hold can add `new-skill` to its `statuses`. Its reviewed head needs a fresh review first, because upstream has changed declared children since `17772c7`. The pre-publication sensitive-token scan was run privately by the maintainer and passed. Refs #213.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR remediates the #213 upstream-health findings in two reviewed rounds. Each installed-scope diff was reviewed: the source path or the declared child paths, together with the root LICENSE/NOTICE/COPYING files. Each entry was then repinned or put on a reviewed hold. Per-entry decisions and compare links are in
docs/upstream-health-213-remediation.md, which covers the first review and then the "Follow-up review (2026-10-27)" section.#222 is now on
main, and this branch has been updated withmain.Changes
entry.jsonand the catalog sidecar stay in sync: refs, compliance, review timestamps, observed versions, license evidence and compatibility requirements.rpi(humanlayer-skills): explicit invocation only. A real summary replaces the upstream text, which only said to invoke it by name.chief-of-staff(mattpocock-skills): from upstream's in-progress folder, manual invocation only.wecomcli-pptx(wecom-cli): needs the separately installed wecom-cli.upstream-health-hold.json):geo-optimizer: upstream moved the workflow outside the installed subtree, so the new layout would install broken.nuwa-skill: SKILL.md recommends the author's other projects whenever a request goes beyond the skill's scope.agent-reach: 1.6.0 defaults to an anti-detection browser that copies site cookies from a connected Chrome.wecom-cli: new wecomcli-sheet content is adapted without attribution from the source-available xlsx skill in anthropics/skills, while the repository declares MIT.marketingskills: a referral promotion and paid "Verified Partner" placements in agent-facing content. This hold went stale again on 2026-10-28; see below.main, and inventory counts followmain. watch is left alone because feat: watch 指针更新到 1.1.2 并改为可安装 / pin watch to 1.1.2 and make it installable #221 already pins it onmain.Review decisions worth a second look
metadata.versionrevision is recorded as an opaque version.Validation
Run on 2026-10-28 on this branch after merging
main(7a3ea30, which includes #226):validate_catalog_metadata.py --require-complete,validate-i18n.pyandtranslate.py --checkpass with 0 errors. Warnings go from 105 onmainto 103, and none are new.gen-collection-children.py --checkreproduces all ten pinned collections, including aws-agent-toolkit from 收录 AWS Agent 工具包技能合集 / Add AWS Agent Toolkit skills #226.git diff --checkis clean.mainmerge and the manifest bump add only generic text.Each round was also checked online against its reviewed heads; see the remediation record. Third-party programs and live account services were not executed.
Not clean as of 2026-10-28
The online check on this branch covered 113 entries, and nothing is broken. One transient TLS failure passed when rechecked individually. Five
heldfindings cover four holds: geo-optimizer counts twice, nuwa-skill, agent-reach and wecom-cli once each. Still actionable:0cd9b3a), so its hold isstale-hold. The two undeclared children are still reported asnew-skill.outdatedagainst a newer head (40b9c03).outdatedagainst a newer head (4652b1d). It was added onmainby 收录视频导演的固定源码 / List source-pinned Video Director #225.outdatedagainst a newer head (655a323). It was added onmainby 收录 AWS Agent 工具包技能合集 / Add AWS Agent Toolkit skills #226.These newer heads are not reviewed here. #213 stays open for the next round.
Refs #213.