Skip to content

VENDOR.md

Latest commit

 

History

History
31 lines (21 loc) · 1.79 KB

VENDOR.md

File metadata and controls

31 lines (21 loc) · 1.79 KB
Raw

Vendored skills

The skill packages under skills/ are vendored from jfrog/jfrog-skills and committed to main.
Repository https://github.com/jfrog/jfrog-skills
Pinned release see pin in scripts/sync-skills-vendor.json

Included skill directories (as of the pinned release): jfrog/, jfrog-package-curation/, jfrog-setup-package-managers/, jfrog-ai-catalog-skills/, jfrog-mcp-management/ (JFrog Agent Guard MCP management, including the Codex harness), and jfrog-reference-architecture/.

Refreshing

When the upstream repo publishes a new release, refresh the vendored tree via a PR that:

  1. Bumps pin in scripts/sync-skills-vendor.json to the new tag.
  2. Re-syncs and commits the refreshed skills/ tree.
  3. Bumps version in both .codex-plugin/plugin.json and package.json — they must match (CI enforces this) — so the published plugin version reflects the new skills bundle.

Merging the PR does not publish on its own: the merge commit subject must carry a [patch] / [minor] / [major] marker, which .github/workflows/release.yml enforces as the release gate. See the README's Releasing and Updating the vendored skills sections for the full workflow.

To regenerate the tree locally before opening the PR:

node scripts/sync-skills.mjs

The script reads its sibling sync-skills-vendor.json, downloads the pinned upstream tarball from codeload.github.com, and replaces the directories listed in paths (today: skills/).