v0.4.16

Added

• New skill: django-storages-s3 — production AWS S3 file storage for Django with django-storages and boto3. Covers the Django 4.2+ STORAGES dict, public/private custom backends, presigned GET/POST URLs, CloudFront integration, a least-privilege IAM policy, and S3 mocking (InMemoryStorage/moto). Cross-referenced with django-expert (#218)
• ReferencePathChecker in scripts/validate-skills.py: validates that file paths cited in skill markdown (backtick paths and markdown links) resolve relative to the containing file or the skill root. Broken paths previously failed silently when an agent tried to load deferred reference content; this class of bug has now recurred across several releases and is guarded automatically in CI and make validate
• devops-engineer: new references/gitlab-ci.md covering GitLab CI/CD best practices (pipeline dedup via workflow:rules, needs: DAG, cache vs artifacts, CI/CD components, environments, OIDC secrets, runner isolation, MR-widget reporting) plus a routing-table row; the GitLab counterpart to the existing GitHub Actions reference (#219)

Changed

• devops-engineer/references/gitlab-ci.md: post-merge patch replacing the kaniko build example with BuildKit rootless (moby/buildkit:rootless + buildctl-daemonless.sh with registry cache) and noting kaniko's archived status in the core principles; kaniko is unmaintained and should not be the recommended build path

Fixed

• vue-expert-js/SKILL.md: three shared-Vue reference paths pointed at vue-expert/references/*.md, which does not resolve from the skill directory; corrected to ../vue-expert/references/*.md (#225)
• react-expert/references/migration-class-to-modern.md: self-referencing path react-expert/references/server-components.md corrected to references/server-components.md (#225)
• fastapi-expert/references/migration-from-django.md: cross-reference to legacy-modernizer used an absolute-style path (/skills/legacy-modernizer/...) that resolves nowhere; corrected to ../legacy-modernizer/references/migration-strategies.md. Found by the new ReferencePathChecker audit
• nestjs-expert/references/migration-from-express.md: cross-reference to legacy-modernizer's strangler-fig reference was a hardcoded contributor-machine absolute path (/Users/.../claude-skills/skills/...); corrected to ../legacy-modernizer/references/strangler-fig-pattern.md. Caught by ReferencePathChecker on CI's clean runner; the checker now rejects absolute paths unconditionally so a stale local clone can never mask one
• site/package-lock.json: applied npm audit fix to clear docs-site dependency vulnerabilities (14 findings down to 9; the remainder stem from advisories published after the fix was cut). Verified via clean npm ci, npm audit, and a successful 98-page site build before merge (#220)
• site/package-lock.json: follow-up fresh npm audit fix clearing post-July advisories (9 findings down to 5). The remaining 5 require a semver-major Astro 7 upgrade (cascading @astrojs/starlight and @astrojs/mdx majors) and are dev-server/SSR-context advisories with low exposure for a statically built site; tracked as separate upgrade work
• rag-architect/SKILL.md: reranking example instantiated the Cohere client with a hard-coded "YOUR_API_KEY" placeholder; now reads COHERE_API_KEY from the environment with a note on secrets handling, closing #210 (#216)
• terraform-engineer/SKILL.md: core workflow allowed proceeding from terraform plan straight to terraform apply; now requires presenting a plan summary (highlighting destructive actions) and receiving explicit user approval before apply, refusing when approval is withheld, closing #211 (#213)
• devops-engineer/SKILL.md: the "never deploy to production without explicit approval" constraint was not operationalized in the core workflow; the deploy step now determines the target environment and, for production or customer-facing targets, presents the deployment summary and rollback plan and requires explicit user approval before running deployment commands, closing #196 and #212

Contributors

• @vasugarg09 — Fixed broken relative reference paths in vue-expert-js and react-expert (#225)
• @chgreer1070 — Patched docs-site dependency vulnerabilities via npm audit fix (#220)
• @kasymovpost — GitLab CI/CD best-practices reference for devops-engineer (#219)
• @awais786 — New django-storages-s3 skill: production S3 file storage for Django (#218)
• @snvtac — Replaced hard-coded Cohere API key placeholder in rag-architect with environment lookup (#216)
• @SergiuLupaiescu — Added user-approval gate between terraform plan and apply in terraform-engineer (#213)
• @specterslient95-lgtm — Reported the missing plan/apply approval gate (#211) and the non-operationalized production-deploy constraint (#196, #212)

---

Documentation: https://jeffallan.github.io/claude-skills/