dsh-github-skills v0.1.2

dsh-github-skills v0.1.2

Release-chain completion: npm publish now passes --provenance, so this
version carries an npm publish attestation + SLSA provenance (signed by the
GitHub Actions OIDC identity; transparency log entry
https://search.sigstore.dev/?logIndex=2477401563).

Changed since v0.1.1

• release.yml: publish step now uses npm publish --access public --provenance.
• ci.yml: version check is semver-generic (no hard-coded version).
• package.test.mjs: derives the expected packed version from the working
  tree.
• CHANGELOG documents the v0.1.1 provenance gap (immutable versions cannot
  be retro-signed).

Also included from v0.1.1: npm description/keywords metadata, README
language navigation, permanent GitHub-source install wording, GitHub
repository About metadata (dsh-plugin topic).

Install: dsh plugin --profile web add dsh-github-skills

dsh-github-skills v0.1.1

dsh-github-skills v0.1.1

npm package metadata release (published via the automated OIDC path).

Changed

• npm description: "Skill-first GitHub workflows for DeepSeek Harness: PR
  triage, review feedback, CI diagnosis, and safe publishing."
• npm keywords for discovery (dsh-plugin first, plus dsh-skill,
  deepseek-harness, github, github-actions, code-review,
  agent-skills, developer-tools, git).
• README (en/zh) language navigation; permanent GitHub-source install
  wording; GitHub repository About metadata set.

Note: v0.1.1 was published via OIDC without provenance; provenance is
attached from v0.1.2 onward.

Install: dsh plugin --profile web add dsh-github-skills

dsh-github-skills v0.1.0

dsh-github-skills v0.1.0

First release of the connector-agnostic GitHub workflow skill pack for DeepSeek Harness.

What's inside

• Four skills (progressive disclosure; catalog = name + description, bodies load on invocation):
  • github — umbrella router: resolve context → classify intent → route immediately.
  • gh-address-comments — thread-aware PR review feedback workflow (resolved/outdated/anchors).
  • gh-fix-ci — GitHub Actions diagnosis/fix from real log evidence; external CI report-only.
  • gh-publish — safe local → GitHub publish (scope-confirmed, never blind git add -A, draft PR first).
• Zero-dependency Node helpers: fetch-review-threads.mjs, inspect-pr-checks.mjs, publish-preflight.mjs.
• Minimal bundle shim (lib/index.js) registering the skills on ctx.skills; no GitHub API tools, no credential handling.
• 100 tests (node:test, zero dev deps) on Node 22.19 + 24; package validation + disposable-profile install smoke in CI.

Safety posture

• Analysis never becomes a write; remote writes require explicit intent or the DSH approval gate.
• Credential redaction at every output boundary; gh auth token never invoked.
• Mixed worktrees never staged with git add -A; external CI never log-diagnosed; host-aware GHES context.

Install

dsh plugin --profile web add dsh-github-skills

Apache-2.0. Attribution to the OpenAI Codex GitHub plugin in THIRD_PARTY_NOTICES.md.