feat(copilot-skills)!: drop lockfile, lean on gh skill frontmatter

[devantler]

Replace the skills-lock.json-driven flow with a thin wrapper around gh skill install / gh skill update --all. Each installed SKILL.md now self-describes its upstream via the metadata.github-* frontmatter that gh skill install injects natively — no sidecar manifest required.

Type of change

• 🚀 New feature
• 🧹 Refactor
• ⛓️‍💥 Breaking change
• 📚 Documentation update

What changed

setup-copilot-skills

• Inputs consolidated onto a single skills list — newline-separated <owner/repo> <skill>[@pin] entries so consumers can mix upstreams freely. # comments and blank lines are allowed.
• skills-lock, source, and the old skills-means-names-from-one-source input are removed.
• jq dependency dropped.
• Per-line @<tag|branch|sha> pins map to gh skill install --pin; reproducible installs work without a lockfile.

update-copilot-skills

• Implementation replaced with gh skill update --all --dir <dir>; the CLI edits installed SKILL.md files in place.
• New dir, dry-run, and unpin inputs; skills-lock input removed.
• changed output computed from SKILL.md content hashes before/after the run, so the action works regardless of whether the caller is in a git workspace.

Both READMEs gain a Migrating from v1 section with a before/after snippet, and the root README.md action list is refreshed.

Breaking change

setup-copilot-skills and update-copilot-skills both remove the skills-lock input; setup-copilot-skills also removes the source input and redefines skills as the sole list input. Consumers should delete any skills-lock.json and move each entry onto its own <owner/repo> <skill> line in setup-copilot-skills.with.skills. Companion PRs in devantler-tech/skills, devantler-tech/reusable-workflows, devantler-tech/ksail, and devantler-tech/platform migrate the upstream-index repo, reusable workflow, and downstream consumers to match.

[Copilot]

Pull request overview

This PR refactors the Copilot skills actions to remove the skills-lock.json workflow and instead rely on the upstream provenance frontmatter that gh skill install injects into each installed SKILL.md. Updates are delegated to gh skill update --all, and both actions’ inputs/outputs and documentation are updated accordingly.

Changes:

• Replace update-copilot-skills lockfile pinning logic with gh skill update --all --dir <dir> plus before/after content hashing to compute changed.
• Simplify setup-copilot-skills to a single required newline-separated skills list (<owner/repo> <skill>[@pin]) supporting comments and blanks.
• Update READMEs and root action list, including “Migrating from v1” guidance.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
update-copilot-skills/action.yaml	Switches implementation to gh skill update, adds dir/dry-run/unpin, and computes changed via SKILL.md hashing.
update-copilot-skills/README.md	Updates docs for new behavior/inputs/outputs and adds v1→v2 migration section.
setup-copilot-skills/action.yaml	Removes lockfile/source modes; parses a unified <owner/repo> <skill>[@pin] list and installs via gh skill install.
setup-copilot-skills/README.md	Documents new unified input format and adds migration notes.
README.md	Updates action catalog descriptions to reflect the new v2 behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[botantler]

🎉 This PR is included in version 3.0.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The cleaned=$( ... | grep -vE ... | ... ) pipeline can cause the action to fail on no-op runs. With set -euo pipefail, grep -vE exits with status 1 when it filters out all lines (i.e., no output), which will terminate the step even though this is a valid “nothing to report” case. Make the filtering pipeline tolerant of empty output (e.g., ignore grep’s 1 exit code or restructure to avoid relying on grep’s exit status).

Suggested change

	cleaned=$(sed -e 's/\r/\n/g' -e 's/\x1B\[[0-9;]*[a-zA-Z]//g' "$out" \
	| grep -vE '^Checking .* installed skill' \
	| sed '/^$/d')
	cleaned=$(sed \
	-e 's/\r/\n/g' \
	-e 's/\x1B\[[0-9;]*[a-zA-Z]//g' \
	-e '/^Checking .* installed skill/d' \
	-e '/^$/d' \
	"$out")

[Copilot]

The checksum snapshot uses sort -z and xargs -0 -r, which are not consistently available across BSD userlands (notably on macOS) even though this repo runs macos-latest in CI. Consider switching to a more portable approach (e.g., iterate find -print0 results in a while read -d '' loop and avoid sort -z/xargs -r), and apply it in both the before/after snapshots.

[Copilot]

The README says updated-skills is “blank when nothing changed”, but the action always writes this output and will emit at least a newline even when there is no cleaned stdout. Either adjust the implementation to only set updated-skills when there is meaningful content, or relax the documentation so consumers don’t rely on it being empty on no-op runs.

Suggested change

	| `updated-skills` | Cleaned stdout from `gh skill update --all` (blank when nothing changed) |
	| `updated-skills` | Cleaned stdout from `gh skill update --all`; do not rely on this output being empty on no-op runs |