refactor(update-copilot-skills)!: drop skills-lock, use gh skill update --all

[devantler]

Wrap devantler-tech/actions/update-copilot-skills@v2 which delegates to gh skill update --all. Installed SKILL.md files' own metadata.github-* frontmatter is the source of truth — no skills-lock.json required.

Type of change

• 🧹 Refactor
• ⛓️‍💥 Breaking change
• 📚 Documentation update

What changed

• Drop the skills-lock, agent, and scope inputs.
• Drop the separate setup-copilot-skills re-install step — gh skill update edits installed SKILL.md files in place.
• Add dir (default .) and unpin inputs; bump the pinned action SHA to the companion devantler-tech/actions#95 head.
• Only open a PR when the action reports changed=true; embed the updated-skills output in the PR body.
• Refresh the README section to match.

Breaking change

The skills-lock, agent, and scope inputs are removed. Consumers should delete their skills-lock.json, install each skill via gh skill install (or devantler-tech/actions/setup-copilot-skills@v2), commit the resulting SKILL.md files, and pass dir: pointing at the directory those files live under. Companion migration PRs: devantler-tech/skills#16, devantler-tech/actions#95, and follow-up PRs in devantler-tech/ksail + devantler-tech/platform.

[botantler]

🎉 This PR is included in version 3.0.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

[Copilot]

Pull request overview

Refactors the update-copilot-skills reusable workflow to rely on gh skill update --all (via devantler-tech/actions/update-copilot-skills@v2) so the committed SKILL.md files’ metadata.github-* frontmatter becomes the source of truth (no skills-lock.json).

Changes:

• Remove skills-lock, agent, and scope inputs; introduce dir and unpin inputs.
• Drop the separate “install skills” step and only create a PR when changed=true, including updated-skills in the PR body.
• Update README documentation to match the new workflow contract and usage.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
README.md	Updates workflow docs/usage to align with the new “installed SKILL.md is source of truth” approach.
.github/workflows/update-copilot-skills.yaml	Switches the workflow to updating installed skills in-place and conditionally opening a PR based on action output.

Comments suppressed due to low confidence (1)

.github/workflows/update-copilot-skills.yaml:75

• The step-security/create-pull-request step is configured with labels: ${{ inputs.pr-labels }}. Applying labels to a PR requires the issues: write permission on the token; with only contents: write and pull-requests: write this step can fail (or silently skip labeling). Add issues: write to the job permissions when labels are used (or omit labels / make them conditional).

      - name: 📦 Create pull request
        if: steps.update.outputs.changed == 'true'
        uses: step-security/create-pull-request@e604d57b37b404d8bb34d152fa905e45d003a895 # v8.1.0
        with:
          commit-message: ${{ inputs.commit-message }}
          title: ${{ inputs.pr-title }}

[Copilot]

The README note says callers must grant contents: write and pull-requests: write, but this workflow also applies PR labels (pr-labels), which typically requires issues: write. Update the note (and/or the permissions example) to include issues: write so consumers don’t hit permission errors.

Suggested change

	> **Note:** The calling workflow must grant `contents: write` and `pull-requests: write` permissions.
	> **Note:** The calling workflow must grant `contents: write`, `pull-requests: write`, and `issues: write` permissions.