v0.10.0

What's Changed

• feat: end-to-end launch autopilot, demo card maker, Verified + authorship gates (0.10.0) by @maumoya in #17

Full Changelog: v0.9.0...v0.10.0

v0.9.0

• Update round: scripts/sync.py keeps every published number in step with one launch/facts.json. It re-renders SVG
  cards and banners from templates, re-runs generators (PNG, GIF) with --run, updates fact markers in
  Markdown, lists owner-only places (social preview, About, profile row), and check fails on any stale surface or old
  value left by hand, badge URLs included. --no-outward for CI.

• make_header.sh OUT_DIR --png-only re-renders header.png from an updated header.svg.

• This repo: launch/ drives the bench card and header; README re-measured (readiness 100/100, retrofit 14 → 66,
  18 files) with both results under one dated Results section; CI runs the sync check.

• README rule: every repo shows a header banner, a demo video card and the result card; readiness checks the banner and the demo card. Scorecard loop continues to 7.4 (7.3 stays the release floor).

v0.8.0: hard ship gates

v0.8.0: hard ship gates

0.8.0 turns every hand step from shipping resource-optimizer v0.3.0 into a gate the skill and readiness.sh check, so a release cannot miss one.

- uses: maumoya/skill-forger-e2e@v0.8.0
  with:
    ship-gates: true

What changed in 0.8.0

• readiness.sh --ship exits 1 unless every gate is met: OpenSSF Scorecard 7.3 or higher, Best Practices passing, private vulnerability reporting on, a ruleset requiring a PR and CodeQL
• New checks: CodeQL workflow, permissions: read-all, SHA-pinned actions, version in sync across plugin.json, CHANGELOG, README and llms.txt, an action self-test, benefit badges in percentages (no GiB), a README hero card
• scorecard.sh prints the 7.3 ship bar, the exact ruleset and vulnerability-reporting fix commands and a short OpenSSF profile badge
• templates/ruleset-main.json: ready-made "Protect main" ruleset
• marketplace_check.sh fails without a CI self-test or on version drift
• Action input ship-gates; CI now proves the action fails a low-scoring skill
• SKILL.md: missing action.yml flagged up front, owner OK before Update release, launch copy in percentages with a hero card, profile and portfolio updated in the same pass

Measured (2026-11-03)

• Own repo: readiness 100/100, all ship gates met
• Bench, 5 cases x 3 runs: 47% of runs pass with the skill vs 0% without; score 78% vs 38%; time -44%, spend +53% per run

Verify the zip
slsa-verifier verify-artifact skill-forger-e2e-v0.8.0.zip --provenance-path skill-forger-e2e-v0.8.0.intoto.jsonl --source-uri github.com/maumoya/skill-forger-e2e --source-tag v0.8.0

Full Changelog: v0.7.0...v0.8.0

v0.7.0: measured triggers, bench and injection scan

v0.7.0: measured, not claimed

0.7.0 turns the Test phase into numbers: does the skill fire, does it help, and is a downloaded skill safe to install.

What changed in 0.7.0

• Spec lint: frontmatter checked against the Agent Skills spec (allowed keys, compatibility, metadata, allowed-tools, name rules); descriptions that narrate steps are flagged
• Injection scan: lint fails on hidden Unicode (zero-width, bidi), injection phrases and symlinks that leave the repo; warns on HTML comments, long base64 runs and scripts that read credentials
• install_test.sh --npx: proves the npx skills add path (pinned skills@1.7.4) in a throwaway HOME
• trigger_test.sh: measured recall and false-trigger rate over evals/triggers.json (billed, plan first)
• bench.sh: with-vs-without benchmark, N runs per case, writes a dated Results block (billed, plan first)
• badges.sh --from: a benefit badge prints only when its numbers come from a measured Results block
• Lint catches multi-document case.yaml and invalid grader focus (both made cases silently skip)

Measured (2026-11-03)

• Triggers: recall 0.95, 0 false triggers over 33 runs (holdout 0.83)
• Bench, 5 cases x 3 runs: 47% of runs pass with the skill vs 0% without; score 0.78 vs 0.38; spend +53%, time -44% per run (evals/bench/2026-11-03.md)
• Open: the injection-scan case passes 1/3 (the skill does not always fire on it); two cases not yet re-measured

Verify the zip
slsa-verifier verify-artifact skill-forger-e2e-v0.7.0.zip --provenance-path skill-forger-e2e-v0.7.0.intoto.jsonl --source-uri github.com/maumoya/skill-forger-e2e --source-tag v0.7.0

Full Changelog: v0.6.0...v0.7.0

v0.6.0

v0.6.0: Marketplace rules before you tag

The GitHub Marketplace validates action.yml only when you publish, and reads it from the release tag. A miss there costs a new release. 0.6.0 catches it in the PR.

What changed in 0.6.0

• lint_skill.sh checks a root action.yml against the Marketplace rules: description under 125 characters, no unquoted : , branding.icon, a valid branding.color, runs.using, author, one action file
• New marketplace_check.sh REPO_DIR OWNER/REPO [--listed]: the same rules plus online checks (repo public, listing name free or already yours, latest tag carries this action.yml, tag signed and Verified); --listed proves the listing is live
• Packaging: an 11-step Marketplace checklist from the pre-tag check to the listing proof, with the CI self-test pattern and what to do when validation fails after tagging

Measured (2026-11-03)

• On a real repo whose 1.8.0 release the Marketplace rejected (description too long), the 0.6.0 lint flags it before tagging; after the fix, marketplace_check.sh --listed passes on the live listing
• This repo: lint PASS with 0 warnings, readiness 100/100

Verify the zip
slsa-verifier verify-artifact skill-forger-e2e-v0.6.0.zip --provenance-path skill-forger-e2e-v0.6.0.intoto.jsonl --source-uri github.com/maumoya/skill-forger-e2e --source-tag v0.6.0

Full Changelog: v0.5.0...v0.6.0

v0.5.0

v0.5.0: release hygiene

First tagged release of Skill Forger E2E.

What changed in 0.5.0

• Signed release tags with an SSH key (one-time setup, git verify-tag before pushing), so GitHub shows them as Verified
• Re-sign an unsigned tag in place, without touching the release, zip or provenance
• After every release, refresh the whole publication: README Results and badges, release notes, About
• List a root action.yml on the GitHub Marketplace from a release (requirements, name check, owner-only agreement)

Already in the box (0.2.0 to 0.4.0)

• Readiness score 0-100 with a badge, locally or as a GitHub Action on every PR
• Retrofit an existing skill repo (adds what is missing, never overwrites), live install test from GitHub
• Header image and badge row, OpenSSF Scorecard feedback, Best Practices evidence sheet, About the author draft

Measured (2026-11-01)

• One retrofit command takes a bare skill repo from readiness 16 to 68, with 0 existing files changed

Verify the zip
slsa-verifier verify-artifact skill-forger-e2e-v0.5.0.zip --provenance-path skill-forger-e2e-v0.5.0.intoto.jsonl --source-uri github.com/maumoya/skill-forger-e2e --source-tag v0.5.0