Skip to content

v0.5.0

Marketplace
Marketplace

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Nov 08:07
· 13 commits to main since this release
v0.5.0
This tag was signed with the committer’s verified signature.
maumoya Mauricio Moya
SSH Key Fingerprint: WMhHFnKuK8S330f4RyQbxMcL8TbBu7hMVt4y+HicoLQ
Verified
Learn about vigilant mode.
4d3b785
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.5.0: release hygiene

First tagged release of Skill Forger E2E.

What changed in 0.5.0

  • Signed release tags with an SSH key (one-time setup, git verify-tag before pushing), so GitHub shows them as Verified
  • Re-sign an unsigned tag in place, without touching the release, zip or provenance
  • After every release, refresh the whole publication: README Results and badges, release notes, About
  • List a root action.yml on the GitHub Marketplace from a release (requirements, name check, owner-only agreement)

Already in the box (0.2.0 to 0.4.0)

  • Readiness score 0-100 with a badge, locally or as a GitHub Action on every PR
  • Retrofit an existing skill repo (adds what is missing, never overwrites), live install test from GitHub
  • Header image and badge row, OpenSSF Scorecard feedback, Best Practices evidence sheet, About the author draft

Measured (2026-11-01)

  • One retrofit command takes a bare skill repo from readiness 16 to 68, with 0 existing files changed

Verify the zip
slsa-verifier verify-artifact skill-forger-e2e-v0.5.0.zip --provenance-path skill-forger-e2e-v0.5.0.intoto.jsonl --source-uri github.com/maumoya/skill-forger-e2e --source-tag v0.5.0

Assets 4
Loading