v0.6.0

v0.6.0: Marketplace rules before you tag

The GitHub Marketplace validates action.yml only when you publish, and reads it from the release tag. A miss there costs a new release. 0.6.0 catches it in the PR.

What changed in 0.6.0

• lint_skill.sh checks a root action.yml against the Marketplace rules: description under 125 characters, no unquoted : , branding.icon, a valid branding.color, runs.using, author, one action file
• New marketplace_check.sh REPO_DIR OWNER/REPO [--listed]: the same rules plus online checks (repo public, listing name free or already yours, latest tag carries this action.yml, tag signed and Verified); --listed proves the listing is live
• Packaging: an 11-step Marketplace checklist from the pre-tag check to the listing proof, with the CI self-test pattern and what to do when validation fails after tagging

Measured (2026-11-03)

• On a real repo whose 1.8.0 release the Marketplace rejected (description too long), the 0.6.0 lint flags it before tagging; after the fix, marketplace_check.sh --listed passes on the live listing
• This repo: lint PASS with 0 warnings, readiness 100/100

Verify the zip
slsa-verifier verify-artifact skill-forger-e2e-v0.6.0.zip --provenance-path skill-forger-e2e-v0.6.0.intoto.jsonl --source-uri github.com/maumoya/skill-forger-e2e --source-tag v0.6.0

Full Changelog: v0.5.0...v0.6.0