v0.1.0 - first public release

First public release. Composite GitHub Action wrapping the skil-lock CLI.

What it does

On every pull request, this Action:

1. Downloads a pinned skil-lock release binary and verifies its SHA-256 against checksums.txt.
2. Runs skil-lock ci against the repo's committed skills.lock and .skil-lock.yaml.
3. Posts (or updates) a single PR comment showing every capability delta — new shell commands, new URLs, new file paths.
4. Fails the check when policy is mode: block and any delta is at severity ≥ medium.

Quick start

name: SkilLock
on: pull_request
permissions:
  contents: read
  pull-requests: write
jobs:
  skil-lock:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: skills-lock/skil-lock-action@v0.1.0
        with:
          pin-binary: v0.1.0

Inputs

Input	Required	Default	Description
pin-binary	yes	—	skil-lock release tag (e.g. v0.1.0). No floating refs.
comment	no	true	Post or update a PR comment with the capability diff.
path	no	.	Repository root containing .claude/skills/ or .codex/skills/.

Worked example

See skills-lock/example-claude-code-skills for a runnable demo, including an example/drift branch that shows what SkilLock catches when a skill grows risky behavior.

Related

• skills-lock/skil-lock — the CLI and skills.lock file format
• skills.lock v0.1 specification

License

Apache 2.0. Not affiliated with Skil power tools, Anthropic, or OpenAI.