mirror of
https://github.com/daymade/claude-code-skills.git
synced 2026-09-14 16:15:21 +08:00
daymade
3fbe882c1b
`changed_paths` fed a raw `git diff --name-only` into the plugin-ownership map, so a change to any file the packaging policy excludes counted as "plugin content changed" and demanded a version bump. Deleting the repository's tracked `.security-scan-passed` markers -- a file `packaging_policy.py` already excludes from every package -- would have demanded bumps for 53 of the 56 plugins: 53 releases pushed at every installed user for content none of them would receive. skill-creator's own rule already says the shipping set is defined only by `packaging_policy.py` and that packaging, security attestation, content hashing and regression auditing must consume that shared policy rather than keep a second exclusion list. This gate was keeping an implicit empty one. It now loads that module and drops paths the position-independent half of the policy excludes: EXCLUDE_DIRS (matched against any path part), EXCLUDE_FILES (basename) and EXCLUDE_GLOBS (basename). `ROOT_EXCLUDE_DIRS` is deliberately not applied. Its `evals`/`dist`/`tests` rules are indexed from a skill root, so carrying them to repository-relative paths would quietly stop the gate firing on real test changes -- a weakening disguised as consistency. A missing policy module falls back to excluding nothing, which is what this check did before. That direction is deliberate: excluding nothing can only make the gate stricter, so a checkout without that Skill -- including the synthetic fixture repos in `tests/test_git_mainline_guard.py` -- costs a false alarm at worst and never a silent pass. An earlier draft raised instead, and the repository's own guard suite caught it: every fixture failed, which is the more expensive failure direction because it teaches operators to bypass. Calibrated against the real repository rather than a fixture: - a candidate deleting only excluded files, with no bumps: failed with exactly 53 complaints before, passes after - a candidate appending one line to `youtube-downloader/SKILL.md` with no bump: fails before and after - with no policy module present: falls back to excluding nothing - `SKILL.md` and `tests/test_x.py` are still not excluded in the real repository - `tests/test_git_mainline_guard.py`: 12 tests pass No plugin content changes, so no version is bumped. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>