← back to Cli Printing Press
fix(skills): drop cli-skills mirror regen from publish flow (#1502)
f64e9913ff259760300b76c01db2e6f1b4ecd4e9 · 2026-05-16 01:47:18 -0700 · Trevin Chow
* fix(skills): drop cli-skills mirror regen from publish flow
The publish skill previously ran the library's generate-skills tool in
Step 6 and committed the regenerated cli-skills/pp-<api-slug>/SKILL.md
mirror, which made every fork PR fail the library's
`Guard against hand-edits to cli-skills mirror` workflow. The auto-fix
that would otherwise rewrite the mirror via the library bot is gated on
`head.repo.full_name == github.repository`, so fork PRs had no path that
satisfied both Guard and the drift check.
Drop the regen call, drop `cli-skills/` from the staging `git add`, and
flip the preamble to forbid touching the mirror in publish PRs. Replace
the regen lines with a guard comment naming the upstream Guard check and
pointing at printing-press-library#590 so the regen isn't reintroduced
without addressing the library side. Update the contract test to assert
the new shape.
Closes #1474
* docs(cli): align AGENTS.md with new publish-skill contract; drop ticket URL from SKILL guard comment
Greptile P1 + P2 from PR #1502.
P1: AGENTS.md described the publish skill as driving cli-skills mirror
regen and only prohibited editing registry.json or README catalog cells.
The publish-flow change in the prior commit makes both descriptions
stale. Drop the regen reference from the skill's responsibility list and
add cli-skills/pp-<api-slug>/SKILL.md to the prohibited-edit list, with
a one-sentence pointer to the upstream Guard check that enforces it.
P2: The Step 6 guard comment ended with a ticket URL, which the Code &
Comment Hygiene rules forbid (no ticket numbers in code comments;
comments must be self-contained). Replace the URL with a self-contained
condition for when the guard could be lifted.
---------
Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
Files touched
M AGENTS.mdM internal/pipeline/contracts_test.goM skills/printing-press-publish/SKILL.md
Diff
commit f64e9913ff259760300b76c01db2e6f1b4ecd4e9
Author: Trevin Chow <trevin@trevinchow.com>
Date: Sat May 16 01:47:18 2026 -0700
fix(skills): drop cli-skills mirror regen from publish flow (#1502)
* fix(skills): drop cli-skills mirror regen from publish flow
The publish skill previously ran the library's generate-skills tool in
Step 6 and committed the regenerated cli-skills/pp-<api-slug>/SKILL.md
mirror, which made every fork PR fail the library's
`Guard against hand-edits to cli-skills mirror` workflow. The auto-fix
that would otherwise rewrite the mirror via the library bot is gated on
`head.repo.full_name == github.repository`, so fork PRs had no path that
satisfied both Guard and the drift check.
Drop the regen call, drop `cli-skills/` from the staging `git add`, and
flip the preamble to forbid touching the mirror in publish PRs. Replace
the regen lines with a guard comment naming the upstream Guard check and
pointing at printing-press-library#590 so the regen isn't reintroduced
without addressing the library side. Update the contract test to assert
the new shape.
Closes #1474
* docs(cli): align AGENTS.md with new publish-skill contract; drop ticket URL from SKILL guard comment
Greptile P1 + P2 from PR #1502.
P1: AGENTS.md described the publish skill as driving cli-skills mirror
regen and only prohibited editing registry.json or README catalog cells.
The publish-flow change in the prior commit makes both descriptions
stale. Drop the regen reference from the skill's responsibility list and
add cli-skills/pp-<api-slug>/SKILL.md to the prohibited-edit list, with
a one-sentence pointer to the upstream Guard check that enforces it.
P2: The Step 6 guard comment ended with a ticket URL, which the Code &
Comment Hygiene rules forbid (no ticket numbers in code comments;
comments must be self-contained). Replace the URL with a self-contained
condition for when the guard could be lifted.
---------
Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
---
AGENTS.md | 4 ++--
internal/pipeline/contracts_test.go | 15 +++++++--------
skills/printing-press-publish/SKILL.md | 29 ++++++++++++++++-------------
3 files changed, 25 insertions(+), 23 deletions(-)
diff --git a/AGENTS.md b/AGENTS.md
index 11b5f39f..3e5d5310 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -199,9 +199,9 @@ Generated artifacts live under `~/printing-press/`, not in this repo: `library/<
## Publishing to the Public Library
The only supported path for **publishing a generated CLI** (adding or updating an entry under `library/<category>/<api-slug>/` in [mvanhorn/printing-press-library](https://github.com/mvanhorn/printing-press-library)) is to invoke the `/printing-press-publish` skill. The skill runs the required `gh`/`git` commands itself; do not reproduce them by hand.
-- Invoke `/printing-press-publish` and let it drive the fork, branch, manifest checks, `cli-skills/pp-<api-slug>/SKILL.md` regen, push, and PR creation. Following its prompts is the supported flow.
+- Invoke `/printing-press-publish` and let it drive the fork, branch, manifest checks, push, and PR creation. Following its prompts is the supported flow.
- Do not skip the skill and improvise the same steps from scratch (manual `gh repo fork` / `cp -r` into a library clone / `gh pr create --repo mvanhorn/printing-press-library …` / branch push to a fork without the skill driving it). The commands look similar; the difference is the preflight checks and conventions the skill enforces before they run.
-- Do not edit `registry.json` or README catalog cells in a publish PR — the public library refreshes those post-merge from `.printing-press.json` / `manifest.json`.
+- Do not edit `registry.json`, README catalog cells, or `cli-skills/pp-<api-slug>/SKILL.md` in a publish PR — the public library refreshes those post-merge (registry and READMEs from `.printing-press.json` / `manifest.json`; the cli-skills mirror via the library's `generate-skills.yml` workflow). The library's `Guard against hand-edits to cli-skills mirror` check rejects any fork PR whose commits touch the mirror, so committing it pre-rejects the publish before review.
Why this matters: the publish skill enforces preflight checks (printer sentinel validation, manifest shape, vendor-spec PII scope, govulncheck scoped to the changed module) and mirrors the public library's own `AGENTS.md` requirements. An agent operating in this repo's CWD never loads the public library's `AGENTS.md`, so those rules are invisible unless the skill is the entry point.
diff --git a/internal/pipeline/contracts_test.go b/internal/pipeline/contracts_test.go
index ba183f06..7056728a 100644
--- a/internal/pipeline/contracts_test.go
+++ b/internal/pipeline/contracts_test.go
@@ -151,22 +151,21 @@ func TestPublishSkillTracksCanonicalUpstreamAndOverwriteFlow(t *testing.T) {
assert.Contains(t, skill, "git push --force-with-lease")
}
-func TestPublishSkillUsesLibraryTreeForCliSkillsMirror(t *testing.T) {
+func TestPublishSkillSkipsCliSkillsMirrorRegen(t *testing.T) {
skill := readContractFile(t, filepath.Join("..", "..", "skills", "printing-press-publish", "SKILL.md"))
- assert.Contains(t, skill, "Do not\nedit `registry.json`")
- assert.Contains(t, skill, "fix the\nlibrary mirror generator to discover from `library/`")
- assert.Contains(t, skill, "# Regenerate the flat cli-skills mirror from the library tree")
- assert.Contains(t, skill, "git add library/ cli-skills/")
+ assert.Contains(t, skill, "Do not\nedit `registry.json`, README catalog cells, or `cli-skills/pp-<api-slug>/SKILL.md`")
+ assert.Contains(t, skill, "Guard against hand-edits to cli-skills mirror")
+ assert.Contains(t, skill, "Do NOT regenerate or commit `cli-skills/pp-<api-slug>/SKILL.md` here")
+ assert.Contains(t, skill, "git add library/\ngit commit")
+ assert.NotContains(t, skill, "git add library/ cli-skills/")
assert.NotContains(t, skill, "git add library/ cli-skills/ registry.json")
assert.NotContains(t, skill, "REGISTRY_HAS_ENTRY")
assert.NotContains(t, skill, "seed one registry")
+ assert.NotContains(t, skill, "go run ./tools/generate-skills/main.go")
copyIntoLibrary := strings.Index(skill, `cp -r "$STAGING_DIR/library/<category>/<api-slug>"`)
- mirrorRun := strings.Index(skill, "go run ./tools/generate-skills/main.go")
require.NotEqual(t, -1, copyIntoLibrary)
- require.NotEqual(t, -1, mirrorRun)
- assert.Less(t, copyIntoLibrary, mirrorRun)
}
func TestPolishSkillHardGatesPublishValidate(t *testing.T) {
diff --git a/skills/printing-press-publish/SKILL.md b/skills/printing-press-publish/SKILL.md
index 4f599d47..fe2caf66 100644
--- a/skills/printing-press-publish/SKILL.md
+++ b/skills/printing-press-publish/SKILL.md
@@ -25,13 +25,11 @@ Publish a generated CLI from your local library to the [printing-press-library](
The public library treats `library/<category>/<api-slug>/.printing-press.json`
and `manifest.json` as the source of truth for registry-display fields. Do not
-edit `registry.json` or README catalog cells in publish PRs; the library's
-post-merge workflow refreshes them from the CLI tree. Do regenerate and commit
-the `cli-skills/pp-<api-slug>/SKILL.md` mirror from
-`library/<category>/<api-slug>/SKILL.md` because PR CI verifies mirror parity.
-If a brand-new CLI's mirror is pruned because `registry.json` is behind, fix the
-library mirror generator to discover from `library/`; do not add a registry
-entry solely to satisfy mirror parity.
+edit `registry.json`, README catalog cells, or `cli-skills/pp-<api-slug>/SKILL.md`
+in publish PRs; all three are bot-regenerated post-merge by the library's own
+workflows. The library's `Guard against hand-edits to cli-skills mirror` check
+rejects any fork PR whose commits touch the mirror, so a publish that includes
+the mirror is pre-rejected before review.
## Setup
@@ -460,10 +458,15 @@ if [ -z "$PRINTER_NAME" ]; then
exit 1
fi
-# Regenerate the flat cli-skills mirror from the library tree so library PR CI passes mirror parity.
-if [ -f "$PUBLISH_REPO_DIR/tools/generate-skills/main.go" ]; then
- (cd "$PUBLISH_REPO_DIR" && go run ./tools/generate-skills/main.go)
-fi
+# Do NOT regenerate or commit `cli-skills/pp-<api-slug>/SKILL.md` here. The
+# mirror is auto-regenerated post-merge by the library's `generate-skills.yml`
+# workflow via a `[skip ci]` bot commit. Including the mirror in a fork PR is
+# pre-rejected by the library's `Guard against hand-edits to cli-skills mirror`
+# check, which fails on any non-bot commit touching the mirror. Same-repo PRs
+# are auto-handled by the library's `Commit generated convention fixes` step,
+# which is gated on `head.repo.full_name == github.repository`. Do not
+# re-introduce a mirror-regenerator invocation here unless the library's
+# Guard check has been loosened to accept publish-flow commits.
# Verify this changed/new CLI builds and has no reachable Go vulnerabilities from the publish repo
cd "$PUBLISH_REPO_DIR/library/<category>/<api-slug>" \
@@ -732,7 +735,7 @@ git checkout -B feat/<api-slug>
```bash
cd "$PUBLISH_REPO_DIR"
-git add library/ cli-skills/
+git add library/
git commit -m "feat(<api-slug>): add <api-slug>"
```
@@ -785,7 +788,7 @@ Build the PR description from:
Read `novel_features` from
`$PUBLISH_REPO_DIR/library/<category>/<api-slug>/.printing-press.json` after
-packaging and mirror regeneration. Preserve the manifest order. Do not derive
+packaging. Preserve the manifest order. Do not derive
this section from README prose, SKILL prose, root help, or memory of the run:
those surfaces may be summarized or hand-edited, while the packaged manifest is
the publish-time source of truth. For each entry, include the command, name, and
← 2abbfec0 fix(scorer): resolve binary at build/stage/bin/ before cliDi
·
back to Cli Printing Press
·
fix(cli): route promoted-command file stem through safeResou bf7f3465 →