skill-inject 0.9.0

skill-inject: local semantic auto-injection of agent skills
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150

name: Release

# Tag-triggered release, modeled on rtk-ai/rtk but scoped to the one platform
# the fastembed build supports: x86_64-unknown-linux-gnu. The ONNX runtime is
# statically linked (ort-download-binaries), so there is no musl target and no
# cross build — a plain glibc binary plus deb/rpm packages.
on:
  push:
    tags: ["v*"]
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag to release (e.g. v0.1.0)"
        required: true

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always
  TARGET: x86_64-unknown-linux-gnu

jobs:
  # Refuse to release if the three manifests have drifted, or if they disagree
  # with the tag being released.
  version-sync:
    name: Version lockstep check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Check versions
        run: bash scripts/version-sync.sh "${{ inputs.tag || github.ref_name }}"

  build:
    name: Build x86_64-unknown-linux-gnu
    needs: version-sync
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-unknown-linux-gnu
      - uses: Swatinem/rust-cache@v2
      - name: Build (default = fastembed)
        run: cargo build --release --target "$TARGET"
      - name: Package tarball
        run: |
          cd "target/$TARGET/release"
          tar -czvf "$GITHUB_WORKSPACE/ski-$TARGET.tar.gz" ski
      - uses: actions/upload-artifact@v4
        with:
          name: ski-tarball
          path: ski-*.tar.gz

  build-deb:
    name: Build .deb
    needs: version-sync
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Install cargo-deb
        run: cargo install cargo-deb --locked
      - name: Build deb
        run: cargo deb
      - uses: actions/upload-artifact@v4
        with:
          name: ski-deb
          path: target/debian/*.deb

  build-rpm:
    name: Build .rpm
    needs: version-sync
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Install cargo-generate-rpm
        run: cargo install cargo-generate-rpm --locked
      - name: Build release binary
        run: cargo build --release
      - name: Generate rpm
        run: cargo generate-rpm
      - uses: actions/upload-artifact@v4
        with:
          name: ski-rpm
          path: target/generate-rpm/*.rpm

  # crates.io publish via Trusted Publishing (OIDC) — no stored token.
  #
  # ONE-TIME BOOTSTRAP (required before this job can succeed):
  #   1. Publish `skill-inject` once manually: `cargo publish` with a token
  #      minted at https://crates.io/settings/tokens (the crate must exist and
  #      you must own it before a trusted publisher can be attached).
  #   2. On crates.io → the crate → Settings → Trusted Publishing → add:
  #      repository `bcmyguest/skill-injector`, workflow `release.yml`.
  # After that, every tagged release publishes here with a 30-minute OIDC token
  # and nothing stored in repo secrets.
  publish-crate:
    name: Publish to crates.io (trusted publishing)
    needs: version-sync
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write # required for OIDC token exchange
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Authenticate to crates.io (OIDC)
        uses: rust-lang/crates-io-auth-action@v1
        id: auth
      - name: cargo publish
        run: cargo publish
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}

  release:
    name: Publish release
    needs: [build, build-deb, build-rpm]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # git-cliff needs full history + tags
      - name: Generate release notes (git-cliff)
        id: notes
        uses: orhun/git-cliff-action@v4
        with:
          config: cliff.toml
          args: --latest --strip header
      - uses: actions/download-artifact@v4
        with:
          path: artifacts
      - name: Stage assets + checksums
        run: |
          mkdir -p release
          find artifacts -type f \( -name '*.tar.gz' -o -name '*.deb' -o -name '*.rpm' \) \
            -exec cp {} release/ \;
          cd release
          sha256sum * > checksums.txt
          ls -l
      - name: Upload to GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ inputs.tag || github.ref_name }}
          files: release/*
          body: ${{ steps.notes.outputs.content }}