* ci(skills): pin clawhub CLI by hash via committed lockfile
Scorecard flags the skill-release workflow's npm install of the clawhub
CLI (code-scanning alerts #25/#26): version pinning alone carries no
integrity guarantee. Install it with npm ci from a committed
package-lock.json instead, so every package (clawhub + 35 transitive
deps) is verified against its sha512 hash at install time.
The publish-payload patch step now resolves the module from the local
node_modules instead of npm root -g.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(skill-release): authenticate pinned clawhub install
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix(skills): scan staged payload with skillspector
* fix(skills): embed skillspector report in releases
* fix(skills): use body path for release notes
* ci(skills): publish release trust packets
* ci(skills): simulate beta tag releases
* ci(skills): match release version bump rules
* chore(skills): group agent skills for installer
* chore(skills): make clawtributor global
* chore(skills): bump all skills for trust release
* ci(skills): require npx install docs
* fix(skills): simulate prerelease tag versions
* fix(skills): aggregate trust artifact checksum failures
* fix(frontend): advertise npx skills suite install
* chore(frontend): drop ad hoc homepage copy test
* fix(ci): run skill release tooling tests
davida-ps
David Abutbul