Bump the "skillsaw" group with 2 updates across multiple ecosystems

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps the skillsaw group with 2 updates: stbenjam/skillsaw and stbenjam/skillsaw/review.

Updates stbenjam/skillsaw from 0.17.0 to 0.18.0

Release notes

Sourced from stbenjam/skillsaw's releases.

v0.18.0

skillsaw now lints two more plugin ecosystems — Agent Plugins v1 and OpenAI Codex — and the new skillsaw port command converts your existing Claude Code and Codex plugins to the vendor-neutral format in one pass. The default rule set got quieter: newer models don't trip over hedged prose the way older ones did, so the rules policing it moved to info severity or retired. And the Claude Code format rules now carry a claude- prefix to match codex-; every old name still works.

New platforms

• Agent Plugins v1. agent-plugin-json-valid and agent-plugin-mcp-valid check portable plugin packages against the official 1.0.0 schemas: root plugin.json, optional mcp.json, path containment, MCP transport rules, and no embedded credentials — findings never echo the secret itself. Auto-enabled when a manifest declares the Agent Plugins schema. (#483)
• OpenAI Codex plugins and marketplaces. Five codex-* rules cover .codex-plugin/plugin.json manifests, plugin structure, .agents/plugins/marketplace.json catalogs (with a suggested fix that appends missing registrations), and the optional agents/openai.yaml skill metadata. Discovery understands ownership: a Codex-only plugin is exempt from Claude format rules, dual-manifest plugins keep both sets, and a directory a marketplace registers but never gives a plugin.json is now reported instead of silently skipped. (#471)

Port your plugins to the portable format

$ skillsaw port --to agent-plugin .
✓ [plugins/release-notes] claude → plugin.json, mcp.json
✓ [plugins/issue-triage] codex → plugin.json
Summary:
Ported:     2 plugins (2 plugin.json, 1 mcp.json)
Catalog:    .agents/plugins/marketplace.json (2 entries)
Validation: ✓ passed
✓ Converted 2 plugins to Agent Plugins v1

One command makes every plugin in a repository or marketplace installable by any Agent Plugins client. The port is additive — it writes a root plugin.json (and mcp.json when the plugin has a Claude MCP config, translating http to streamable-http and ${CLAUDE_PLUGIN_ROOT} to ${PLUGIN_ROOT}) and never touches the source format's files, so Claude Code and Codex keep working unchanged. Anything the portable format can't express is skipped with a note rather than mistranslated, every run ends with the Agent Plugins rules validating the output, and nothing that already exists is ever overwritten: foreign manifests are refused, existing catalogs and MCP files are left alone, and reruns are no-ops.

Because Agent Plugins defines a package rather than a marketplace, a multi-plugin port also writes Codex's .agents/plugins/marketplace.json so catalog-driven clients can discover the ported plugins (--marketplaces codex, the default; none to skip).

The opt-in agent-plugin-required rule makes the conversion a standing guarantee: a plugin missing the portable manifest is a lint finding with a SAFE autofix that runs the same conversion, and metadata drift between manifests or a missing portable MCP config is reported. Enable it in CI and no plugin merges without the vendor-neutral format.

Proven against real repositories before release: all 180 plugins in openai/plugins (existing catalog left untouched), all 40 in openshift-eng/ai-helpers (byte-identical to that repo's hand-written manifests), and all 40 in anthropics/claude-plugins-official. (#486)

New rules

• content-description-routing (warning). A skill or agent description has one job: telling the model when to route to it. This rule flags descriptions with no when-to-use phrasing and descriptions that only restate the name. Both checks are configurable, and user-invoked skills (disable-model-invocation: true) are skipped since routing phrasing doesn't apply to them. (#479, #482)
• coderabbit-schema-valid. Catches .coderabbit.yaml keys CodeRabbit silently ignores — review: instead of reviews: reverts the whole block to defaults with no error — and invalid reviews.profile values. (#442)

Quieter defaults

Anthropic's own official plugins break the hedging rules a hundred times over and work fine, so the defaults now reflect how current models actually behave:

• content-weak-language, content-tautological, content-negative-only, and content-critical-position dropped from warning to info. (#484)
• content-critical-position and content-actionability-score (attention-era heuristics) and skill-frontmatter (superseded by agentskill-valid, which inherited its autofix) are deprecated. They no longer run under enabled: auto and are gone from generated configs; enabled: true or --rule still runs them, with a warning that removal is coming. Those warnings are advisory — they never change the exit code, grade, badge, or baselines, so upgrading cannot break a strict: true CI run. The deprecated rules page explains why each rule went. (#484)

Checked against five real repositories before release: grades improve or hold on every one, and none changes exit code.

New names

The 13 Claude Code format rules are canonical under claude- prefixes: claude-plugin-json-required, claude-plugin-json-valid, claude-plugin-naming, claude-plugin-readme, claude-marketplace-json-valid, claude-marketplace-registration, claude-agent-frontmatter, claude-command-frontmatter, claude-command-naming, claude-command-name-format, claude-command-sections, claude-settings-dangerous, and claude-rules-valid. Cross-ecosystem rules (hooks-*, mcp-*, instruction-*, content and security) keep bare names.

Old names keep working everywhere a rule is named: config keys, --rule/--skip-rule, skillsaw explain, suppression comments, and existing baselines all resolve them. Plugin and custom rules can't claim a legacy name or skillsaw's reserved advisory ID — alias resolution would make them unaddressable, so they're skipped with a warning. (#484, #485)

... (truncated)

Commits

• c325108 Fix macOS-only test failures in instruction imports tests (#487)
• 10651c9 Add skillsaw port: convert Claude/Codex plugins to Agent Plugins v1 (#486)
• d50ae7e Reserve legacy aliases and advisory IDs against plugin rule collisions (#485)
• 745952f 0.18.0 rule defaults: quieter content rules, deprecation mechanism, claude- r...
• 42a474a Add Agent Plugins v1 linting (#483)
• fb795cb Skip user-only skills in description routing (#482)
• e000821 Fix authorized 0.18.0 bug sweep (#478)
• 53a4eba Decompose repository discovery from context (#481)
• 0f41cce Add description routing quality rule (#479)
• 0155509 Retire unsafe path resolution calls (#480)
• Additional commits viewable in compare view

Updates stbenjam/skillsaw/review from 0.17.0 to 0.18.0

Release notes

Sourced from stbenjam/skillsaw/review's releases.

v0.18.0

skillsaw now lints two more plugin ecosystems — Agent Plugins v1 and OpenAI Codex — and the new skillsaw port command converts your existing Claude Code and Codex plugins to the vendor-neutral format in one pass. The default rule set got quieter: newer models don't trip over hedged prose the way older ones did, so the rules policing it moved to info severity or retired. And the Claude Code format rules now carry a claude- prefix to match codex-; every old name still works.

New platforms

• Agent Plugins v1. agent-plugin-json-valid and agent-plugin-mcp-valid check portable plugin packages against the official 1.0.0 schemas: root plugin.json, optional mcp.json, path containment, MCP transport rules, and no embedded credentials — findings never echo the secret itself. Auto-enabled when a manifest declares the Agent Plugins schema. (#483)
• OpenAI Codex plugins and marketplaces. Five codex-* rules cover .codex-plugin/plugin.json manifests, plugin structure, .agents/plugins/marketplace.json catalogs (with a suggested fix that appends missing registrations), and the optional agents/openai.yaml skill metadata. Discovery understands ownership: a Codex-only plugin is exempt from Claude format rules, dual-manifest plugins keep both sets, and a directory a marketplace registers but never gives a plugin.json is now reported instead of silently skipped. (#471)

Port your plugins to the portable format

$ skillsaw port --to agent-plugin .
✓ [plugins/release-notes] claude → plugin.json, mcp.json
✓ [plugins/issue-triage] codex → plugin.json
Summary:
Ported:     2 plugins (2 plugin.json, 1 mcp.json)
Catalog:    .agents/plugins/marketplace.json (2 entries)
Validation: ✓ passed
✓ Converted 2 plugins to Agent Plugins v1

One command makes every plugin in a repository or marketplace installable by any Agent Plugins client. The port is additive — it writes a root plugin.json (and mcp.json when the plugin has a Claude MCP config, translating http to streamable-http and ${CLAUDE_PLUGIN_ROOT} to ${PLUGIN_ROOT}) and never touches the source format's files, so Claude Code and Codex keep working unchanged. Anything the portable format can't express is skipped with a note rather than mistranslated, every run ends with the Agent Plugins rules validating the output, and nothing that already exists is ever overwritten: foreign manifests are refused, existing catalogs and MCP files are left alone, and reruns are no-ops.

Because Agent Plugins defines a package rather than a marketplace, a multi-plugin port also writes Codex's .agents/plugins/marketplace.json so catalog-driven clients can discover the ported plugins (--marketplaces codex, the default; none to skip).

The opt-in agent-plugin-required rule makes the conversion a standing guarantee: a plugin missing the portable manifest is a lint finding with a SAFE autofix that runs the same conversion, and metadata drift between manifests or a missing portable MCP config is reported. Enable it in CI and no plugin merges without the vendor-neutral format.

Proven against real repositories before release: all 180 plugins in openai/plugins (existing catalog left untouched), all 40 in openshift-eng/ai-helpers (byte-identical to that repo's hand-written manifests), and all 40 in anthropics/claude-plugins-official. (#486)

New rules

• content-description-routing (warning). A skill or agent description has one job: telling the model when to route to it. This rule flags descriptions with no when-to-use phrasing and descriptions that only restate the name. Both checks are configurable, and user-invoked skills (disable-model-invocation: true) are skipped since routing phrasing doesn't apply to them. (#479, #482)
• coderabbit-schema-valid. Catches .coderabbit.yaml keys CodeRabbit silently ignores — review: instead of reviews: reverts the whole block to defaults with no error — and invalid reviews.profile values. (#442)

Quieter defaults

Anthropic's own official plugins break the hedging rules a hundred times over and work fine, so the defaults now reflect how current models actually behave:

• content-weak-language, content-tautological, content-negative-only, and content-critical-position dropped from warning to info. (#484)
• content-critical-position and content-actionability-score (attention-era heuristics) and skill-frontmatter (superseded by agentskill-valid, which inherited its autofix) are deprecated. They no longer run under enabled: auto and are gone from generated configs; enabled: true or --rule still runs them, with a warning that removal is coming. Those warnings are advisory — they never change the exit code, grade, badge, or baselines, so upgrading cannot break a strict: true CI run. The deprecated rules page explains why each rule went. (#484)

Checked against five real repositories before release: grades improve or hold on every one, and none changes exit code.

New names

The 13 Claude Code format rules are canonical under claude- prefixes: claude-plugin-json-required, claude-plugin-json-valid, claude-plugin-naming, claude-plugin-readme, claude-marketplace-json-valid, claude-marketplace-registration, claude-agent-frontmatter, claude-command-frontmatter, claude-command-naming, claude-command-name-format, claude-command-sections, claude-settings-dangerous, and claude-rules-valid. Cross-ecosystem rules (hooks-*, mcp-*, instruction-*, content and security) keep bare names.

Old names keep working everywhere a rule is named: config keys, --rule/--skip-rule, skillsaw explain, suppression comments, and existing baselines all resolve them. Plugin and custom rules can't claim a legacy name or skillsaw's reserved advisory ID — alias resolution would make them unaddressable, so they're skipped with a warning. (#484, #485)

... (truncated)

Commits

• c325108 Fix macOS-only test failures in instruction imports tests (#487)
• 10651c9 Add skillsaw port: convert Claude/Codex plugins to Agent Plugins v1 (#486)
• d50ae7e Reserve legacy aliases and advisory IDs against plugin rule collisions (#485)
• 745952f 0.18.0 rule defaults: quieter content rules, deprecation mechanism, claude- r...
• 42a474a Add Agent Plugins v1 linting (#483)
• fb795cb Skip user-only skills in description routing (#482)
• e000821 Fix authorized 0.18.0 bug sweep (#478)
• 53a4eba Decompose repository discovery from context (#481)
• 0f41cce Add description routing quality rule (#479)
• 0155509 Retire unsafe path resolution calls (#480)
• Additional commits viewable in compare view

Bumps the skillsaw group with 1 update: skillsaw.

Updates skillsaw from 0.17.0 to 0.18.0

Release notes

Sourced from skillsaw's releases.

v0.18.0

skillsaw now lints two more plugin ecosystems — Agent Plugins v1 and OpenAI Codex — and the new skillsaw port command converts your existing Claude Code and Codex plugins to the vendor-neutral format in one pass. The default rule set got quieter: newer models don't trip over hedged prose the way older ones did, so the rules policing it moved to info severity or retired. And the Claude Code format rules now carry a claude- prefix to match codex-; every old name still works.

New platforms

• Agent Plugins v1. agent-plugin-json-valid and agent-plugin-mcp-valid check portable plugin packages against the official 1.0.0 schemas: root plugin.json, optional mcp.json, path containment, MCP transport rules, and no embedded credentials — findings never echo the secret itself. Auto-enabled when a manifest declares the Agent Plugins schema. (#483)
• OpenAI Codex plugins and marketplaces. Five codex-* rules cover .codex-plugin/plugin.json manifests, plugin structure, .agents/plugins/marketplace.json catalogs (with a suggested fix that appends missing registrations), and the optional agents/openai.yaml skill metadata. Discovery understands ownership: a Codex-only plugin is exempt from Claude format rules, dual-manifest plugins keep both sets, and a directory a marketplace registers but never gives a plugin.json is now reported instead of silently skipped. (#471)

Port your plugins to the portable format

$ skillsaw port --to agent-plugin .
✓ [plugins/release-notes] claude → plugin.json, mcp.json
✓ [plugins/issue-triage] codex → plugin.json
Summary:
Ported:     2 plugins (2 plugin.json, 1 mcp.json)
Catalog:    .agents/plugins/marketplace.json (2 entries)
Validation: ✓ passed
✓ Converted 2 plugins to Agent Plugins v1

One command makes every plugin in a repository or marketplace installable by any Agent Plugins client. The port is additive — it writes a root plugin.json (and mcp.json when the plugin has a Claude MCP config, translating http to streamable-http and ${CLAUDE_PLUGIN_ROOT} to ${PLUGIN_ROOT}) and never touches the source format's files, so Claude Code and Codex keep working unchanged. Anything the portable format can't express is skipped with a note rather than mistranslated, every run ends with the Agent Plugins rules validating the output, and nothing that already exists is ever overwritten: foreign manifests are refused, existing catalogs and MCP files are left alone, and reruns are no-ops.

Because Agent Plugins defines a package rather than a marketplace, a multi-plugin port also writes Codex's .agents/plugins/marketplace.json so catalog-driven clients can discover the ported plugins (--marketplaces codex, the default; none to skip).

The opt-in agent-plugin-required rule makes the conversion a standing guarantee: a plugin missing the portable manifest is a lint finding with a SAFE autofix that runs the same conversion, and metadata drift between manifests or a missing portable MCP config is reported. Enable it in CI and no plugin merges without the vendor-neutral format.

Proven against real repositories before release: all 180 plugins in openai/plugins (existing catalog left untouched), all 40 in openshift-eng/ai-helpers (byte-identical to that repo's hand-written manifests), and all 40 in anthropics/claude-plugins-official. (#486)

New rules

• content-description-routing (warning). A skill or agent description has one job: telling the model when to route to it. This rule flags descriptions with no when-to-use phrasing and descriptions that only restate the name. Both checks are configurable, and user-invoked skills (disable-model-invocation: true) are skipped since routing phrasing doesn't apply to them. (#479, #482)
• coderabbit-schema-valid. Catches .coderabbit.yaml keys CodeRabbit silently ignores — review: instead of reviews: reverts the whole block to defaults with no error — and invalid reviews.profile values. (#442)

Quieter defaults

Anthropic's own official plugins break the hedging rules a hundred times over and work fine, so the defaults now reflect how current models actually behave:

• content-weak-language, content-tautological, content-negative-only, and content-critical-position dropped from warning to info. (#484)
• content-critical-position and content-actionability-score (attention-era heuristics) and skill-frontmatter (superseded by agentskill-valid, which inherited its autofix) are deprecated. They no longer run under enabled: auto and are gone from generated configs; enabled: true or --rule still runs them, with a warning that removal is coming. Those warnings are advisory — they never change the exit code, grade, badge, or baselines, so upgrading cannot break a strict: true CI run. The deprecated rules page explains why each rule went. (#484)

Checked against five real repositories before release: grades improve or hold on every one, and none changes exit code.

New names

The 13 Claude Code format rules are canonical under claude- prefixes: claude-plugin-json-required, claude-plugin-json-valid, claude-plugin-naming, claude-plugin-readme, claude-marketplace-json-valid, claude-marketplace-registration, claude-agent-frontmatter, claude-command-frontmatter, claude-command-naming, claude-command-name-format, claude-command-sections, claude-settings-dangerous, and claude-rules-valid. Cross-ecosystem rules (hooks-*, mcp-*, instruction-*, content and security) keep bare names.

Old names keep working everywhere a rule is named: config keys, --rule/--skip-rule, skillsaw explain, suppression comments, and existing baselines all resolve them. Plugin and custom rules can't claim a legacy name or skillsaw's reserved advisory ID — alias resolution would make them unaddressable, so they're skipped with a warning. (#484, #485)

... (truncated)

Commits

• c325108 Fix macOS-only test failures in instruction imports tests (#487)
• 10651c9 Add skillsaw port: convert Claude/Codex plugins to Agent Plugins v1 (#486)
• d50ae7e Reserve legacy aliases and advisory IDs against plugin rule collisions (#485)
• 745952f 0.18.0 rule defaults: quieter content rules, deprecation mechanism, claude- r...
• 42a474a Add Agent Plugins v1 linting (#483)
• fb795cb Skip user-only skills in description routing (#482)
• e000821 Fix authorized 0.18.0 bug sweep (#478)
• 53a4eba Decompose repository discovery from context (#481)
• 0f41cce Add description routing quality rule (#479)
• 0155509 Retire unsafe path resolution calls (#480)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by CodeRabbit

• Chores
  • Updated development tooling to the latest Skillsaw 0.18.0 release.
  • Updated automated linting and review checks to use the newer tooling version.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dependabot[bot]
Once this PR has been reviewed and has the lgtm label, please assign enxebre for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• .github/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: f5800eba-84ac-43cf-8474-af416c0ea6c5

📥 Commits

Reviewing files that changed from the base of the PR and between 95991b3 and 3482a93.

📒 Files selected for processing (3)

• .github/workflows/lint-plugins.yml
• .github/workflows/lint-review.yml
• requirements-dev.txt

---

Walkthrough

The pull request updates both Skillsaw GitHub Actions and the development dependency from version 0.17.0 to version 0.18.0.

Changes

Skillsaw upgrade

Layer / File(s)	Summary
Update Skillsaw pins .github/workflows/lint-plugins.yml, .github/workflows/lint-review.yml, requirements-dev.txt	The workflows and development dependency now use Skillsaw version 0.18.0 with updated pins.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• openshift-eng/ai-helpers#505: Updates Skillsaw in the same workflow files.
• openshift-eng/ai-helpers#637: Updates the same stbenjam/skillsaw/review action.
• openshift-eng/ai-helpers#640: Updates the Skillsaw action in lint-plugins.yml.

Suggested reviewers: cblecker, stbenjam

🚥 Pre-merge checks | ✅ 10

✅ Passed checks (10 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No Real People Names In Style References	✅ Passed	The PR diff only updates skillsaw pins from 0.17.0 to 0.18.0 in two workflows and requirements-dev.txt; it adds no plugin commands, skills, docs, prompts, or style references.
No Assumed Git Remote Names	✅ Passed	The exact PR diff only changes skillsaw action and package versions; it adds no git commands, skills, documentation, or hardcoded origin/upstream remote names.
Git Push Safety Rules	✅ Passed	The diff only updates Skillsaw versions; the sole push occurrence is a GitHub Actions trigger, not a git push command or automated branch/force push.
No Untrusted Mcp Servers	✅ Passed	The exact PR diff only bumps pinned skillsaw actions and the skillsaw Python dependency; it adds no MCP server package, install command, or untrusted server source.
Ai-Helpers Overlap Detection	✅ Passed	The diff changes only two workflow action pins and requirements-dev.txt; no plugins//commands, plugins//skills//SKILL.md, or agents/ files are modified.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the skillsaw dependency updates across multiple ecosystems.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/skillsaw-d87b4fc716

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.