[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADCWCGBVG81YM7GH548VBN":3,"skill-same:01M6ADCWCGBVG81YM7GH548VBN":50},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":22,"linkOnly":23,"markdownContent":24,"markdownBody":25,"frontMatter":26,"refName":27,"commitSha":28,"skillDirectory":29,"forksCount":30,"repositoryHtmlUrl":31,"repositoryHomepageUrl":6,"ownerHtmlUrl":32,"ownerBlogUrl":33,"ownerDescription":34,"updatedAt":35,"install":36,"resources":49},"01M6ADCWCGBVG81YM7GH548VBN","get-gh-aw-release-binary",null,"How to fetch the latest github\u002Fgh-aw release binary — either as the gh CLI extension (gh aw ...) or as a raw platform binary downloaded from GitHub Releases — including how to resolve the latest tag, pick the right asset, and verify its checksum.","github\u002Fgh-aw-threat-detection","github","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","01M6AC83DS133TPXFSP1DHNCC6","GitHub","01M6ADCNPQCEMS9GXQZBS2TNGT",15,"MIT","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-threat-detection\u002Fblob\u002Fmain\u002Fskills\u002Fget-gh-aw-release-binary\u002FSKILL.md",[],[19,20,21,9],"release","get gh aw release binary","cli","2026-11-10 10:12:30",false,"---\nname: get-gh-aw-release-binary\ndescription: How to fetch the latest github\u002Fgh-aw release binary — either as the gh CLI extension (gh aw ...) or as a raw platform binary downloaded from GitHub Releases — including how to resolve the latest tag, pick the right asset, and verify its checksum.\n---\n\n# Getting the latest `github\u002Fgh-aw` release binary\n\nUse this skill whenever you need the `gh-aw` compiler binary — for example to\nrecompile agentic workflow `.lock.yml` files (see the\n[`update-workflow-versions`](..\u002Fupdate-workflow-versions\u002FSKILL.md) skill), to\nreproduce a compiled workflow locally, or to run `gh aw` in CI.\n\n`github\u002Fgh-aw` publishes two kinds of consumable artifacts on each GitHub\nRelease:\n\n- **The `gh` CLI extension** — installed with `gh extension install github\u002Fgh-aw`\n  and invoked as `gh aw ...`. This is the normal way to *use* the tool.\n- **Raw platform binaries** — bare release assets named by GOOS\u002FGOARCH\n  (`linux-amd64`, `darwin-arm64`, …) plus a `checksums.txt`. Use these when you\n  need the executable directly (no `gh`, or a pinned standalone binary).\n\nNo authentication is required to download from a **public** repository's\nreleases. In this environment TLS is already trusted (system CA bundle), so\n`curl`, `gh`, and `go` work without extra flags.\n\n## 1. Decide what \"latest\" means\n\n`gh-aw` ships both **stable** releases and **prereleases**. Pick deliberately:\n\n- **Latest stable** — the release GitHub marks as *Latest* (never a prerelease).\n- **Latest overall** — the newest release *or* prerelease by publish date.\n\nResolve the tag (`vX.Y.Z`). Any method works; ignore drafts and rolling refs and\nonly accept tags matching `^v[0-9]`.\n\n```bash\n# Latest STABLE tag (the GitHub \"Latest\" release, excludes prereleases):\ngh release view --repo github\u002Fgh-aw --json tagName --jq .tagName\n# ...or without gh:\ncurl -fsSL https:\u002F\u002Fapi.github.com\u002Frepos\u002Fgithub\u002Fgh-aw\u002Freleases\u002Flatest \\\n  | grep -m1 '\"tag_name\"' | cut -d'\"' -f4\n\n# Latest OVERALL tag (newest release OR prerelease):\ngh api repos\u002Fgithub\u002Fgh-aw\u002Freleases --paginate \\\n  --jq '.[] | select(.draft == false) | select(.tag_name | test(\"^v[0-9]\")) | [.published_at, .tag_name] | @tsv' \\\n  | sort | tail -n1 | cut -f2\n```\n\nRefer to the chosen value below as `\u003CTAG>` (e.g. `v0.83.4`).\n\n> [!NOTE]\n> `\u002Freleases\u002Flatest` and `gh release view` (no tag) return only the release\n> flagged **Latest** — i.e. the newest **stable** one. To include prereleases you\n> must list all releases and sort, as shown above.\n\n## 2a. Install as the `gh` CLI extension (to run `gh aw`)\n\nThis is the right choice when you want to *run* the compiler.\n\n```bash\n# Latest available (stable) extension:\ngh extension install github\u002Fgh-aw\n\n# Pin to a specific tag (repeat with --force to switch versions):\ngh extension install github\u002Fgh-aw --pin \u003CTAG> --force\n\n# Verify:\ngh aw version        # -> \"gh aw version \u003CTAG>\"\n\n# Later, upgrade to the newest published extension:\ngh extension upgrade gh-aw\n```\n\nThe compiler baked-in version is what stamps `compiler_version` into generated\n`.lock.yml` files, so pin the extension to the exact `\u003CTAG>` you intend the\nlocks to track.\n\n## 2b. Download the raw platform binary\n\nUse this when you need the executable directly. Release assets are **bare**\nGOOS\u002FGOARCH names (no `gh-aw-` prefix):\n\n| Platform            | Asset name           |\n|---------------------|----------------------|\n| Linux x86_64        | `linux-amd64`        |\n| Linux arm64         | `linux-arm64`        |\n| macOS Intel         | `darwin-amd64`       |\n| macOS Apple Silicon | `darwin-arm64`       |\n| Windows x86_64      | `windows-amd64.exe`  |\n| Windows arm64       | `windows-arm64.exe`  |\n\nAlso published: `checksums.txt`, a WASM tarball (`gh-aw-wasm-\u003CTAG>.tar.gz`), and\nassorted `freebsd-*` \u002F `android-*` builds.\n\nPick the asset for the current machine:\n\n```bash\ncase \"$(uname -s)-$(uname -m)\" in\n  Linux-x86_64)   ASSET=linux-amd64 ;;\n  Linux-aarch64)  ASSET=linux-arm64 ;;\n  Darwin-x86_64)  ASSET=darwin-amd64 ;;\n  Darwin-arm64)   ASSET=darwin-arm64 ;;\n  *) echo \"unsupported platform: $(uname -s)-$(uname -m)\" >&2; exit 1 ;;\nesac\n```\n\nDownload with `gh` (resolves the tag for you) …\n\n```bash\ngh release download \u003CTAG> --repo github\u002Fgh-aw \\\n  --pattern \"$ASSET\" --pattern checksums.txt --dir \u002Ftmp\u002Fgh-aw-dl --clobber\n```\n\n… or with plain `curl` against the predictable asset URL:\n\n```bash\nBASE=\"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Freleases\u002Fdownload\u002F\u003CTAG>\"\nmkdir -p \u002Ftmp\u002Fgh-aw-dl\ncurl -fsSL \"$BASE\u002F$ASSET\"        -o \u002Ftmp\u002Fgh-aw-dl\u002F\"$ASSET\"\ncurl -fsSL \"$BASE\u002Fchecksums.txt\" -o \u002Ftmp\u002Fgh-aw-dl\u002Fchecksums.txt\n```\n\n## 3. Verify the checksum\n\n`checksums.txt` has one `sha256␠␠asset-name` line per asset.\n\n```bash\ncd \u002Ftmp\u002Fgh-aw-dl\n# Verify just the asset you downloaded:\ngrep \" $ASSET\\$\" checksums.txt | sha256sum -c -\n# -> \"\u003Casset>: OK\"\n```\n\n## 4. Make it executable and use it\n\n```bash\ninstall -m 0755 \u002Ftmp\u002Fgh-aw-dl\u002F\"$ASSET\" \u002Ftmp\u002Fgh-aw\n\u002Ftmp\u002Fgh-aw version        # confirm it matches \u003CTAG>\n\n# Example: compile workflows with the pinned binary\n\u002Ftmp\u002Fgh-aw compile --action-mode action --action-tag \u003CTAG> --no-check-update \\\n  .github\u002Fworkflows\u002F\u003Cfile>.md\n```\n\n## Notes\n\n- **Extension vs raw binary** produce the same compiler; use the extension to run\n  `gh aw`, the raw binary when you need a standalone, pinnable executable.\n- **Don't confuse repos.** This skill is about the **`github\u002Fgh-aw`** compiler.\n  The **`threat-detect`** binary this repository ships is released separately from\n  **`github\u002Fgh-aw-threat-detection`** (assets `threat-detect-linux-amd64` \u002F\n  `threat-detect-linux-arm64`); the same tag-resolution and checksum steps apply,\n  only the repo and asset names differ.\n- **Compiler version matters.** Whatever binary you compile with stamps its\n  version into `.lock.yml` (`compiler_version`), which the **gh-aw Version Check**\n  workflow validates — so match `\u003CTAG>` to the version the locks should track.\n","# Getting the latest `github\u002Fgh-aw` release binary\n\nUse this skill whenever you need the `gh-aw` compiler binary — for example to\nrecompile agentic workflow `.lock.yml` files (see the\n[`update-workflow-versions`](..\u002Fupdate-workflow-versions\u002FSKILL.md) skill), to\nreproduce a compiled workflow locally, or to run `gh aw` in CI.\n\n`github\u002Fgh-aw` publishes two kinds of consumable artifacts on each GitHub\nRelease:\n\n- **The `gh` CLI extension** — installed with `gh extension install github\u002Fgh-aw`\n  and invoked as `gh aw ...`. This is the normal way to *use* the tool.\n- **Raw platform binaries** — bare release assets named by GOOS\u002FGOARCH\n  (`linux-amd64`, `darwin-arm64`, …) plus a `checksums.txt`. Use these when you\n  need the executable directly (no `gh`, or a pinned standalone binary).\n\nNo authentication is required to download from a **public** repository's\nreleases. In this environment TLS is already trusted (system CA bundle), so\n`curl`, `gh`, and `go` work without extra flags.\n\n## 1. Decide what \"latest\" means\n\n`gh-aw` ships both **stable** releases and **prereleases**. Pick deliberately:\n\n- **Latest stable** — the release GitHub marks as *Latest* (never a prerelease).\n- **Latest overall** — the newest release *or* prerelease by publish date.\n\nResolve the tag (`vX.Y.Z`). Any method works; ignore drafts and rolling refs and\nonly accept tags matching `^v[0-9]`.\n\n```bash\n# Latest STABLE tag (the GitHub \"Latest\" release, excludes prereleases):\ngh release view --repo github\u002Fgh-aw --json tagName --jq .tagName\n# ...or without gh:\ncurl -fsSL https:\u002F\u002Fapi.github.com\u002Frepos\u002Fgithub\u002Fgh-aw\u002Freleases\u002Flatest \\\n  | grep -m1 '\"tag_name\"' | cut -d'\"' -f4\n\n# Latest OVERALL tag (newest release OR prerelease):\ngh api repos\u002Fgithub\u002Fgh-aw\u002Freleases --paginate \\\n  --jq '.[] | select(.draft == false) | select(.tag_name | test(\"^v[0-9]\")) | [.published_at, .tag_name] | @tsv' \\\n  | sort | tail -n1 | cut -f2\n```\n\nRefer to the chosen value below as `\u003CTAG>` (e.g. `v0.83.4`).\n\n> [!NOTE]\n> `\u002Freleases\u002Flatest` and `gh release view` (no tag) return only the release\n> flagged **Latest** — i.e. the newest **stable** one. To include prereleases you\n> must list all releases and sort, as shown above.\n\n## 2a. Install as the `gh` CLI extension (to run `gh aw`)\n\nThis is the right choice when you want to *run* the compiler.\n\n```bash\n# Latest available (stable) extension:\ngh extension install github\u002Fgh-aw\n\n# Pin to a specific tag (repeat with --force to switch versions):\ngh extension install github\u002Fgh-aw --pin \u003CTAG> --force\n\n# Verify:\ngh aw version        # -> \"gh aw version \u003CTAG>\"\n\n# Later, upgrade to the newest published extension:\ngh extension upgrade gh-aw\n```\n\nThe compiler baked-in version is what stamps `compiler_version` into generated\n`.lock.yml` files, so pin the extension to the exact `\u003CTAG>` you intend the\nlocks to track.\n\n## 2b. Download the raw platform binary\n\nUse this when you need the executable directly. Release assets are **bare**\nGOOS\u002FGOARCH names (no `gh-aw-` prefix):\n\n| Platform            | Asset name           |\n|---------------------|----------------------|\n| Linux x86_64        | `linux-amd64`        |\n| Linux arm64         | `linux-arm64`        |\n| macOS Intel         | `darwin-amd64`       |\n| macOS Apple Silicon | `darwin-arm64`       |\n| Windows x86_64      | `windows-amd64.exe`  |\n| Windows arm64       | `windows-arm64.exe`  |\n\nAlso published: `checksums.txt`, a WASM tarball (`gh-aw-wasm-\u003CTAG>.tar.gz`), and\nassorted `freebsd-*` \u002F `android-*` builds.\n\nPick the asset for the current machine:\n\n```bash\ncase \"$(uname -s)-$(uname -m)\" in\n  Linux-x86_64)   ASSET=linux-amd64 ;;\n  Linux-aarch64)  ASSET=linux-arm64 ;;\n  Darwin-x86_64)  ASSET=darwin-amd64 ;;\n  Darwin-arm64)   ASSET=darwin-arm64 ;;\n  *) echo \"unsupported platform: $(uname -s)-$(uname -m)\" >&2; exit 1 ;;\nesac\n```\n\nDownload with `gh` (resolves the tag for you) …\n\n```bash\ngh release download \u003CTAG> --repo github\u002Fgh-aw \\\n  --pattern \"$ASSET\" --pattern checksums.txt --dir \u002Ftmp\u002Fgh-aw-dl --clobber\n```\n\n… or with plain `curl` against the predictable asset URL:\n\n```bash\nBASE=\"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw\u002Freleases\u002Fdownload\u002F\u003CTAG>\"\nmkdir -p \u002Ftmp\u002Fgh-aw-dl\ncurl -fsSL \"$BASE\u002F$ASSET\"        -o \u002Ftmp\u002Fgh-aw-dl\u002F\"$ASSET\"\ncurl -fsSL \"$BASE\u002Fchecksums.txt\" -o \u002Ftmp\u002Fgh-aw-dl\u002Fchecksums.txt\n```\n\n## 3. Verify the checksum\n\n`checksums.txt` has one `sha256␠␠asset-name` line per asset.\n\n```bash\ncd \u002Ftmp\u002Fgh-aw-dl\n# Verify just the asset you downloaded:\ngrep \" $ASSET\\$\" checksums.txt | sha256sum -c -\n# -> \"\u003Casset>: OK\"\n```\n\n## 4. Make it executable and use it\n\n```bash\ninstall -m 0755 \u002Ftmp\u002Fgh-aw-dl\u002F\"$ASSET\" \u002Ftmp\u002Fgh-aw\n\u002Ftmp\u002Fgh-aw version        # confirm it matches \u003CTAG>\n\n# Example: compile workflows with the pinned binary\n\u002Ftmp\u002Fgh-aw compile --action-mode action --action-tag \u003CTAG> --no-check-update \\\n  .github\u002Fworkflows\u002F\u003Cfile>.md\n```\n\n## Notes\n\n- **Extension vs raw binary** produce the same compiler; use the extension to run\n  `gh aw`, the raw binary when you need a standalone, pinnable executable.\n- **Don't confuse repos.** This skill is about the **`github\u002Fgh-aw`** compiler.\n  The **`threat-detect`** binary this repository ships is released separately from\n  **`github\u002Fgh-aw-threat-detection`** (assets `threat-detect-linux-amd64` \u002F\n  `threat-detect-linux-arm64`); the same tag-resolution and checksum steps apply,\n  only the repo and asset names differ.\n- **Compiler version matters.** Whatever binary you compile with stamps its\n  version into `.lock.yml` (`compiler_version`), which the **gh-aw Version Check**\n  workflow validates — so match `\u003CTAG>` to the version the locks should track.\n",{"name":5,"description":7},"main","76a4653600a9211a9dfe5e50cda88708ec918ced","skills\u002Fget-gh-aw-release-binary",8,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-threat-detection","https:\u002F\u002Fgithub.com\u002Fgithub","https:\u002F\u002Fgithub.com\u002Fabout","How people build software.","2026-11-11 11:34:58",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add github\u002Fgh-aw-threat-detection --skill get-gh-aw-release-binary",{"tool":42,"command":43},"bunx","bunx skills add github\u002Fgh-aw-threat-detection --skill get-gh-aw-release-binary",{"tool":45,"command":46},"pnpm","pnpm dlx skills add github\u002Fgh-aw-threat-detection --skill get-gh-aw-release-binary","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-threat-detection\u002Fblob\u002Fmain\u002Fskills\u002Fget-gh-aw-release-binary\u002FSKILL.md",true,[],[51,69,79,89],{"skillNo":52,"name":53,"nameZh":6,"description":54,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":55,"categories":56,"keywords":62,"publishedAt":22},"01M6ADCY2GJ9YPES5TYZQ56DK6","update-workflow-versions","How to manually regenerate the compiled agentic workflow .lock.yml files when the gh-aw Version Check workflow reports version drift. All workflows track the newest github\u002Fgh-aw release or prerelease.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-threat-detection\u002Fblob\u002Fmain\u002Fskills\u002Fupdate-workflow-versions\u002FSKILL.md",[57],{"categoryNo":58,"categoryName":59,"taxonomyType":60,"taxonomyTypeDesc":61},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[63,64,65,9,66,67,68,19],"update workflow versions","update","workflow","agentic","agentic workflow","workflows",{"skillNo":70,"name":71,"nameZh":6,"description":72,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":73,"categories":74,"keywords":75,"publishedAt":22},"01M6ADCTM254M9KNW1T21TTJFJ","error-messages","Error Message Style Guide for Validation Errors","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-threat-detection\u002Fblob\u002Fmain\u002Fskills\u002Ferror-messages\u002FSKILL.md",[],[76,77,78],"messages","error messages","validation",{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":22},"01M6ADCS45KNQGSY6GP1PVMCBK","console-rendering","Instructions for using the struct tag-based console rendering system in Go","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-threat-detection\u002Fblob\u002Fmain\u002Fskills\u002Fconsole-rendering\u002FSKILL.md",[],[86,87,88],"console rendering","console","go",{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":22},"01M6ADCQTSVP6607C201HSD19H","lane","Use lane in this repository when the user asks to create or work in an isolated worktree.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-threat-detection\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Flane\u002FSKILL.md",[],[91,96,97,98],"create","repository","worktree"]