[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADCY2GJ9YPES5TYZQ56DK6":3,"skill-same:01M6ADCY2GJ9YPES5TYZQ56DK6":59},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":31,"linkOnly":32,"markdownContent":33,"markdownBody":34,"frontMatter":35,"refName":36,"commitSha":37,"skillDirectory":38,"forksCount":39,"repositoryHtmlUrl":40,"repositoryHomepageUrl":6,"ownerHtmlUrl":41,"ownerBlogUrl":42,"ownerDescription":43,"updatedAt":44,"install":45,"resources":58},"01M6ADCY2GJ9YPES5TYZQ56DK6","update-workflow-versions",null,"How to manually regenerate the compiled agentic workflow .lock.yml files when the gh-aw Version Check workflow reports version drift. All workflows track the newest github\u002Fgh-aw release or prerelease.","github\u002Fgh-aw-threat-detection","github","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","01M6AC83DS133TPXFSP1DHNCC6","GitHub","01M6ADCNPQCEMS9GXQZBS2TNGT",16,"MIT","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-threat-detection\u002Fblob\u002Fmain\u002Fskills\u002Fupdate-workflow-versions\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,9,27,28,29,30],"workflow","update","update workflow versions","agentic","agentic workflow","workflows","release","2026-11-10 10:12:30",false,"---\nname: update-workflow-versions\ndescription: How to manually regenerate the compiled agentic workflow .lock.yml files when the gh-aw Version Check workflow reports version drift. All workflows track the newest github\u002Fgh-aw release or prerelease.\n---\n\n# Updating Agentic Workflow Versions\n\nUse this skill when the **gh-aw Version Check** workflow\n(`.github\u002Fworkflows\u002Fgh-aw-version-check.yml`) opens a *\"Workflow version drift\"*\nissue, or whenever you need to bump the versions the compiled workflow\n`.lock.yml` files are pinned to.\n\nThere is no automation for the regeneration itself — it is a deliberate,\nhuman-reviewed step. Pushing changes under `.github\u002Fworkflows\u002F` requires a token\nwith the `workflows` permission, which the built-in `GITHUB_TOKEN` lacks, so a\nmaintainer (or an agent with suitably-permissioned credentials) performs the\nrecompile locally and opens a PR.\n\n## Background\n\nEach agentic workflow source (`.github\u002Fworkflows\u002F*.md`) is compiled by the\n`gh-aw` compiler into a committed `*.lock.yml`. The version baked into a lock is\nwhatever compiler produced it, and **every** workflow tracks the same gh-aw\nversion: the newest `github\u002Fgh-aw` release **or prerelease**, whichever was\npublished most recently. There are no per-workflow categories — a bump\nrecompiles all the locks together.\n\n**The detector version is baked into the locks.** `gh-aw`'s\n`buildInstallThreatDetectStep` unconditionally emits\n`constants.DefaultThreatDetectVersion` (a hardcoded tag, e.g. `v0.4.12`) as the\nargument to `install_threat_detect_binary.sh`. There is no CLI flag, env var, or\nfrontmatter field that consults an alternate version at compile time. The\ndetector pin therefore only moves when either:\n\n1. `github\u002Fgh-aw` bumps the constant upstream (typically after a detector\n   promotion) and a normal drift-recompile picks up the new tag, or\n2. a maintainer does a targeted post-compile edit of the lock (see\n   [Testing an unpromoted detector prerelease in the smokes](#testing-an-unpromoted-detector-prerelease-in-the-smokes)\n   below).\n\nPromoting a detector release is **not** by itself enough to put it into the\nsmokes — it takes effect only once the upstream constant is bumped and this\nrepo's locks are recompiled against that gh-aw tag.\n\n## 1. Determine the target gh-aw version\n\nThe drift issue lists it. To confirm or resolve it yourself (any method works —\n`gh`, `curl`, or the GitHub Releases UI): newest `github\u002Fgh-aw` release **or**\nprerelease, i.e. the most recent by publish date whose tag looks like\n`v\u003Cdigit>...`; ignore drafts.\n\nFor example, with `gh` available:\n\n```bash\ngh api repos\u002Fgithub\u002Fgh-aw\u002Freleases --paginate \\\n  --jq '.[] | select(.draft == false) | select(.tag_name | test(\"^v[0-9]\")) | [.published_at, .tag_name] | @tsv' \\\n  | sort | tail -n1 | cut -f2\n```\n\nIn the steps below, refer to this as `\u003CTARGET_GH_AW>`.\n\n## 2. Recompile the locks\n\nRecompile every workflow with the same tag. The released `gh aw` extension is\nthe simplest route:\n\n```bash\ngh extension install github\u002Fgh-aw --pin \u003CTARGET_GH_AW> --force\ngh aw compile --action-mode action --action-tag \u003CTARGET_GH_AW> --no-check-update \\\n  .github\u002Fworkflows\u002F*.md\n```\n\n### Building the compiler from source instead\n\nIf `gh extension install` is unavailable (no `gh` auth, offline, etc.), build\ngh-aw from source — but you **must** set both version ldflags:\n\n```bash\ngit clone --depth 1 --branch \u003CTAG> https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw \u002Ftmp\u002Fgh-aw-src\n( cd \u002Ftmp\u002Fgh-aw-src && go build -ldflags \"-X main.version=\u003CTAG> -X main.isRelease=true\" -o \u002Ftmp\u002Fgh-aw .\u002Fcmd\u002Fgh-aw )\n```\n\n> [!IMPORTANT]\n> `-X main.isRelease=true` is not optional. `cmd\u002Fgh-aw\u002Fmain.go` defaults\n> `isRelease` to `\"false\"` and passes it to `workflow.SetIsRelease()`, which\n> normalizes the emitted `compiler_version` \u002F `GH_AW_VERSION` to `dev` and skips\n> release-only generation. Locks compiled without it look superficially fine but\n> carry `dev` at runtime.\n\nVerify before compiling:\n\n```bash\n\u002Ftmp\u002Fgh-aw version   # must print the target tag, not \"dev\"\n```\n\n## 3. Verify and open a PR\n\n1. Sanity-check that only the intended version bumps changed:\n   ```bash\n   git status --short -- .github\u002Fworkflows\n   git diff -- .github\u002Fworkflows\n   ```\n   Confirm each regenerated lock carries the target version in **both** places —\n   they must not say `dev`:\n   ```bash\n   grep -o '\"compiler_version\":\"[^\"]*\"' .github\u002Fworkflows\u002F*.lock.yml\n   grep -n 'GH_AW_VERSION:' .github\u002Fworkflows\u002F*.lock.yml\n   ```\n   Re-running the **gh-aw Version Check** workflow after the PR merges should\n   report no drift.\n2. Commit only the regenerated `*.lock.yml` files (and any intended `.md`\n   changes). The compiler also refreshes `.github\u002Faw\u002Factions-lock.json` and may\n   touch `.gitattributes` — that churn is expected. Open a PR describing the\n   version bumps.\n3. **Pushing workflow-file changes requires a token with the `workflows`\n   permission.** The built-in `GITHUB_TOKEN` (github-actions[bot]) is rejected\n   for changes under `.github\u002Fworkflows\u002F`, so this regeneration is done by a\n   maintainer \u002F agent whose credentials carry that permission — not by an\n   automated push in the version-check workflow.\n4. After merging, dispatch the top-level **Smoke** workflow to confirm the new\n   versions run green.\n\n## Testing an unpromoted detector prerelease\n\nThere are two sanctioned paths, depending on what you want to exercise.\n\n### Replay path (preferred for most prerelease iteration)\n\nDispatch `.github\u002Fworkflows\u002Freplay-detection.yml` with\n`detector_source=release`, `detector_ref=\u003Cprerelease tag>`, and `use_awf=true`.\nIt downloads that exact release asset and runs it under AWF against a prior\ngh-aw run's artifacts. No lock edit needed.\n\n### Smoke path (when you specifically need fresh AWF + fresh artifacts)\n\nThe smokes only ever see whatever tag gh-aw's constant currently points at\n(promoted, stable). To point them at an unpromoted prerelease, do a targeted\npost-compile edit of the smoke locks:\n\n```bash\nsed -i 's|install_threat_detect_binary.sh\" v0\\.[0-9.]*|install_threat_detect_binary.sh\" \u003CPRERELEASE_TAG>|' \\\n  .github\u002Fworkflows\u002Fsmoke-copilot-standalone.lock.yml \\\n  .github\u002Fworkflows\u002Fsmoke-claude-standalone.lock.yml \\\n  .github\u002Fworkflows\u002Fsmoke-codex-standalone.lock.yml\n```\n\nCommit those three files and open a PR. Do **not** patch\n`constants.DefaultThreatDetectVersion` in a `gh-aw` fork to accomplish this:\nthat route corrupts the compiler-version story (locks would carry a fork tag or\nlie about upstream), and it inverts the invariant that the constant tracks the\npromoted detector.\n\nOnly touch the smoke locks. Leave `detection-stats-daily`,\n`detection-failure-monitor`, `gh-aw-issue-digest`, and `gh-aw-parity-monitor` on\nthe compiler-emitted tag — they are not the test bed for detector prereleases.\n\nThe edit is deliberately ephemeral: the next `gh aw compile` run will regenerate\nthe locks from `constants.DefaultThreatDetectVersion` and revert the pin. That\nis intentional — prerelease pins should not survive a routine recompile. Once\nthe detector is promoted and gh-aw bumps its constant, a normal drift-recompile\npicks it up on the standard path.\n","# Updating Agentic Workflow Versions\n\nUse this skill when the **gh-aw Version Check** workflow\n(`.github\u002Fworkflows\u002Fgh-aw-version-check.yml`) opens a *\"Workflow version drift\"*\nissue, or whenever you need to bump the versions the compiled workflow\n`.lock.yml` files are pinned to.\n\nThere is no automation for the regeneration itself — it is a deliberate,\nhuman-reviewed step. Pushing changes under `.github\u002Fworkflows\u002F` requires a token\nwith the `workflows` permission, which the built-in `GITHUB_TOKEN` lacks, so a\nmaintainer (or an agent with suitably-permissioned credentials) performs the\nrecompile locally and opens a PR.\n\n## Background\n\nEach agentic workflow source (`.github\u002Fworkflows\u002F*.md`) is compiled by the\n`gh-aw` compiler into a committed `*.lock.yml`. The version baked into a lock is\nwhatever compiler produced it, and **every** workflow tracks the same gh-aw\nversion: the newest `github\u002Fgh-aw` release **or prerelease**, whichever was\npublished most recently. There are no per-workflow categories — a bump\nrecompiles all the locks together.\n\n**The detector version is baked into the locks.** `gh-aw`'s\n`buildInstallThreatDetectStep` unconditionally emits\n`constants.DefaultThreatDetectVersion` (a hardcoded tag, e.g. `v0.4.12`) as the\nargument to `install_threat_detect_binary.sh`. There is no CLI flag, env var, or\nfrontmatter field that consults an alternate version at compile time. The\ndetector pin therefore only moves when either:\n\n1. `github\u002Fgh-aw` bumps the constant upstream (typically after a detector\n   promotion) and a normal drift-recompile picks up the new tag, or\n2. a maintainer does a targeted post-compile edit of the lock (see\n   [Testing an unpromoted detector prerelease in the smokes](#testing-an-unpromoted-detector-prerelease-in-the-smokes)\n   below).\n\nPromoting a detector release is **not** by itself enough to put it into the\nsmokes — it takes effect only once the upstream constant is bumped and this\nrepo's locks are recompiled against that gh-aw tag.\n\n## 1. Determine the target gh-aw version\n\nThe drift issue lists it. To confirm or resolve it yourself (any method works —\n`gh`, `curl`, or the GitHub Releases UI): newest `github\u002Fgh-aw` release **or**\nprerelease, i.e. the most recent by publish date whose tag looks like\n`v\u003Cdigit>...`; ignore drafts.\n\nFor example, with `gh` available:\n\n```bash\ngh api repos\u002Fgithub\u002Fgh-aw\u002Freleases --paginate \\\n  --jq '.[] | select(.draft == false) | select(.tag_name | test(\"^v[0-9]\")) | [.published_at, .tag_name] | @tsv' \\\n  | sort | tail -n1 | cut -f2\n```\n\nIn the steps below, refer to this as `\u003CTARGET_GH_AW>`.\n\n## 2. Recompile the locks\n\nRecompile every workflow with the same tag. The released `gh aw` extension is\nthe simplest route:\n\n```bash\ngh extension install github\u002Fgh-aw --pin \u003CTARGET_GH_AW> --force\ngh aw compile --action-mode action --action-tag \u003CTARGET_GH_AW> --no-check-update \\\n  .github\u002Fworkflows\u002F*.md\n```\n\n### Building the compiler from source instead\n\nIf `gh extension install` is unavailable (no `gh` auth, offline, etc.), build\ngh-aw from source — but you **must** set both version ldflags:\n\n```bash\ngit clone --depth 1 --branch \u003CTAG> https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw \u002Ftmp\u002Fgh-aw-src\n( cd \u002Ftmp\u002Fgh-aw-src && go build -ldflags \"-X main.version=\u003CTAG> -X main.isRelease=true\" -o \u002Ftmp\u002Fgh-aw .\u002Fcmd\u002Fgh-aw )\n```\n\n> [!IMPORTANT]\n> `-X main.isRelease=true` is not optional. `cmd\u002Fgh-aw\u002Fmain.go` defaults\n> `isRelease` to `\"false\"` and passes it to `workflow.SetIsRelease()`, which\n> normalizes the emitted `compiler_version` \u002F `GH_AW_VERSION` to `dev` and skips\n> release-only generation. Locks compiled without it look superficially fine but\n> carry `dev` at runtime.\n\nVerify before compiling:\n\n```bash\n\u002Ftmp\u002Fgh-aw version   # must print the target tag, not \"dev\"\n```\n\n## 3. Verify and open a PR\n\n1. Sanity-check that only the intended version bumps changed:\n   ```bash\n   git status --short -- .github\u002Fworkflows\n   git diff -- .github\u002Fworkflows\n   ```\n   Confirm each regenerated lock carries the target version in **both** places —\n   they must not say `dev`:\n   ```bash\n   grep -o '\"compiler_version\":\"[^\"]*\"' .github\u002Fworkflows\u002F*.lock.yml\n   grep -n 'GH_AW_VERSION:' .github\u002Fworkflows\u002F*.lock.yml\n   ```\n   Re-running the **gh-aw Version Check** workflow after the PR merges should\n   report no drift.\n2. Commit only the regenerated `*.lock.yml` files (and any intended `.md`\n   changes). The compiler also refreshes `.github\u002Faw\u002Factions-lock.json` and may\n   touch `.gitattributes` — that churn is expected. Open a PR describing the\n   version bumps.\n3. **Pushing workflow-file changes requires a token with the `workflows`\n   permission.** The built-in `GITHUB_TOKEN` (github-actions[bot]) is rejected\n   for changes under `.github\u002Fworkflows\u002F`, so this regeneration is done by a\n   maintainer \u002F agent whose credentials carry that permission — not by an\n   automated push in the version-check workflow.\n4. After merging, dispatch the top-level **Smoke** workflow to confirm the new\n   versions run green.\n\n## Testing an unpromoted detector prerelease\n\nThere are two sanctioned paths, depending on what you want to exercise.\n\n### Replay path (preferred for most prerelease iteration)\n\nDispatch `.github\u002Fworkflows\u002Freplay-detection.yml` with\n`detector_source=release`, `detector_ref=\u003Cprerelease tag>`, and `use_awf=true`.\nIt downloads that exact release asset and runs it under AWF against a prior\ngh-aw run's artifacts. No lock edit needed.\n\n### Smoke path (when you specifically need fresh AWF + fresh artifacts)\n\nThe smokes only ever see whatever tag gh-aw's constant currently points at\n(promoted, stable). To point them at an unpromoted prerelease, do a targeted\npost-compile edit of the smoke locks:\n\n```bash\nsed -i 's|install_threat_detect_binary.sh\" v0\\.[0-9.]*|install_threat_detect_binary.sh\" \u003CPRERELEASE_TAG>|' \\\n  .github\u002Fworkflows\u002Fsmoke-copilot-standalone.lock.yml \\\n  .github\u002Fworkflows\u002Fsmoke-claude-standalone.lock.yml \\\n  .github\u002Fworkflows\u002Fsmoke-codex-standalone.lock.yml\n```\n\nCommit those three files and open a PR. Do **not** patch\n`constants.DefaultThreatDetectVersion` in a `gh-aw` fork to accomplish this:\nthat route corrupts the compiler-version story (locks would carry a fork tag or\nlie about upstream), and it inverts the invariant that the constant tracks the\npromoted detector.\n\nOnly touch the smoke locks. Leave `detection-stats-daily`,\n`detection-failure-monitor`, `gh-aw-issue-digest`, and `gh-aw-parity-monitor` on\nthe compiler-emitted tag — they are not the test bed for detector prereleases.\n\nThe edit is deliberately ephemeral: the next `gh aw compile` run will regenerate\nthe locks from `constants.DefaultThreatDetectVersion` and revert the pin. That\nis intentional — prerelease pins should not survive a routine recompile. Once\nthe detector is promoted and gh-aw bumps its constant, a normal drift-recompile\npicks it up on the standard path.\n",{"name":5,"description":7},"main","76a4653600a9211a9dfe5e50cda88708ec918ced","skills\u002Fupdate-workflow-versions",8,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-threat-detection","https:\u002F\u002Fgithub.com\u002Fgithub","https:\u002F\u002Fgithub.com\u002Fabout","How people build software.","2026-11-11 11:34:58",{"source":8,"skillName":5,"commands":46,"prompt":56,"zipAvailable":57},[47,50,53],{"tool":48,"command":49},"npx","npx skills add github\u002Fgh-aw-threat-detection --skill update-workflow-versions",{"tool":51,"command":52},"bunx","bunx skills add github\u002Fgh-aw-threat-detection --skill update-workflow-versions",{"tool":54,"command":55},"pnpm","pnpm dlx skills add github\u002Fgh-aw-threat-detection --skill update-workflow-versions","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-threat-detection\u002Fblob\u002Fmain\u002Fskills\u002Fupdate-workflow-versions\u002FSKILL.md",true,[],[60,69,79,89],{"skillNo":61,"name":62,"nameZh":6,"description":63,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":64,"categories":65,"keywords":66,"publishedAt":31},"01M6ADCWCGBVG81YM7GH548VBN","get-gh-aw-release-binary","How to fetch the latest github\u002Fgh-aw release binary — either as the gh CLI extension (gh aw ...) or as a raw platform binary downloaded from GitHub Releases — including how to resolve the latest tag, pick the right asset, and verify its checksum.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-threat-detection\u002Fblob\u002Fmain\u002Fskills\u002Fget-gh-aw-release-binary\u002FSKILL.md",[],[30,67,68,9],"get gh aw release binary","cli",{"skillNo":70,"name":71,"nameZh":6,"description":72,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":73,"categories":74,"keywords":75,"publishedAt":31},"01M6ADCTM254M9KNW1T21TTJFJ","error-messages","Error Message Style Guide for Validation Errors","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-threat-detection\u002Fblob\u002Fmain\u002Fskills\u002Ferror-messages\u002FSKILL.md",[],[76,77,78],"error messages","messages","validation",{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":31},"01M6ADCS45KNQGSY6GP1PVMCBK","console-rendering","Instructions for using the struct tag-based console rendering system in Go","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-threat-detection\u002Fblob\u002Fmain\u002Fskills\u002Fconsole-rendering\u002FSKILL.md",[],[86,87,88],"console","console rendering","go",{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":31},"01M6ADCQTSVP6607C201HSD19H","lane","Use lane in this repository when the user asks to create or work in an isolated worktree.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgh-aw-threat-detection\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Flane\u002FSKILL.md",[],[91,96,97,98],"create","worktree","repository"]