ci: auto-publish skill to ClawHub on release tag (#59)

## What

Adds a `publish-clawhub` job to `.github/workflows/release-please.yml`
so that whenever release-please cuts a stable `vX.Y.Z` release, the
skill is automatically published to ClawHub (`chainbase/agentkey`).

## How it works

- **Trigger:** gated on `needs.release-please.outputs.release_created ==
'true'` — the same gate as the existing `publish-skill-asset` job. Only
fires for real stable releases (not plain commits, not pre-releases).
- **Auth:** `clawhub login --no-browser --token "$CLAWHUB_TOKEN"` using
the new `CLAWHUB_TOKEN` repo secret.
- **CLI pinned** to `clawhub@0.18.0` for reproducible publishes.
- **Version** derived from the release tag (`v1.9.0` → `1.9.0`).
- **Changelog** auto-extracted from the matching `## [<version>]`
section of `CHANGELOG.md` and passed via `--changelog`.
- **ClawScan note** accurately describes expected behavior: remote HTTP
MCP endpoint + read-only GitHub-release version check + local config
inspection (no exfiltration).

## Required setup

- Repo secret **`CLAWHUB_TOKEN`** (already added) — the token's account
must have publish rights to the `chainbase` owner.

## Notes

- Must merge to `main` to take effect (release-please runs from the
default branch).
- v1.9.0 was already published manually; this automates all future
releases.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/release-please.yml

@@ -47,3 +47,46 @@ jobs:
           gh release upload "$TAG" agentkey.skill \
             --repo "$GITHUB_REPOSITORY" \
             --clobber
+
+  publish-clawhub:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      # Pin the CLI for reproducible publishes; bump deliberately.
+      - name: Install ClawHub CLI
+        run: npm i -g clawhub@0.18.0
+
+      - name: Authenticate with ClawHub
+        env:
+          CLAWHUB_TOKEN: ${{ secrets.CLAWHUB_TOKEN }}
+        run: clawhub login --no-browser --token "$CLAWHUB_TOKEN"
+
+      - name: Publish skill to ClawHub
+        env:
+          TAG: ${{ needs.release-please.outputs.tag_name }}
+        run: |
+          set -euo pipefail
+          VERSION="${TAG#v}"
+
+          # Extract this version's section body from CHANGELOG.md (no header line).
+          CHANGELOG="$(awk -v v="$VERSION" '
+            $0 ~ "^## \\[" v "\\]" { f=1; next }
+            f && /^## \[/ { exit }
+            f { print }
+          ' CHANGELOG.md | sed '/^[[:space:]]*$/d')"
+          [ -n "$CHANGELOG" ] || CHANGELOG="Release $TAG"
+
+          clawhub skill publish skills/agentkey \
+            --no-input \
+            --owner chainbase \
+            --slug agentkey \
+            --version "$VERSION" \
+            --changelog "$CHANGELOG" \
+            --clawscan-note "Expected behavior: this is an MCP-adapter skill. (1) SKILL.md routes the agent to the remote AgentKey HTTP MCP endpoint (https://api.agentkey.app/v1/mcp) for real-time data (web search, social, on-chain). (2) scripts/check-update.sh makes a read-only curl to the GitHub Releases API to notify when a newer skill version exists; it never modifies the install. (3) scripts/check-mcp.sh reads local agent config files (e.g. ~/.claude.json) and runs 'claude mcp list' to detect whether the MCP is registered and an API key is present. This is local config inspection and version checking, not credential exfiltration; the API key is user-provided and stays in standard local MCP config."