mirror of
https://github.com/chainbase-labs/Agentkey.git
synced 2026-09-20 14:20:23 +08:00
fullstackjam
e7dbae688a
## What Deletes `skills/agentkey/scripts/check-mcp.sh` (92 lines) and updates every doc that referenced it. The script has shipped since the initial public release but is **dead code** — nothing in the skill's runtime ever invokes it. ## Why it's safe to remove (the receipts) `check-mcp.sh` was never wired into the skill: - **Never in SKILL.md, ever.** `git log -S check-mcp -- '*SKILL.md'` returns no commits across all history — the script has never been referenced by the skill's decision tree in any version. - **Superseded by a native check.** The skill verifies MCP health by calling the MCP `list_tools` endpoint directly (SKILL.md → "Status" / Step 0.C), not a shell script. Its three status codes (`MCP_OK` / `MCP_NO_KEY` / `MCP_NOT_CONFIGURED`) are consumed by nothing. - **Not in any runtime path.** No reference in CI (`scripts-test.yml`), the bats suite, `dev-smoke.sh`, `install.sh`/`install.ps1`, or `uninstall.sh`/`uninstall.ps1`. The only mentions were prose: SECURITY.md, the ClawScan note, the PR template, and directory-tree comments. (The companion `@agentkey/cli` is a separately-published npm package; it *writes* MCP config and has no reason to invoke a diagnostic bundled inside an already-installed skill.) ## What removing it buys - **Drops the skill's only `python3` dependency.** `check-mcp.sh` shelled out to `python3` to parse `~/.claude.json`; on a host without python3 it silently returned a false `MCP_NO_KEY`. The surviving `check-update.sh` is pure shell. - **Shrinks the on-disk read footprint to zero.** Post-removal the skill reads **no** agent config file and **no** `AGENTKEY_API_KEY` value from disk — it only talks to the MCP transport. SECURITY.md's "Files the skill reads or writes" table is updated to match. - **Removes a security-scanner false-positive surface.** The credential-read (`*_API_KEY*`) pattern in this script is precisely what required a dedicated SECURITY.md carve-out *and* a `--clawscan-note` item explaining "this is not credential exfiltration." Both are now unnecessary and removed. ## Doc updates (no dangling references left) - `SECURITY.md` — "two helper scripts" → "one"; removed the check-mcp.sh bullet and the `*_API_KEY*` scanner note; fixed the file table (the skill no longer reads `~/.claude.json` / `~/.env.local`; `~/.claude.json` re-characterized as CLI-written so the credential-handling reference stays accurate). - `.github/workflows/release-please.yml` — dropped item (3) from the ClawScan note. - `.github/PULL_REQUEST_TEMPLATE.md` — removed the obsolete "check-mcp.sh still works" checkbox. - `README.md` / `docs/README_zh.md` / `.claude/CLAUDE.md` — directory-tree comments. `grep -rn check-mcp` now returns nothing. ## Verification - ✅ `bats tests/` — all 10 pass (they cover the untouched `check-update.sh`). - ✅ `grep -rn 'check-mcp\|MCP_OK\|MCP_NO_KEY\|MCP_NOT_CONFIGURED\|env.local'` → zero hits. - ✅ `release-please.yml` still parses as valid YAML. ## Why `chore:` and not `fix:` Typed `chore:` deliberately so release-please does **not** cut a version bump / GitHub Release for an internal cleanup — a release would push a no-op plugin update to every user. No end-user runtime behavior changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
93 lines
3.1 KiB
YAML
93 lines
3.1 KiB
YAML
name: release-please
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
release-please:
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
release_created: ${{ steps.release.outputs.release_created }}
|
|
tag_name: ${{ steps.release.outputs.tag_name }}
|
|
steps:
|
|
- id: release
|
|
uses: googleapis/release-please-action@v4
|
|
with:
|
|
token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
|
|
config-file: release-please-config.json
|
|
manifest-file: .release-please-manifest.json
|
|
|
|
publish-skill-asset:
|
|
needs: release-please
|
|
if: ${{ needs.release-please.outputs.release_created == 'true' }}
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Build agentkey.skill zip
|
|
run: |
|
|
cd skills/agentkey
|
|
zip -r "$GITHUB_WORKSPACE/agentkey.skill" . \
|
|
-x "*.DS_Store" \
|
|
-x "__pycache__/*" \
|
|
-x "*.pyc"
|
|
echo "--- contents ---"
|
|
unzip -l "$GITHUB_WORKSPACE/agentkey.skill"
|
|
|
|
- name: Upload asset to release
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
TAG: ${{ needs.release-please.outputs.tag_name }}
|
|
run: |
|
|
gh release upload "$TAG" agentkey.skill \
|
|
--repo "$GITHUB_REPOSITORY" \
|
|
--clobber
|
|
|
|
publish-clawhub:
|
|
needs: release-please
|
|
if: ${{ needs.release-please.outputs.release_created == 'true' }}
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
|
|
# Pin the CLI for reproducible publishes; bump deliberately.
|
|
- name: Install ClawHub CLI
|
|
run: npm i -g clawhub@0.18.0
|
|
|
|
- name: Authenticate with ClawHub
|
|
env:
|
|
CLAWHUB_TOKEN: ${{ secrets.CLAWHUB_TOKEN }}
|
|
run: clawhub login --no-browser --token "$CLAWHUB_TOKEN"
|
|
|
|
- name: Publish skill to ClawHub
|
|
env:
|
|
TAG: ${{ needs.release-please.outputs.tag_name }}
|
|
run: |
|
|
set -euo pipefail
|
|
VERSION="${TAG#v}"
|
|
|
|
# Extract this version's section body from CHANGELOG.md (no header line).
|
|
CHANGELOG="$(awk -v v="$VERSION" '
|
|
$0 ~ "^## \\[" v "\\]" { f=1; next }
|
|
f && /^## \[/ { exit }
|
|
f { print }
|
|
' CHANGELOG.md | sed '/^[[:space:]]*$/d')"
|
|
[ -n "$CHANGELOG" ] || CHANGELOG="Release $TAG"
|
|
|
|
clawhub skill publish skills/agentkey \
|
|
--no-input \
|
|
--owner chainbase \
|
|
--slug agentkey \
|
|
--version "$VERSION" \
|
|
--changelog "$CHANGELOG" \
|
|
--clawscan-note "Expected behavior: this is an MCP-adapter skill. (1) SKILL.md routes the agent to the remote AgentKey HTTP MCP endpoint (https://api.agentkey.app/v1/mcp) for real-time data (web search, social, on-chain). (2) scripts/check-update.sh makes a read-only curl to the GitHub Releases API to notify when a newer skill version exists; it never modifies the install. This is version checking, not credential exfiltration; the API key is user-provided and stays in standard local MCP config."
|