feat: publish safe Gitea repository update skill
This commit is contained in:
@@ -0,0 +1,21 @@
|
|||||||
|
{
|
||||||
|
"name": "updating-gitea-repositories",
|
||||||
|
"version": "0.1.0",
|
||||||
|
"description": "通过 HTTPS、Git Credential Manager 和 PAT 安全更新 Gitea 仓库",
|
||||||
|
"author": {
|
||||||
|
"name": "Eapil"
|
||||||
|
},
|
||||||
|
"homepage": "https://git.playones.com/huzhifa/skill-git-push",
|
||||||
|
"repository": "https://git.playones.com/huzhifa/skill-git-push.git",
|
||||||
|
"keywords": ["gitea", "git", "gcm", "pat", "repository"],
|
||||||
|
"skills": "./skills/",
|
||||||
|
"interface": {
|
||||||
|
"displayName": "Gitea 仓库安全更新",
|
||||||
|
"shortDescription": "通过 GCM 和 PAT 安全提交及验证 Gitea 仓库更新",
|
||||||
|
"longDescription": "在 macOS、Windows 和 WSL 中检查或安装 GCM，安全处理 Gitea PAT，精确暂存变更，并在推送后验证远程提交。",
|
||||||
|
"developerName": "Eapil",
|
||||||
|
"category": "Developer Tools",
|
||||||
|
"capabilities": ["Write"],
|
||||||
|
"defaultPrompt": "使用 updating-gitea-repositories 安全更新这个 Gitea HTTPS 仓库。"
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,55 @@
|
|||||||
|
---
|
||||||
|
name: updating-gitea-repositories
|
||||||
|
description: Use when publishing or updating prepared files in a Gitea repository over HTTPS on macOS or Windows, especially when Git Credential Manager, Personal Access Token authentication, empty repositories, existing clones, or push verification are involved.
|
||||||
|
---
|
||||||
|
|
||||||
|
# Updating Gitea Repositories
|
||||||
|
|
||||||
|
## Purpose
|
||||||
|
|
||||||
|
Publish only the intended changes to a Gitea repository through HTTPS, Git Credential Manager (GCM), and a least-privilege Personal Access Token (PAT). Preserve existing work, keep secrets out of commands and logs, and verify the remote commit after every push.
|
||||||
|
|
||||||
|
## Required Reading
|
||||||
|
|
||||||
|
1. Always read [repository workflow](references/repository-workflow.md).
|
||||||
|
2. On macOS, also read [macOS GCM setup](references/macos.md).
|
||||||
|
3. On native Windows or WSL, also read [Windows GCM setup](references/windows.md).
|
||||||
|
|
||||||
|
## Core Contract
|
||||||
|
|
||||||
|
- Require a clean Gitea HTTPS URL, exact prepared source paths, intended repository paths, target branch, and commit intent. Infer only what the active task makes unambiguous.
|
||||||
|
- Verify GCM by executing its version command. When it succeeds, reuse that installation without install, reinstall, or upgrade actions. Install only when no working GCM exists; repair only when installation records exist but the executable does not.
|
||||||
|
- The user creates a Gitea PAT with `write:repository`. The user enters the Gitea login and PAT only in a local GCM prompt. Never request or expose a PAT in chat, URLs, environment variables, command arguments, logs, or files.
|
||||||
|
- Preserve unrelated work. Stage only exact task paths; never use unscoped `git add .` or `git add -A`.
|
||||||
|
- Before committing, set the user-confirmed identity only in the target repository:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
git config --local user.name "<confirmed-name>"
|
||||||
|
git config --local user.email "<confirmed-id>@eapil.com"
|
||||||
|
```
|
||||||
|
|
||||||
|
- Never bypass TLS, branch protection, hooks, validation, or non-fast-forward safety. Never force-push as recovery.
|
||||||
|
- Report success only after fetching the pushed branch and matching its remote SHA to local `HEAD`.
|
||||||
|
|
||||||
|
## Quick Decisions
|
||||||
|
|
||||||
|
| State | Action |
|
||||||
|
|---|---|
|
||||||
|
| GCM version works | Reuse it unchanged |
|
||||||
|
| Installer record exists but command fails | Repair or reinstall GCM |
|
||||||
|
| HTTPS remote has no refs | Initialize the confirmed default branch |
|
||||||
|
| Remote has history | Clone or fetch before writing |
|
||||||
|
| Dirty changes overlap task paths | Stop or use a clean clone/worktree |
|
||||||
|
| Default branch rejects normal push | Push a task branch for review |
|
||||||
|
|
||||||
|
## Example Invocation
|
||||||
|
|
||||||
|
> Use `$updating-gitea-repositories` to publish the prepared skill to `https://gitea.example.com/team/skill-repo.git`, targeting `skills/updating-gitea-repositories` on `main`.
|
||||||
|
|
||||||
|
## Common Mistakes
|
||||||
|
|
||||||
|
- Trusting package-manager state instead of running the GCM version command.
|
||||||
|
- Treating a PAT as ordinary text.
|
||||||
|
- Staging the whole worktree for a narrow update.
|
||||||
|
- Treating push rejection as permission to force-push.
|
||||||
|
- Reporting the local commit without remote SHA verification.
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
interface:
|
||||||
|
display_name: "Updating Gitea Repositories"
|
||||||
|
short_description: "通过 HTTPS、GCM 和 PAT 安全更新 Gitea 仓库"
|
||||||
|
default_prompt: "Use $updating-gitea-repositories to publish prepared changes to this Gitea HTTPS repository."
|
||||||
@@ -0,0 +1,59 @@
|
|||||||
|
# macOS GCM Setup
|
||||||
|
|
||||||
|
Use this reference only on macOS.
|
||||||
|
|
||||||
|
## Verify
|
||||||
|
|
||||||
|
```bash
|
||||||
|
git --version
|
||||||
|
git-credential-manager --version
|
||||||
|
git config --show-origin --get-all credential.helper
|
||||||
|
```
|
||||||
|
|
||||||
|
Treat `command not found` as missing or broken even when Homebrew says the cask is installed.
|
||||||
|
|
||||||
|
If the version command succeeds, GCM is already available. Do not run Homebrew install, reinstall, or upgrade commands; continue to configuration and repository work.
|
||||||
|
|
||||||
|
## Install or Repair
|
||||||
|
|
||||||
|
Run the preferred installation only when the version command confirms that no working GCM exists:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
brew install --cask git-credential-manager
|
||||||
|
```
|
||||||
|
|
||||||
|
If Homebrew records the cask but the command is unavailable:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
brew reinstall --cask git-credential-manager
|
||||||
|
git-credential-manager --version
|
||||||
|
```
|
||||||
|
|
||||||
|
The package installer may require a macOS administrator password. Never ask the user to send that password. Have the user enter it in their own terminal or the macOS installer. If installation cannot be completed, stop rather than silently switching away from GCM.
|
||||||
|
|
||||||
|
If reinstall succeeds but the shell still cannot find the command, start a new shell and check:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
command -v git-credential-manager
|
||||||
|
ls -l /usr/local/share/gcm-core/git-credential-manager
|
||||||
|
```
|
||||||
|
|
||||||
|
Use the reported installed path to diagnose PATH configuration; do not create speculative symlinks.
|
||||||
|
|
||||||
|
## Configure
|
||||||
|
|
||||||
|
```bash
|
||||||
|
git-credential-manager configure
|
||||||
|
git config --global --get-all credential.helper
|
||||||
|
```
|
||||||
|
|
||||||
|
GCM uses the macOS Keychain as its default secure credential store. Remove a repository-local helper override only after inspecting its origin and confirming it conflicts with GCM:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
git config --show-origin --get-all credential.helper
|
||||||
|
git config --local --unset-all credential.helper
|
||||||
|
```
|
||||||
|
|
||||||
|
Do not replace GCM with `osxkeychain` when the requested workflow is standardized on GCM.
|
||||||
|
|
||||||
|
Official references: [GCM installation](https://github.com/git-ecosystem/git-credential-manager/blob/main/docs/install.md) and [credential stores](https://github.com/git-ecosystem/git-credential-manager/blob/main/docs/credstores.md).
|
||||||
@@ -0,0 +1,63 @@
|
|||||||
|
# Repository Update Workflow
|
||||||
|
|
||||||
|
Read this reference for every Gitea repository update.
|
||||||
|
|
||||||
|
## 1. Resolve Inputs
|
||||||
|
|
||||||
|
Identify the clean Gitea HTTPS URL, prepared source paths, repository target paths, target branch, and commit intent. If a source-to-target mapping is ambiguous, stop and ask before writing.
|
||||||
|
|
||||||
|
## 2. Inspect Before Editing
|
||||||
|
|
||||||
|
Read applicable `AGENTS.md` and `CONTRIBUTING*`. Inspect the repository root, current branch, `git status`, staged diff, remotes, recent history, and remote refs. Do not print a remote URL that may contain credentials; reject URLs with embedded user information.
|
||||||
|
|
||||||
|
Verify GCM using the active platform reference. A successful version command means reuse the existing installation without installing or upgrading it. Configure GCM only when its helper is absent or conflicting.
|
||||||
|
|
||||||
|
The user creates a Gitea PAT with `write:repository` and enters the Gitea login plus PAT only in the local GCM prompt. The account must already have repository write access.
|
||||||
|
|
||||||
|
## 3. Choose the Repository Path
|
||||||
|
|
||||||
|
- Existing clone: `git fetch --prune` first; do not merge automatically.
|
||||||
|
- Existing remote without a clone: clone the target branch before copying prepared files.
|
||||||
|
- Empty remote: only after `git ls-remote` succeeds with no refs, initialize the confirmed default branch, normally `main`, and add the clean HTTPS remote.
|
||||||
|
- Dirty clone: preserve unrelated changes. If they overlap task paths or prevent a safe update, use a fresh clone or isolated worktree based on the latest remote branch.
|
||||||
|
|
||||||
|
Do not use force, reset, clean, stash, or destructive checkout as a shortcut.
|
||||||
|
|
||||||
|
## 4. Prepare and Validate the Commit
|
||||||
|
|
||||||
|
Set the user-confirmed Eapil identity only in the target repository:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
git config --local user.name "<confirmed-name>"
|
||||||
|
git config --local user.email "<confirmed-id>@eapil.com"
|
||||||
|
```
|
||||||
|
|
||||||
|
Copy or edit only the intended paths. Stage with an explicit pathspec:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
git add -- <path-1> <path-2>
|
||||||
|
git diff --cached --name-status
|
||||||
|
git diff --cached --stat
|
||||||
|
git diff --cached --check
|
||||||
|
git diff --cached
|
||||||
|
```
|
||||||
|
|
||||||
|
Confirm every staged path is in scope, deletions are intentional, no secret or transient file is present, and repository-required tests pass. If there is no staged change, report that the remote already contains the prepared content instead of creating an empty commit, unless the user explicitly requested an empty commit.
|
||||||
|
|
||||||
|
## 5. Commit, Push, and Verify
|
||||||
|
|
||||||
|
Commit with an intent-based message. Re-fetch before pushing when the remote may have advanced. Push normally to the target branch. If the default branch is protected, push a task branch and report that review or merge is required. Do not use `--force`, `--force-with-lease`, `--no-verify`, or TLS bypasses.
|
||||||
|
|
||||||
|
After a successful push, fetch the pushed branch and compare:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
git rev-parse HEAD
|
||||||
|
git rev-parse "origin/<pushed-branch>"
|
||||||
|
git ls-remote origin "refs/heads/<pushed-branch>"
|
||||||
|
```
|
||||||
|
|
||||||
|
Report completion only when the local and remote SHAs match. Include the repository, branch, commit SHA and subject, exact changed paths, validation performed, and remaining user action.
|
||||||
|
|
||||||
|
## Stop Conditions
|
||||||
|
|
||||||
|
Stop on ambiguous paths, missing Git identity, authentication or TLS failure, insufficient account/PAT permissions, unexpected staged files, validation failure, overlapping user changes, non-fast-forward history requiring judgment, protected-branch rejection, server-hook rejection, or a request to overwrite remote history.
|
||||||
@@ -0,0 +1,55 @@
|
|||||||
|
# Windows GCM Setup
|
||||||
|
|
||||||
|
Use this reference on native Windows or Windows Subsystem for Linux (WSL).
|
||||||
|
|
||||||
|
## Native Windows
|
||||||
|
|
||||||
|
In PowerShell, verify Git, GCM, and the configured helper:
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
git --version
|
||||||
|
git credential-manager --version
|
||||||
|
Get-Command git-credential-manager -ErrorAction SilentlyContinue
|
||||||
|
git config --show-origin --get-all credential.helper
|
||||||
|
```
|
||||||
|
|
||||||
|
Git for Windows is the preferred GCM installation method and includes GCM by default. If GCM is missing or broken, repair or reinstall the current Git for Windows release and keep Git Credential Manager selected. The official standalone GCM user installer is an alternative that does not require administrator rights; the system installer does.
|
||||||
|
|
||||||
|
If either version command succeeds, reuse the installed GCM. Do not reinstall Git for Windows, install standalone GCM, or upgrade GCM as part of an ordinary repository update.
|
||||||
|
|
||||||
|
After installation, start a new PowerShell session and run:
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
git-credential-manager --version
|
||||||
|
git-credential-manager configure
|
||||||
|
git config --global --get-all credential.helper
|
||||||
|
```
|
||||||
|
|
||||||
|
GCM uses Windows Credential Manager by default. If `credential.helper=store` is active, stop before entering a PAT and replace the plaintext helper through GCM configuration. Never edit `%USERPROFILE%\.git-credentials` to add a PAT.
|
||||||
|
|
||||||
|
## WSL
|
||||||
|
|
||||||
|
Prefer Git for Windows plus its GCM executable. Inside WSL, configure the helper using the actual installed path, commonly:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
git config --global credential.helper "/mnt/c/Program\ Files/Git/mingw64/bin/git-credential-manager.exe"
|
||||||
|
```
|
||||||
|
|
||||||
|
A current-user standalone installer may instead place GCM under the user's `AppData/Local/Programs` directory. Inspect the real location rather than guessing it. GCM backed by Windows Credential Manager requires an interactive Windows desktop session and does not persist credentials from a remote SSH-only Windows session.
|
||||||
|
|
||||||
|
## Authentication and Verification
|
||||||
|
|
||||||
|
At the first `git ls-remote`, clone, fetch, or push prompt:
|
||||||
|
|
||||||
|
- Username: the Gitea login name or email accepted by the instance.
|
||||||
|
- Password: the PAT with `write:repository`, entered locally.
|
||||||
|
|
||||||
|
Confirm the remote URL contains no credentials:
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
git remote -v
|
||||||
|
```
|
||||||
|
|
||||||
|
Do not disable TLS verification for internal certificates. Install the organization's trusted CA correctly or stop and report the certificate issue.
|
||||||
|
|
||||||
|
Official references: [GCM installation](https://github.com/git-ecosystem/git-credential-manager/blob/main/docs/install.md), [Windows credential store](https://github.com/git-ecosystem/git-credential-manager/blob/main/docs/credstores.md), and [WSL configuration](https://github.com/git-ecosystem/git-credential-manager/blob/main/docs/wsl.md).
|
||||||
Reference in New Issue
Block a user