Updater PRs state the upstream range, licence and archival state of each moved skill #745

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Evidence

This is the implementing issue for devantler-tech/agent-plugins#583, which records the outcome the marketplace needs.

The per-skill pull request opened by .github/workflows/update-agent-skills.yaml (job open-skill-pull-requests, step "Create pull request") has a fixed body: it says only that the skill at <path> moved "to its latest version". Third-party skills are pinned only by metadata.github-tree-sha, and none of their upstreams publishes releases, so each update is a range of upstream commits. A reviewer doing the required release-range review has to find the old and new trees upstream and compare them by hand. devantler-tech/agent-plugins#568 is a recent example.

Problem

Every review-bearing updater PR costs a manual reconstruction of its upstream range, and a licence change or an archived upstream can pass unnoticed, because nothing on the PR mentions it.

Smallest useful change

For each moved skill, the per-skill PR body states:

• the upstream repository and path (the skill's metadata.github-repo and metadata.github-path);
• the old tree SHA (the base branch copy) and the new tree SHA (the updated copy), the upstream commits that hold them, and a compare link between those commits;
• the number of upstream commits that touch that path in the range, with their subjects shown as quoted, untrusted text;
• the licence at the old and at the new commit, flagged when it changed;
• whether the upstream repository is archived, or now redirects after a rename.

A changed licence, an archived or renamed upstream, or a range that cannot be resolved puts a visible warning at the top of the body. A fact that cannot be resolved is stated as unknown, never left out.

Notes for the implementer

• The old tree SHA comes from the checked-out base copy of <path>/SKILL.md, and the new one from the applied patch.
• Finding the commit that holds a tree SHA needs the path's history, for example a blobless partial clone of the upstream (git clone --filter=blob:none --no-checkout), then git log --format=%H -- <github-path> and git rev-parse <commit>:<github-path>. The agent-plugins license check for Matt Pocock's skills already binds a recorded skill tree to its source commit and may be reusable.
• Upstream commit subjects are untrusted text. Render them so that no closing keyword (such as Fixes #1) or @mention inside them can link, close or notify anything in the consuming repository.
• The PR stays review-bearing; auto-merge rules do not change.

Acceptance criteria

• A per-skill updater PR for a third-party skill carries all five facts above.
• Upstream text in the body is quoted and inert: no closing keyword or mention in an upstream subject links, closes or notifies anything.
• A changed licence, an archived or renamed upstream, or an unresolved range adds a warning at the top of the body.
• Tests cover an unchanged licence, a changed licence, an archived repository and a tree that cannot be resolved.
• The change is released, and agent-plugins moves to that release, so Updater PRs state what changed upstream for each moved skill agent-plugins#583 can be checked on a real updater PR.

Size: Medium. Priority: Medium: it removes a manual step from every third-party skill update (about weekly) and closes a blind spot for licence and archival changes.