feat(ci): dogfood vendored agent skills on every website release

[xergioalex]

Summary

Add a release-integrated dogfood step to release_and_publish.yml that keeps the two vendored agent skills (deepworkplan, dailybot) at the latest upstream tag exactly at release time — no autonomous cron, no drift between "an upstream tag dropped" and "someone cut a release".

This replaces the abandoned PR #43 (PR-driven cron approach). The maintainer's stated preference: refresh happens only when a release is cut, and the maintainer controls when that is.

What changed

.github/workflows/release_and_publish.yml — new Step 1a — Dogfood, inserted between "Setup GitHub Config" and "Set release body". The step:

1. Resolves the latest tag of DailybotHQ/deepworkplan-skill and DailybotHQ/agent-skill via gh release view --json tagName.
2. Compares against the vendored SKILL.md version: field (frontmatter). Sets a per-skill _MOVED flag; only skills that actually moved are installed.
3. Runs npx --yes skills add <repo>@<tag> --skill <name> --force -y — the exact command any downstream consumer would run, so this doubles as a live smoke test of the upstream tag.
4. Asserts the invariant: installed SKILL.md version equals the requested tag. Fails the release on mismatch.
5. Stages .agents/skills/deepworkplan, .agents/skills/dailybot, skills-lock.json. If there is a diff, commits chore: dogfood vendored skills to <list> locally. Step 3's git push --follow-tags sends this commit alongside the version-bump commit + tag in a single atomic push.

Runs before Step 2 on purpose: get_github_release_log.sh walks the commit range from the previous release marker to HEAD, so the dogfood commit lands in the auto-generated Release notes alongside the PR that triggered the release.

Docs:

• .github/docs/WORKFLOWS.md — Step 1a documented with a dedicated Dogfood step subsection, including a failure-mode matrix.
• AGENTS.md — new "Vendored agent skills — refreshed on every website release" section replacing the old free-form guidance.

Design choices

Release-driven, not autonomous. The maintainer wanted control over when the site adopts a new skill version. A background cron would refresh silently overnight and eventually cause a release — the opposite of the intent. Coupling refresh to release means: no unexpected upstream drift shipped to production, no PRs from a bot to review, and the maintainer decides cadence by choosing when to merge.

Runs before the release-notes step. So the dogfood commit appears in the GitHub Release body next to whatever PR triggered the release. A reader sees chore: dogfood vendored skills to deepworkplan v2.16.3 in the release notes for v1.0.75, not a hidden change tucked under HEAD~.

Version-match invariant. If npx skills add <repo>@vX.Y.Z installs anything other than vX.Y.Z (e.g. resolver bug, tag layout drift), the release fails at Step 1a — a broken upstream tag can never quietly slip into a shipped website version.

Selective commit message. Commit subject lists only the skills that actually moved: chore: dogfood vendored skills to deepworkplan v2.16.3 (one moved) or chore: dogfood vendored skills to deepworkplan v2.16.3, dailybot v3.10.4 (both moved). Never dogfood vendored skills to deepworkplan v2.16.1 (unchanged), dailybot v3.10.4.

Failure semantics

Failure	Behavior
gh release view blip for one upstream repo	Warn; skip that skill; the other skill (and the release) proceed
gh release view blip for both	Warn twice; release proceeds without a dogfood commit
npx skills add failure	Fails the release — real upstream breakage, must be surfaced
Version invariant mismatch	Fails the release — refuses to publish a misrepresenting tag
Both skills already at latest	Clean no-op; release proceeds normally

Local validation

The commit-message and moved-flag logic was exhaustively tested against all seven scenarios (both-at-latest, one moved, both moved, one API blip, both API blip, blip + move). Output matches the intended commit subjects exactly.

What this replaces

• PR feat: auto-refresh vendored agent skills via PR-driven flow #43 (feat/auto-refresh-vendored-skills) — a cron-driven pair of workflows that opened + auto-merged a "refresh vendored skills" PR daily. Closed with rationale: user wants release-driven refresh, not autonomous. Branch deleted.

Test plan

• Merge this PR to main — the very next release will exercise the new Step 1a end-to-end.
• Verify chore: dogfood vendored skills to ... shows up in the release commit list (or the clean-no-op path fires cleanly if both skills are already at latest).
• Confirm the generated GitHub Release body includes the dogfood commit alongside the PR merge commit.
• After the release, confirm .agents/skills/deepworkplan/SKILL.md and .agents/skills/dailybot/SKILL.md versions match gh release view --repo DailybotHQ/{deepworkplan-skill,agent-skill} output.

Made with Cursor