From ca4ed692140ea7cd6905c5df15705a9f523edd14 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Per=20S=C3=B8derlind?= <per@soderlind.no>
Date: Sat, 8 Aug 2026 01:44:22 +0200
Subject: [PATCH] ci: discovery index builds + commits (CI source of truth),
 fixes gzip non-reproducibility

---
 .github/workflows/discovery-index.yml | 32 ++++++++++++++++++++++++---
 1 file changed, 29 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/discovery-index.yml b/.github/workflows/discovery-index.yml
index bc5dac4..1a78d64 100644
--- a/.github/workflows/discovery-index.yml
+++ b/.github/workflows/discovery-index.yml
@@ -5,16 +5,42 @@ on:
     branches: [main]
   pull_request:
 
+# Needs write access to commit the regenerated index back to main.
 permissions:
-  contents: read
+  contents: write
+
+concurrency:
+  group: discovery-index-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
-  check:
+  build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with:
           node-version: 22
-      - run: node scripts/build-agent-skills-index.mjs --check
+
+      # Plugin output is plain files (reproducible across environments), so a
+      # byte-level drift guard is safe here.
       - run: node scripts/build-agent-plugin.mjs --check
+
+      # The discovery archives are gzip, whose bytes are not reproducible across
+      # Node/zlib versions. CI is the source of truth: rebuild here and commit any
+      # changes on main instead of byte-comparing a locally built copy.
+      - run: node scripts/build-agent-skills-index.mjs
+
+      - name: Commit regenerated discovery index
+        if: github.event_name == 'push'
+        run: |
+          set -euo pipefail
+          if [ -z "$(git status --porcelain .well-known)" ]; then
+            echo "Discovery index already up to date."
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add .well-known
+          git commit -m "chore: regenerate agent-skills discovery index [skip ci]"
+          git push origin HEAD:main