feat: publish Microsoft 365 Copilot Cowork skills flavor (PILOT-6707)

[gabrielavaduva]

Summary

• compose a complete, marker-free Cowork flavor from the canonical catalog plus sparse Cowork overrides
• publish Cowork as the separate @uipath/skills-cowork package; keep the default @uipath/skills tarball unchanged and free of cowork/
• include both the complete composed skills/ tree and upload-ready .skill, Microsoft 365 plugin ZIP, and report.json artifacts under cowork/
• make the centralized all-flavor pack transactional, verify the final tarball against its staged payload and report, and reject unresolved flavor markers
• publish only dev and preview builds to Internal GitHub Packages through the isolated reusable flavor publisher
• keep Cowork publication fail-closed behind the existing global gate plus ENABLE_COWORK_SKILL_FLAVOR_PUBLISH
• document export, tenant validation, registry bootstrap, and runtime boundaries

Context and companion PR

Implements PILOT-6707.

The dependent CLI consumer is UiPath/cli#3487. It resolves the version-matched @uipath/skills-cowork package and exposes uip skills export --target cowork without requiring Python or a skills checkout at runtime.

Package contract

@uipath/skills-cowork contains:

• skills/ — all 25 composed Cowork skills
• cowork/skills/*.skill — 25 directly uploadable skill archives
• cowork/plugins/*.zip — 2 Microsoft 365 plugin shards
• cowork/report.json — the exact owned-artifact contract

The default @uipath/skills package contains no cowork/ path. Custom flavors remain GitHub Packages-only and have no npmjs or latest publication path.

Validation

• npm run skills:validate — default, Cowork, and Studio Web all valid (25 skills each)
• npm run skills:test — 51 passed, 1 Windows privilege-dependent symlink test skipped
• uvx --from pytest pytest tests/scripts/test_export_cowork.py -q — 16 passed, 4 Windows link/junction privilege tests skipped
• npm run cowork:build — exported 25 skills into 2 plugin packages
• npm run skills:pack — built and verified all 3 npm tarballs
• root npm pack is byte-identical to the generated default tarball and restores canonical sources
• default tarball: 25 composed skills, 0 Cowork artifacts
• Cowork tarball: 25 composed skills, 25 .skill archives, 2 plugin ZIPs
• npm run version:check
• Ruff check/format, workflow YAML parse, Slack script syntax, and git diff --check

Publication prerequisite

Code publication is intentionally fail-closed. ENABLE_SKILL_FLAVOR_PUBLISH is currently enabled for existing flavors, but @uipath/skills-cowork is not yet present in GitHub Packages and the dedicated ENABLE_COWORK_SKILL_FLAVOR_PUBLISH variable is absent.

Before enabling the Cowork caller, an authorized package administrator must:

1. bootstrap @uipath/skills-cowork with an explicitly routed one-time publication;
2. set the package visibility to Internal;
3. grant UiPath/skills Actions Write access without inheriting unsafe public-repository access; and
4. set ENABLE_COWORK_SKILL_FLAVOR_PUBLISH=true.

Until then, Cowork jobs are skipped while existing flavor and default publishing continue normally.

Hosted Cowork validation

Repository and package validation is complete. A live upload remains pending: the available Microsoft 365 account exposes Copilot Chat Basic rather than Cowork Customize/Plugins.

Once a licensed tenant exposes Cowork, upload an individual .skill through Customize > Skills for focused testing or deploy both plugin ZIP shards through the tenant admin flow, then start a fresh Cowork session and run the acceptance matrix in docs/copilot-cowork.md.

Uploading a package validates discovery and instructions. It does not install the uip CLI or grant access to UiPath services; end-to-end execution still needs a separately governed runtime or connector integration.

Cross-repository package integration

The rebased CLI from UiPath/cli#3487 was run directly against this PR's staged @uipath/skills-cowork@1.200.0 package. uip skills export --target cowork returned 25 skills and 2 plugin shards, and all 28 exported files matched the staged cowork/ payload byte-for-byte by SHA-256.