Skip to content

docs: AX-2170 - Remove plugin versions from READMEs #39

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
YoniMelki wants to merge 2 commits into
base: main
Choose a base branch
from
Open

docs: AX-2170 - Remove plugin versions from READMEs #39

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
97f5c10
AX-2170 - Remove plugin versions from READMEs
YoniMelki Aug 25, 2026
110acb8
AX-2170 - Drop README version tests and leftover pin-sync machinery
YoniMelki Aug 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 6 additions & 8 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ Before installing, make sure you have:
- **JFrog host** — A [JFrog Platform](https://jfrog.com) instance you can authenticate against, exposed to the plugin as `JFROG_PLATFORM_URL` (e.g. `mycompany.jfrog.io`). The JFrog Platform MCP server authenticates via OAuth (browser sign-in).
- **OpenCode** — Installed (verified against OpenCode **1.17.7** and newer, which honors `config.skills.paths` in object form).
- **Node.js** (≥ 18) — with `npx` on your `PATH` (used by the Agent Guard).
- **Skill runtime requirements** — `jf` CLI, `jq`, and `curl` on `PATH`, plus a configured JFrog CLI server. For the minimum versions, see the upstream skills [`Requirements`](https://github.com/jfrog/jfrog-skills/blob/v0.22.0/README.md#requirements). Configure the CLI with `jf login` / `jf config add` — see [Authentication](#authentication).
- **Skill runtime requirements** — `jf` CLI, `jq`, and `curl` on `PATH`, plus a configured JFrog CLI server. For the minimum versions, see the upstream skills [`Requirements`](https://github.com/jfrog/jfrog-skills/blob/main/README.md#requirements). Configure the CLI with `jf login` / `jf config add` — see [Authentication](#authentication).
- **JFrog AI Catalog** (optional) — If you want to use the Agent Guard feature, your JFrog subscription needs to include the AI Catalog entitlement. Contact your JFrog account team if you're unsure whether it's enabled.
- **JFrog CLI ≥ 2.105.0** (optional) — If you want the Agent Guard to auto-resolve the credentials/server ID from the JFrog CLI configuration.
- **JFrog project** (optional) — If you want to use the Agent Guard feature.
Expand Down Expand Up @@ -214,7 +214,7 @@ The `skills/` tree is vendored from
[`jfrog/jfrog-skills`](https://github.com/jfrog/jfrog-skills) at the version pinned in
[`sync-skills-vendor.json`](sync-skills-vendor.json). To pull a newer upstream release:

1. Bump `pin` in `sync-skills-vendor.json` to the new tag (e.g. `v0.23.0`).
1. Bump `pin` in `sync-skills-vendor.json` to the new upstream tag.
2. Re-sync and commit the refreshed tree:

```bash
Expand All @@ -223,9 +223,7 @@ The `skills/` tree is vendored from

It downloads the pinned tarball from `codeload.github.com` and replaces the
directories listed in `paths` (today: `skills/`).
3. Update the pinned-version link in the [Prerequisites](#prerequisites) section so the
skill runtime requirements point at the new tag.
4. Cut a plugin release so the new skills ship to users (see [Release](#release)).
3. Cut a plugin release so the new skills ship to users (see [Release](#release)).
Until a release is published, installed plugins keep using the previously vendored
skills.

Expand All @@ -234,13 +232,13 @@ CI runs `mise run sync-skills:check`, which re-vendors and fails if the committe

---

## Upgrading from < 0.0.3
## Upgrading from legacy skill layout

This release changes behavior in ways that are **not** backward compatible:

- **Skill catalog changed.** The previous Artifactory skills — `skill-install`, `skill-publish`, `jfrog-cli`, `opencode-jfrog-mcp`, `jfrog-curation`, `jfrog-packages` — are replaced by the canonical vendored skills above. Invocations of the removed skill names no longer exist; that functionality now folds into the `jfrog` skill.
- **Package-manager auto-setup was removed.** Earlier versions ran `jf setup <pm>` automatically on session start; that is gone. Durable package-manager setup is provided by the `jfrog-setup-package-managers` skill.
- **Old skills are not auto-cleaned.** The plugin no longer touches `~/.config/opencode/skills`. If you used a version < 0.0.3, remove the old managed skill directories yourself under `~/.config/opencode/skills`.
- **Package-manager auto-setup was removed.** Earlier releases ran `jf setup <pm>` automatically on session start; that is gone. Durable package-manager setup is provided by the `jfrog-setup-package-managers` skill.
- **Old skills are not auto-cleaned.** The plugin no longer touches `~/.config/opencode/skills`. If you used a legacy release with runtime-managed skills, remove the old managed skill directories yourself under `~/.config/opencode/skills`.
- **No more runtime artifacts.** The plugin no longer injects instructions files or writes local package-manager state, and it no longer downloads skills at runtime.
- **Dependencies resolve from public npm.** Internal registry references were removed; the build and CI now resolve from public npm.

Expand Down
13 changes: 7 additions & 6 deletions VENDOR.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,15 +15,15 @@ The vendoring source is declared in `sync-skills-vendor.json` at the repo root:
```json
{
"repo": "jfrog/jfrog-skills",
"pin": "v0.22.0",
"pin": "<upstream-tag>",
"paths": ["skills"]
}
```

| Field | Meaning |
| ------- | ------------------------------------------------------------------------------------------- |
| `repo` | The upstream GitHub repository (`owner/name`) to vendor from. |
| `pin` | The exact upstream ref to vendor (a tag, e.g. `v0.16.0`). Pin to a tag for reproducibility. |
| `pin` | The exact upstream release tag to vendor. Pin to a tag for reproducibility. |
| `paths` | The paths within the upstream repo to copy into this repo root. Currently just `skills`. |

## How the sync works
Expand All @@ -47,14 +47,15 @@ skills/
```

> **Note:** the exact set of skill directories is whatever the pinned `jfrog/jfrog-skills` release
> ships under `skills/` — the sync copies the whole tree. `jfrog-mcp-management/` (JFrog Agent Guard
> MCP management, including the OpenCode harness) is included as of the pinned `v0.22.0`.
> ships under `skills/` — the sync copies the whole tree.

The README deliberately omits release numbers. [`package.json`](package.json) and GitHub tags/releases are the authoritative plugin-version sources; `sync-skills-vendor.json` is the authoritative skills pin.

The script is dependency-free Node ESM and makes no changes outside the vendored `paths`.

## Bumping the pin

1. Edit `sync-skills-vendor.json` and set `pin` to the new upstream tag (e.g. `v0.12.0`).
1. Edit `sync-skills-vendor.json` and set `pin` to the new upstream release tag.
2. Re-vendor:

```bash
Expand All @@ -66,7 +67,7 @@ The script is dependency-free Node ESM and makes no changes outside the vendored

```bash
git add sync-skills-vendor.json skills
git commit -m "feat(skills): vendor jfrog-skills@v0.12.0"
git commit -m "feat(skills): update vendored jfrog-skills"
```

4. Cut a plugin release so the new skills ship to users. Until a release is published, installed plugins
Expand Down
Loading