mirror of
https://github.com/only-cli/oc.git
synced 2026-09-15 10:40:56 +02:00
only-cli
bbe894bb96
Every GitHub action is now pinned to a full commit SHA with its version in a trailing comment, verified against each upstream repo's tags, so a retagged release cannot swap code under CI. The publish workflow pins npm to an exact version instead of @latest, the experiment Dockerfile pins its base image by digest, and codeql.yml gets a top-level read-all permissions block so the default token grants nothing the analyze job does not ask for. SECURITY.md points reports at GitHub private vulnerability reporting, which is now enabled, and scopes out experiments/. Branch protection on main now blocks force pushes and deletions.
Skills install/remove loop
This container repeatedly installs the web-browsing-cli skill for only-cli
from GitHub and removes it again. Each command is non-interactive, and failures
are logged without stopping the default infinite loop.
Build and run it from the repository root:
docker build -t only-cli-skills-loop experiments/skills-install-remove-loop
docker run --rm --name only-cli-skills-loop only-cli-skills-loop
Stop it with Ctrl-C or docker stop only-cli-skills-loop.
The delay between iterations defaults to five seconds and can be changed with
LOOP_DELAY_SECONDS. Set MAX_ITERATIONS to a positive integer for a bounded
run; its default of zero runs forever.
docker run --rm \
-e LOOP_DELAY_SECONDS=1 \
-e MAX_ITERATIONS=10 \
only-cli-skills-loop
SKILL_SOURCE and SKILL_NAME are also configurable. Anonymous telemetry from
the skills CLI is enabled so successful installs are reported to skills.sh.