reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/win-dev-skills/.github/workflows/codeql.yml

@@ -0,0 +1,46 @@
+name: "CodeQL Advanced"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '35 20 * * 0'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      # required for all workflows
+      security-events: write
+
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: actions
+          build-mode: none
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+        config-file: ./.github/codeql/codeql-config.yml
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+      with:
+        category: "/language:${{matrix.language}}"

vendor-new/win-dev-skills/.github/workflows/dependency-review.yml

@@ -0,0 +1,22 @@
+name: Dependency Review
+
+on:
+  pull_request:
+    branches: [ "main" ]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Dependency Review
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: high
+          comment-summary-in-pr: on-failure

vendor-new/win-dev-skills/.github/workflows/pr-validation.yml

@@ -0,0 +1,62 @@
+name: PR validation
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  catalog-check:
+    name: Catalog check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+
+      # Every entry resolves (repo, commit, path, manifest, name, version) and
+      # the Copilot, Claude, and Codex catalogs list the same plugins at the same pin.
+      - name: Check catalogs
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: node scripts/check-catalogs.mjs
+
+  vally-lint:
+    name: Local plugin lint (vally)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+
+      # Same linter and version github/awesome-copilot runs on external plugins.
+      # Only plugins stored in this repo are linted; remote plugins are linted
+      # in their own repositories.
+      - name: Install local plugin lint dependencies
+        run: npm ci --prefix scripts/vally --no-audit --no-fund
+
+      - name: Check WinDbg package
+        run: node scripts/validate-windbg.mjs
+
+      - name: Test WinDbg diagnosis validator
+        run: node scripts/tests/test-windbg-validator.mjs
+
+      - name: Lint local plugin skills
+        run: node scripts/vally/lint-skills.mjs
+
+      # Fixture-based self-test: a plugin stored in this repo is checked and linted.
+      - name: Test catalog tooling
+        run: node scripts/tests/test-catalog-tools.mjs

vendor-new/win-dev-skills/.github/workflows/release-post-merge.yml

@@ -0,0 +1,88 @@
+name: Release post-merge
+
+# On every push to main: if the catalog version changed, tag main HEAD as
+# vX.Y.Z. The catalog version is metadata.version in
+# .github/plugin/marketplace.json (the Catalog check keeps the Claude catalog
+# in sync). Pushes that don't change it are skipped.
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write       # push tags
+
+# Serialize tag-creation across overlapping pushes to main so two workflow runs
+# can't race on the same tag.
+concurrency:
+  group: release-post-merge-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+
+  auto-tag:
+    name: Tag main HEAD as vX.Y.Z
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Read catalog version
+        id: ver
+        env:
+          BEFORE: ${{ github.event.before }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          CATALOG=.github/plugin/marketplace.json
+          VERSION=$(jq -r '.metadata.version' "$CATALOG")
+          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::$CATALOG metadata.version '$VERSION' is not valid semver. Refusing to tag."
+            exit 1
+          fi
+          PREVIOUS=""
+          if [[ -n "$BEFORE" && ! "$BEFORE" =~ ^0+$ ]] && git cat-file -e "$BEFORE:$CATALOG" 2>/dev/null; then
+            PREVIOUS=$(git show "$BEFORE:$CATALOG" | jq -r '.metadata.version // empty')
+          elif git cat-file -e "HEAD^1:$CATALOG" 2>/dev/null; then
+            PREVIOUS=$(git show "HEAD^1:$CATALOG" | jq -r '.metadata.version // empty')
+          fi
+          if [[ "$PREVIOUS" == "$VERSION" ]]; then
+            echo "::notice::Catalog version unchanged ($VERSION) — no tag."
+            echo "tag=" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "tag=v$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Create and push tag (idempotent, SHA-checked)
+        if: steps.ver.outputs.tag != ''
+        env:
+          TAG: ${{ steps.ver.outputs.tag }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          git fetch --tags origin --quiet
+
+          # Same SHA = idempotent success. A tag on an earlier main commit (e.g.
+          # after reverting a bump) is left alone. Anything else fails loudly;
+          # never overwrite or accept a misplaced tag.
+          if git rev-parse --verify --quiet "refs/tags/$TAG^{}" >/dev/null; then
+            EXISTING_SHA=$(git rev-parse "refs/tags/$TAG^{}")
+            if [[ "$EXISTING_SHA" == "$GITHUB_SHA" ]]; then
+              echo "::notice::Tag $TAG already points at $GITHUB_SHA — nothing to do."
+              exit 0
+            fi
+            if git merge-base --is-ancestor "$EXISTING_SHA" "$GITHUB_SHA"; then
+              echo "::notice::Tag $TAG already exists at earlier commit $EXISTING_SHA — not moving it."
+              exit 0
+            fi
+            echo "::error::Tag $TAG already exists at $EXISTING_SHA but main HEAD is $GITHUB_SHA. Bump the catalog version instead of reusing one."
+            exit 1
+          fi
+
+          git config user.name  "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag -a "$TAG" -m "Release $TAG"
+          git push origin "$TAG"
+          echo "::notice::Tagged $GITHUB_SHA as $TAG."

vendor-new/win-dev-skills/.github/workflows/stale-issues.yml

@@ -0,0 +1,54 @@
+name: Close stale issues
+
+on:
+  schedule:
+    - cron: '0 0 * * *'  # Run daily at midnight UTC
+  workflow_dispatch:     # Allow manual trigger for testing
+
+permissions:
+  issues: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
+        with:
+          # Only process issues with this label
+          only-issue-labels: 'needs-author-response'
+          
+          # Mark stale after 14 days of no activity
+          days-before-issue-stale: 14
+          
+          # Close 7 days after being marked stale
+          days-before-issue-close: 7
+          
+          # Label to add when marking stale
+          stale-issue-label: 'stale'
+          
+          # Warning message when marking as stale
+          stale-issue-message: >
+            This issue has been automatically marked as stale because it has not had
+            recent activity after requesting information from the author. It will be
+            closed in 7 days if no further activity occurs.
+          
+          # Message when closing
+          close-issue-message: >
+            This issue was closed because it has been stale for 7 days with no activity.
+            Feel free to reopen if you have the requested information.
+          
+          # Remove these labels when issue becomes unstale (any comment/activity)
+          labels-to-remove-when-unstale: 'needs-author-response,stale'
+          
+          # Add this label when issue becomes unstale (author responded)
+          labels-to-add-when-unstale: 'needs-maintainer-response'
+          
+          # Exempt issues with these labels from stale processing
+          exempt-issue-labels: 'exempt-from-stale'
+          
+          # Don't process PRs
+          days-before-pr-stale: -1
+          days-before-pr-close: -1
+          
+          # Enable for testing - remove this line after verifying behavior
+          # debug-only: true