CI

Use a read-only API key and fail the pipeline when skill pins drift.

Reproducible pull

Install the CLI in the job (or use a pre-baked image), then sync:

- name: Install pm-skills
  run: npm install -g https://npm.elsai.ai/elsai-pm-skills-0.1.0.tgz
- name: Sync agent skills
  run: pm-skills pull --frozen
  env:
    PM_SKILLS_API_KEY: ${{ secrets.PM_SKILLS_READONLY_KEY }}
    PM_SKILLS_SERVER: https://api.promptmanager-new.elsaifoundry.ai

--frozen installs exactly the SHAs in pm-skills.lock.json and fails if server resolution differs — analogous to npm ci.

Drift gate

- name: Fail on skill drift
  run: pm-skills status
  env:
    PM_SKILLS_API_KEY: ${{ secrets.PM_SKILLS_READONLY_KEY }}
    PM_SKILLS_SERVER: https://api.promptmanager-new.elsaifoundry.ai

Treat non-zero exit as failure when you want to block merges on local modifications or pending updates.

Commit these files

• .pm-skills.json — project binding
• pm-skills.lock.json — pinned SHAs

Do not commit API keys or ~/.pm-skills/config.json.

Scheduled bump PRs (optional)

A weekly job can run pm-skills update --all --yes on a branch and open a PR so skill bumps get the same review as dependency bumps — after server-side approval already happened.