This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
Summary
AI summaryRemoved development‑time YouTrack test that caused CI failures and prevented releases.
Full changelog
The release pipeline has been silently broken since the May 28 housecleaning
sweep. Five tag pushes (v0.11.0 → v0.13.1) never reached npm, GHCR, or
GitHub Releases — the Test step failed before any of those ran. Dogfood
attempt (npm install [email protected]) surfaced this: npm
registry only had v0.10.0.
Two failure modes, single fix
ci.yml(every main push since May 28) failed on the env-gate assert
intests/v0.4.1-youtrack-proving.test.ts— the test always-fails when
YOUTRACK_TEST_TOKENis unset, and ci.yml never had that secret.release.yml(every tag push since v0.11.0) passed the env gate
(token IS set as a release-only secret) but then failed onENOENTfor
examples/youtrack-morning-sweep.skill.md— the file got moved to
examples/skillscripts/in the housecleaning, and this one test was the
straggler I missed when fixing other path references.
Cut
tests/v0.4.1-youtrack-proving.test.ts was a development-time MCP proving
artifact, not part of the runtime contract. It depended on a live YouTrack
instance + a CI secret + a personal cloud subdomain. The other ~10 tests
that reference youtrack as a string fixture (allowlist, unwired-connector,
function-call rejection, object-iteration) don't need a real backend and
stay. The examples/skillscripts/youtrack-morning-sweep.skill.md skill
stays too — it's a user-facing example of a remote MCP connector wired
declaratively.
Removed
tests/v0.4.1-youtrack-proving.test.ts(entire file)YOUTRACK_TEST_TOKENenv block + comment in.github/workflows/release.yml
Test step
Operational hygiene
- The
YOUTRACK_TEST_TOKENGitHub repo secret should be deleted from repo
settings (UI action — not scriptable from CI). Token itself stays valid
in Scott's environment for ad-hoc local MCP probes if needed.
Meta-lesson banked
The "ignorable YouTrack env-gate failure" note I'd carried across the v0.10
→ v0.13.1 arc was load-bearing on a false premise. The test was passing on
main pre-housecleaning when the token was set; the reorg broke it for a
new reason (path), and I conflated the two failure modes. Pattern:
when an unrelated change lands near a known-broken signal, re-classify
the signal — don't assume the failure mode is unchanged.
Breaking Changes
- Removed `tests/v0.4.1-youtrack-proving.test.ts` file and its associated `YOUTRACK_TEST_TOKEN` environment configuration.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Skillscript
All releases →Related context
Related tools
Earlier breaking changes
- v0.35.0 Editing `# Deadline:` on an approved skill drops it to Draft (signature invalidates).
Beta — feedback welcome: [email protected]