Skip to content

Skillscript

v0.13.2 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

agents dsl llm mcp skills workflow

Summary

AI summary

Removed development‑time YouTrack test that caused CI failures and prevented releases.

Full changelog

The release pipeline has been silently broken since the May 28 housecleaning
sweep. Five tag pushes (v0.11.0 → v0.13.1) never reached npm, GHCR, or
GitHub Releases — the Test step failed before any of those ran. Dogfood
attempt (npm install [email protected]) surfaced this: npm
registry only had v0.10.0.

Two failure modes, single fix

  • ci.yml (every main push since May 28) failed on the env-gate assert
    in tests/v0.4.1-youtrack-proving.test.ts — the test always-fails when
    YOUTRACK_TEST_TOKEN is unset, and ci.yml never had that secret.
  • release.yml (every tag push since v0.11.0) passed the env gate
    (token IS set as a release-only secret) but then failed on ENOENT for
    examples/youtrack-morning-sweep.skill.md — the file got moved to
    examples/skillscripts/ in the housecleaning, and this one test was the
    straggler I missed when fixing other path references.

Cut

tests/v0.4.1-youtrack-proving.test.ts was a development-time MCP proving
artifact, not part of the runtime contract. It depended on a live YouTrack
instance + a CI secret + a personal cloud subdomain. The other ~10 tests
that reference youtrack as a string fixture (allowlist, unwired-connector,
function-call rejection, object-iteration) don't need a real backend and
stay. The examples/skillscripts/youtrack-morning-sweep.skill.md skill
stays too — it's a user-facing example of a remote MCP connector wired
declaratively.

Removed

  • tests/v0.4.1-youtrack-proving.test.ts (entire file)
  • YOUTRACK_TEST_TOKEN env block + comment in .github/workflows/release.yml
    Test step

Operational hygiene

  • The YOUTRACK_TEST_TOKEN GitHub repo secret should be deleted from repo
    settings (UI action — not scriptable from CI). Token itself stays valid
    in Scott's environment for ad-hoc local MCP probes if needed.

Meta-lesson banked

The "ignorable YouTrack env-gate failure" note I'd carried across the v0.10
→ v0.13.1 arc was load-bearing on a false premise. The test was passing on
main pre-housecleaning when the token was set; the reorg broke it for a
new reason (path), and I conflated the two failure modes. Pattern:
when an unrelated change lands near a known-broken signal, re-classify
the signal — don't assume the failure mode is unchanged.

Breaking Changes

  • Removed `tests/v0.4.1-youtrack-proving.test.ts` file and its associated `YOUTRACK_TEST_TOKEN` environment configuration.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Skillscript

Get notified when new releases ship.

Sign up free

About Skillscript

All releases →

Related context

Earlier breaking changes

  • v0.35.0 Editing `# Deadline:` on an approved skill drops it to Draft (signature invalidates).

Beta — feedback welcome: [email protected]