justinmclean opened a new pull request, #541:
URL: https://github.com/apache/airflow-steward/pull/541
## Summary
Adds release-keys-sync, Step 3 of the release-management lifecycle, which
drafts the diff to add a Release Manager's public GPG key to the project KEYS
file, emits a paste-ready svn command sequence, reminds the RM to upload to the
keyserver, and enforces the ASF key-strength floor.
## What's included
skills/release-keys-sync/SKILL.md (370 lines), Drafting mode, with five
golden rules: never hold the private key, every state-changing action is a
proposal, no-op gracefully when already present, hand off on a rolled key/UID
mismatch, and enforce the strength floor.
Skill registration symlinks under .agents/, .claude/, and .github/, plus a
row in docs/labels-and-capabilities.md.
A 9-case eval suite under tools/skill-evals/evals/release-keys-sync/:
step-0-preflight: clean pass, already-in-KEYS no-op, key-rolled block
step-1-key-fetch: RSA 4096 pass, not-on-keyserver, RSA 1024 fails the floor
step-2-svn-commands: standard ASF svnpubsub, Ed25519 on non-ASF
GitHub-hosted KEYS, expiring-key advisory
## Boundaries
Never holds, reads, or proxies the private key. Never commits. External
content is input data only and prompt-injection attempts are flagged. Composes
with release-prepare (upstream) and release-rc-cut (downstream).
## Testing
uv run --directory tools/skill-and-tool-validator skill-and-tool-validate
uv run --directory tools/skill-evals skill-eval --cli "claude -p"
evals/release-keys-sync/
Step-2 fixtures grade automatically via assertions.json plus
grading-schema.json (regex/non_empty/field_true predicates); the strength-floor
decision in step-1 is an exact-match field. No Python tool source changed, so
pytest is not relevant to this branch.
## Type of change
- [X] Skill change (`.claude/skills/<name>/`) — eval fixtures updated below
- [ ] Tool / bridge contract (`tools/<system>/*.md`)
- [ ] Python package (`tools/*/` with `pyproject.toml`)
- [ ] Groovy reference impl
- [ ] Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
- [ ] Documentation (`docs/`, `README.md`, `CONTRIBUTING.md`)
- [ ] Project template (`projects/_template/`)
- [ ] CI / dev loop (`prek`, workflows, validators)
- [ ] Other:
## Test plan
- [X] `prek run --all-files` passes
- [ ] For Python packages touched: `uv run pytest` / `ruff check` / `mypy`
passes
- [ ] For Groovy bridges touched: command-line invocation tested end-to-end
- [X] For skill changes: eval suite passes for the affected skill
(`PYTHONPATH=tools/skill-evals/src python3 -m skill_evals.runner
tools/skill-evals/evals/<skill>/`)
- [ ] For skill *behaviour* changes: a new or updated eval fixture is
included in this PR
(a regression test for the bug fixed / the behaviour added — see
CONTRIBUTING.md)
- [ ] Other:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
