ci: mirror blocks-ci-sessions repository scaffolding

[cubeorgdev]

Summary

Stacked on #1. Brings the repository files over from blocks-ci-sessions so both repos follow the same conventions. Repo settings and rulesets were applied directly and are listed below for the record.

Files

.github/workflows/ci.yml                 "Lint workflows" (actionlint, pinned + checksummed) and "Validate skills"
.github/workflows/codeql.yml             "CodeQL" on the actions language, skipped until the repo is public
.github/pull_request_template.md         skills-specific checklist
.github/ISSUE_TEMPLATE/*.yml             bug report, feature request, question, config with blank issues off
.github/assets/blocks-logo-*.svg         README header logos
SECURITY.md                              what the skills touch, trust boundaries, private reporting link
README.md                                logo header and CI / license badges

"Validate skills" checks that every skills/*/SKILL.md has a frontmatter name matching its directory and a description, that npx skills add . --list discovers every skill directory, that nothing in the repo contains a real-looking ApiKey or an internal host, and that install.sh parses.

No release workflow: this repo does not tag releases.

Settings applied directly (not in this diff)

• Merge methods: squash only (rebase merge turned off). Homepage, description, and topics set.
• Secret scanning, push protection, validity checks, and non-provider patterns enabled. Dependabot alerts enabled.
• Rulesets, copied from blocks-ci-sessions with the required checks renamed to this repo's jobs:
  • Protect main: no deletion or force-push, PR required with 1 approval, dismiss stale reviews, last-push approval, extra approval for unattributed changes, squash only, strict required checks Lint workflows, Validate skills, CodeQL. Repository admins bypass.
  • Protect version tags (v*.*): no deletion, force-push, or update.
  • Protect floating major tags (v* except v*.*): no deletion.

Visibility is unchanged (internal) and left for a manual change.

Merge order

1. Merge this PR into feature/blocks-api-skill. That puts the workflows on Add blocks-api skill and npx skills install scaffolding #1 so its required checks can run.
2. Merge Add blocks-api skill and npx skills install scaffolding #1 into main once the checks are green and it has an approval, or use the admin bypass.

How I verified

• actionlint 1.7.12 (same tarball and checksum as the workflow) passes on both workflow files.
• Every step of "Validate skills" was run locally against this tree and passed.
• The Checks tab on this PR shows the live runs.

🤖 Generated with Claude Code

[cubeorgdev]

This pull request was created from a Blocks session.

View in dashboard | View on desktop