[beldar]

Summary

Skills are now pushed to the rolling automated/skills-sync PR by the producer repo, so the old pull-based sync can go. This PR removes it and adds a small workflow for the release chores the old sync used to do.

Ticket: PD-126336

Removed

• scripts/sync-skills.mjs: cloned pandadoc-studio/agentic-hub-skills with a personal token and vendored skills/.
• scripts/lib/hash.mjs: only used by the script above.
• .sync-notes.md entry in .gitignore: leftover from the old sync.
• skills.lock.json: only the old sync read and wrote it. The push-based sync commits touch skills/ only, and no docs or scripts reference it.
• .github/workflows/sync-skills.yml was already deleted on main (#9d98e52).

Added

sync-release-chores.yml + scripts/bump-plugin-version.mjs. The push-based pipeline only writes skills/, so this covers what the old sync did on top of that. On PRs from automated/skills-sync into main it:

1. Sets all six plugin manifests to base version + 1 (patch) and adds the CHANGELOG.md entry (Added / Updated / Removed skills).
2. Runs claude plugin validate . --strict (@latest, unpinned on purpose).
3. Commits the bump to the sync branch with the release bot App token, so CI still triggers on the PR.

The bump is derived from the base branch, so re-runs on a re-synced PR are idempotent.

Testing

• Ran the bump script against the real origin/automated/skills-sync branch in a throwaway worktree: 1.0.3 → 1.0.4 across all manifests, changelog entry correct, identical output on a second run.
• claude plugin validate . --strict passes on this branch and on the sync branch after the bump.
• No references to sync-skills, lib/hash, skills.lock.json or SKILLS_REPO_TOKEN remain.
• Not tested: the workflow itself in Actions (needs the secrets below).

Before merging

• RELEASE_BOT_APP_ID and RELEASE_BOT_PRIVATE_KEY repo secrets exist, and the App is installed on this repo with contents write access (and allowed to push to automated/skills-sync if a ruleset covers it).

Heads-up

• plugin.json, .cursor-plugin/plugin.json, .github/plugin/plugin.json, gemini-extension.json and server.json are at 1.0.0 while .claude-plugin/plugin.json is at 1.0.3. The first run moves all of them to base + 1, so expect a larger manifest diff on the next sync PR (chore(skills): sync skills v0.2.5 #16), including server.json.
• Changelog entries no longer include the old "Synced from … (commit)" line.

Follow-ups from the ticket (not in this PR)

• Delete the SKILLS_REPO_TOKEN Actions secret and revoke the underlying personal token.
• Confirm no leftover branch or PR from the old workflow remains.

🤖 Generated with Claude Code