What pipelines do
Stages are fixed: safely fetch Git, discover SKILL.md, statically validate, and store content and versions. Builds bind to a fixed commit SHA. Webhooks, manual synchronization, and periodic checks use the same job queue.
Arbitrary step orchestration, shell execution, and custom test plugins are not supported. Repository scripts may be inspected but are never executed by the pipeline.
Repository configuration
Commit .skills-platform.yaml at the repository root:
version: 1
skills:
root: skills
pipeline:
trigger:
branches:
- main
validate:
blockScripts: true
blockExternalLinks: true
| Setting | Behavior |
|---|---|
| version | Only 1 is accepted |
| skills.root | Scan directory; overrides the repository page's root |
| pipeline.trigger.branches | Validates the configured branch against an allowlist |
| pipeline.trigger.tags | Validates tags when the default ref targets a tag |
| validate.blockScripts | Blocks detected script content |
| validate.blockExternalLinks | Blocks detected external links |
Branches and tags use exact matching, such as main or refs/heads/main. Wildcards such as release/* are not supported here. Multiple entries do not create multiple branch listeners: the repository's default ref remains the synchronization target. A mismatch produces a configuration diagnostic. Omitting a list adds no restriction for that ref type.
Unknown fields are rejected. Adding steps or run does not enable command execution.
Organization policy
Security settings(console) controls per-file bytes, total bytes, file count, scripts, and external links. Defaults are 8 MiB per file, 64 MiB total, and 10,000 files. Tree resource limits can cover files throughout the fetched tree; keep repositories focused.
Repository configuration can tighten but cannot relax organization policy. Setting false cannot disable an organization-level block. Static detection does not prove content safe; publishers must still review warnings.
Webhooks and reconciliation
Repository details provides webhook URLs and configuration. GitHub, GitLab, and Gitea use provider signatures or shared tokens and delivery-ID deduplication.
The worker checks remotes every minute to recover missed webhooks. Builds deduplicate unchanged commits and effective configurations. Expired Git credentials affect future synchronization, not existing published snapshots.
Custom tests and model evaluations
Run custom tests in external CI. Merge approved commits into the tracked branch, then let Skiva validate and deliver them.
Feature branch → External CI tests / evaluations → Merge main
→ Skiva sync and validation → Canary → Stable
Skiva does not enforce an external-CI release gate. Configure required checks and branch protection at the Git service if passing evaluations must be mandatory.
Read diagnostics
Diagnostics include ruleId, severity, file path, line, and explanation. Fix blockers and commit again; review warnings before release. Fetch failures may appear only as synchronization errors because no buildable commit has been resolved yet.
Discovery, validation, and content writes share one static scan. Displayed stage times may overlap and must not be summed as total duration.