Update flutter skill regularly

[code-schreiber]

No description provided.

[opencode-agent]

Here's my review of PR — Update flutter skill regularly:

---

File name conventions

Skill Update.yml — Spaces in workflow filenames work but are highly unconventional. Rename to skill-update.yml to match standard GitHub Actions naming patterns.

Potential issues

1. Non-existent package.json

The workflow relies on npx skills add flutter/skills. Since this project has no package.json, the skills CLI version is never pinned. A change in the CLI could break the workflow or produce different results. Consider adding a minimal package.json with skills as a devDependency.

2. actions/checkout@v6

The latest stable version of actions/checkout is v4 in my knowledge. If v6 does not exist, this will fail at runtime. Verify the correct version tag.

3. Broad skill import

--skill '*' imports all Flutter skills. This is very aggressive — it likely installs many irrelevant skills. Consider scoping to only the skills actually needed by this project.

4. Fixed branch name

The PR branch is hardcoded to chore/update-skills. If a previous run's PR is still open, the action pushes to the same branch (updating the PR). That's fine, but if the branch is deleted or the PR is closed without merging, the next run will recreate it. This is acceptable but worth being aware of.

5. No skills-lock.json exists yet

The PR's own checklist references skills-lock.json and .opencode/skills/, but neither exists in the repo. The workflow will create these, but the first run will generate them from scratch. Ensure the team reviews the initial generated output carefully before merging.

Suggestions

Area	Suggestion
Filename	Rename to .github/workflows/skill-update.yml
Dependency pinning	Add a package.json with "skills": "^x.y.z"
Skill scope	Replace --skill '*' with specific skill names relevant to the project
Checkout version	Confirm @v6 exists or pin to @v4
Scheduling	0 5 * * 1-5 runs weekdays at 5 AM UTC — confirm this is the intended cadence

Summary

The PR adds a reasonable automated skill update workflow. The main concerns are the unchecked skills CLI version (no lockfile/pin), potentially over-broad skill import (*), and the file naming convention. Fix those and this is good to go.

github run

[opencode-agent]

Here's my review:

---

Critical Issues

1. Change detection misses untracked files (Skill Update.yml:24)

if ! git diff --quiet HEAD; then

git diff --quiet HEAD only checks tracked file modifications, not new files. If skills add creates new untracked files (likely for a first run), the change goes undetected and no PR is created. Fix:

if ! git diff --quiet HEAD || [ -n "$(git ls-files --others --exclude-standard)" ]; then

2. Empty orphan workflow file (opencode.yml)

The commit history shows opencode.yml was "renamed" to opencode-review.yml", but the old file was emptied instead of deleted. An empty YAML file in .github/workflows/ should be removed (git rm`).

Minor Issues

3. actions/checkout@v6 (both new files) — actions/checkout latest public release is v4. flutter.yml already uses @v5, so this follows existing convention, but neither v5 nor v6 exist in the official marketplace.

4. Filename has spaces — Skill Update.yml works but is non-standard. Rename to skill-update.yml.

Answers to open review comments

Permissions (Skill Update.yml:8): contents: write + pull-requests: write are the minimum required for create-pull-request to push a branch and open a PR. These are correct.

Checklist (Skill Update.yml:40):

• Remove: "Document any new conventions" — too vague and won't be actionable for an automated PR
• Add: "Verify lockfile format is valid" and "Confirm no unexpected files were modified"

Summary

Two real bugs (untracked file detection, orphaned empty workflow), one actionable suggestion (rename file), and one questionable action version that follows the repo's existing convention.

github run

[opencode-agent]

Here is my review of the PR.

---

Bugs

1. YAML indentation mismatch in opencode.yml:25

The uses key in the "Run OpenCode" step is indented with 8 spaces, but name (same step) starts at column 10. This mismatch will likely cause a YAML parse error or the uses to be treated as a sibling of the step instead of a property.

Current:

       - name: Run OpenCode
        uses: anomalyco/opencode/github@latest

name is at column 10 (7 spaces + - ), uses is at column 9 (8 spaces). Fix by adding one more space before uses:

       - name: Run OpenCode
         uses: anomalyco/opencode/github@latest

2. Change detection ignores new files in Skill Update.yml:24

git diff --quiet HEAD only checks modifications to tracked files. If npx skills add creates new files (e.g., on first run or when a new skill is added), the change goes undetected and no PR is created. Fix:

if ! git diff --quiet HEAD || [ -n "$(git ls-files --others --exclude-standard)" ]; then

---

Potential Issues

3. actions/checkout@v6 (all 3 files)

The latest official release from actions/checkout is v4. v5 and v6 do not exist on the marketplace. This will fail at runtime. This pattern is pre-existing in the repo but this PR continues it. Pin to @v4.

4. anomalyco/opencode/github@latest (opencode-review.yml:18, opencode.yml:25)

Mutable @latest tags are dangerous — a breaking release will silently break the workflow. Pin to a specific version tag.

5. opencode.yml — orphaned empty file?

Commit 863e668 renamed the old opencode.yml content to opencode-review.yml and wrote new content to opencode.yml, but opencode.yml was previously empty (Git blob e69de29). If the old opencode.yml had content that was moved, it should be confirmed no content was lost.

6. opencode-review.yml — missing trailing newline

The file lacks a POSIX-compliant trailing newline (shown as \ No newline at end of file).

7. opencode-review.yml permissions

Uses pull-requests: read but needs to write review comments. The opencode/github action may authenticate via id-token rather than GITHUB_TOKEN, but if it uses GITHUB_TOKEN, this will fail. Verify which auth mechanism is used.

---

Suggestions

Area	Suggestion
Filename	Rename Skill Update.yml → skill-update.yml
Skill scope	Replace --skill '*' with specific skill names
Dependency pinning	Add a package.json with "skills": "^x.y.z"
Checklist	Remove "Document any new conventions" (too vague for an automated PR), add "Verify lockfile format is valid" and "Confirm no unexpected files were modified"

---

Summary

The PR has one confirmed bug (YAML indentation in opencode.yml that will cause a parse error) and one logic bug (change detection misses new files). The @v6 checkout version will fail at runtime. Fix those and this is in good shape.

github run

[opencode-agent]

PR Review: Update flutter skill regularly

Bugs (confirmed, still present)

1. Change detection misses new/untracked files — Skill Update.yml:24

if ! git diff --quiet HEAD; then

git diff --quiet HEAD only checks modifications to tracked files. When npx skills add creates new files (e.g., first run or new skills), the change is undetected and no PR is created. Use:

if ! git diff --quiet HEAD || [ -n "$(git ls-files --others --exclude-standard)" ]; then

2. pull-requests: read may be insufficient — opencode-review.yml:13

The opencode/github action likely needs to write review comments on PRs, but the permission is set to read only. This will fail silently or throw an auth error depending on how the action authenticates. Should be pull-requests: write.

Potential Issues

3. @latest mutable tag — opencode-review.yml:18, opencode.yml:25

anomalyco/opencode/github@latest will silently pick up breaking changes. Pin to a specific version tag.

4. actions/checkout@v6 — all 3 files

If v6 doesn't exist yet on the marketplace, this fails at runtime. Pin to a known good version (the repo previously used v5 in flutter.yml).

5. Unpinned skills CLI — Skill Update.yml:19

npx skills add flutter/skills runs whatever version npm resolves. No package.json pins it. A breaking CLI release breaks the workflow with no warning.

6. Over-broad skill import — Skill Update.yml:19

--skill '*' imports every Flutter skill, many of which may be irrelevant. Scope to actual project needs.

Suggestions

Area	Suggestion
Filename	Rename Skill Update.yml → skill-update.yml
Trailing newline	Add POSIX trailing newline to opencode-review.yml
Scheduling	0 5 * * 1-5 runs weekdays at 5 AM UTC — confirm this cadence is intended
PR checklist	Remove "Document any new conventions" (too vague for automation); add "Verify lockfile format is valid"

What was already fixed

The YAML indentation issue in opencode.yml (noted in a prior review) was fixed in commit d41902e.

Summary

Two real bugs: untracked file detection (Skill Update.yml:24) and insufficient write permission for PR reviews (opencode-review.yml:13). The @latest tags and actions/checkout@v6 version are risky. Fix those and add a package.json to pin the skills CLI version.

github run

[opencode-agent]

Renamed .github/workflows/Skill Update.yml → .github/workflows/skill-update.yml.

github run

[opencode-agent]

User opencode-agent[bot] does not have write permissions

github run

[opencode-agent]

PR Review: Update flutter skill regularly

Bugs

1. Missing contents: read permission — opencode.yml:15-16

The new opencode.yml dropped contents: read and pull-requests: read that existed in the old version. With only id-token: write specified, all other permissions default to none. actions/checkout@v6 will fail because GITHUB_TOKEN lacks read access.

Old: permissions: { id-token: write, contents: read, pull-requests: read }
New: permissions: { id-token: write } ← contents: read is missing

2. actions/checkout@v6 — all 3 files

The latest official release of actions/checkout is v4. v5 and v6 don't exist on the marketplace. Every workflow will fail at runtime.

3. Change detection misses new files — skill-update.yml:24

if ! git diff --quiet HEAD; then

git diff --quiet HEAD only checks modifications to tracked files. When npx skills add creates new untracked files, the change is undetected and no PR is created. Fix:

if ! git diff --quiet HEAD || [ -n "$(git ls-files --others --exclude-standard)" ]; then

Issues

4. anomalyco/opencode/github@latest mutable tag — opencode-review.yml:18, opencode.yml:25

@latest silently picks up breaking releases. Pin to a specific version tag.

5. Unpinned skills CLI — skill-update.yml:19

npx skills add resolves to whatever version npm decides. A breaking CLI release breaks the workflow silently. Add a package.json with "@opencode/skills": "^x.y.z" as a devDependency.

6. --skill '*' is too broad — skill-update.yml:19

Imports every Flutter skill, many irrelevant. Scope to specific skills the project actually uses.

Checklist suggestions (skill-update.yml:40-44)

• Remove "Document any new conventions" — not actionable for an automated PR
• Add "Verify lockfile format is valid" — catches corruption
• Add "Confirm no unexpected files were modified" — catches drift

Already fixed ✓

• YAML indentation bug in opencode.yml (commit d41902e)
• pull-requests: read → write in opencode-review.yml (commit cedf1b0)
• Filename Skill Update.yml → skill-update.yml (commit af1a659)

Summary

3 confirmed bugs (missing contents: read, actions/checkout@v6 doesn't exist, change detection misses new files). Fix those and pin the @latest tag and this is ready to go.

github run

[opencode-agent]

Yes. contents: write (push branch) + pull-requests: write (create PR) is exactly the minimum for peter-evans/create-pull-request. Nothing extra.

github run