[tool] Update skills_lint to ^0.5.2 and add SARIF code scanning - #240
Open
reidbaker-agent wants to merge 1 commit into
Open
reidbaker-agent wants to merge 1 commit into
reidbaker-agent wants to merge 1 commit into
Conversation
- Bump skills_lint to ^0.5.2 in tool/generator/pubspec.yaml - Add .github/workflows/code_scanning.yaml workflow using skills_lint --format=sarif and github/codeql-action/upload-sarif - Verify path resolution in tool/generator/skills_lint.yaml under skills_lint 0.5.2 - Verify SARIF generation and schema validity locally - Verify all 100 tests pass cleanly with zero static analysis warnings
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
reidbaker
approved these changes
Sep 18, 2026
reidbaker
marked this pull request as ready for review
September 18, 2026 21:44
johnpryan
approved these changes
Sep 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Most important feature in 0.5.2 is that we can now use github SARIF format to have comments on skills when the linter fails and not just a failing test.
Agent authored pr using skills_lint /downstream-consumers skill
Gemini 3.8 flash, high effort.
Agent authored description
Details
Updates `tool/generator` to depend on `skills_lint: ^0.5.2` and adds the GitHub Code Scanning workflow for automated SARIF reporting.Summary of Changes
skills_lint: Updatedtool/generator/pubspec.yamldev_dependency to^0.5.2..github/workflows/code_scanning.yamlto rundart run skills_lint --format=sarifand upload findings to GitHub Code Scanning viagithub/codeql-action/upload-sarif.tool/generator/skills_lint.yamlresolves correctly with 0.5.2. In 0.5.2, directory and skill paths resolve relative to the declaring config file, ensuringpath: "../../skills"reliably resolves to<repo-root>/skillsregardless of invocation working directory.dart run skills_lint --format=sarifoutputs valid OASIS SARIF 2.1.0 JSON.skills/(no violation ofblock-dart-skills-prs.yaml).dart pub getran cleanly.dart format tool/generator/reports 0 changed files.dart analyze --fatal-infos tool/generator/reports no issues.dart testpasses cleanly (all 100 tests passing).