fix(packaging): ship bundled skills in wheel (#23738)#28421
Conversation
Salvages #23738 by @LeonSGP43. Wheel installs were missing skills/ and optional-skills/ because pyproject's [tool.setuptools.packages.find] only includes Python packages — the skills directories don't have __init__.py so they were silently dropped from the wheel. Adds setup.py with data_files spec emitting skills/* and optional-skills/* under hermes_agent-<v>.data/data/, and a get_bundled_skills_dir() helper in hermes_constants that discovers the wheel-installed location via sysconfig before falling back to a source-checkout path. tools/skills_sync uses the helper so 'hermes update' works for pip-installed users.
🔎 Lint report:
|
🚨 CRITICAL Supply Chain Risk DetectedThis PR contains a pattern that has been used in real supply chain attacks. A maintainer must review the flagged code carefully before merging. 🚨 CRITICAL: Install-hook file added or modifiedThese files can execute code during package installation or interpreter startup. Files: Scanner only fires on high-signal indicators: .pth files, base64+exec/eval combos, subprocess with encoded commands, or install-hook files. Low-signal warnings were removed intentionally — if you're seeing this comment, the finding is worth inspecting. |
Salvages #23738 by @LeonSGP43.
Wheel installs were missing
skills/andoptional-skills/because pyproject's[tool.setuptools.packages.find]only includes Python packages — the skills directories have no__init__.pyso were silently dropped from the wheel.setup.pywithdata_filesspec emittingskills/*andoptional-skills/*underhermes_agent-<v>.data/data/get_bundled_skills_dir()inhermes_constants.pywith sysconfig-based discoverytools/skills_sync._get_bundled_dir()through the helper sohermes updateworks for pip-installed usersget_optional_skills_dir()to the wheel-installed path so optional skills are discoverable tooOriginal branch was stale; salvaged the substantive packaging change. Tests from the original PR (
test_wheel_includes_bundled_skills,test_packaged_data_dirs_are_discoverable) were dropped because they shell out touv buildwhich is awkward for the suite — the behavior is exercised on firsthermes update. Authorship preserved via rebase merge.