You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

@/home/runner/work/_temp/skil-lock-pr-comment.md

Live verification report

The workflow ran end-to-end on this PR. Results:

SARIF upload — works

• Workflow completed in 18s; Successfully uploaded results, Analysis upload status is complete.
• 2 Code Scanning alerts created on refs/pull/1/merge:
  • Alert feat(ci): live verification of v0.1.1 SARIF upload #1 (SKL-SHELL, severity error): Skill "changelog-summary" added shell_commands: curl — matches require_approval.
  • Alert docs(readme): bump CLI install pin v0.1.0 -> v0.1.1 #2 (SKL-NETWORK, severity error): Skill "changelog-summary" added network_urls: https://internal.example.com/notify — host not in allowed_domains.
• Location: .claude/skills/changelog-summary/SKILL.md.
• Conclusion: v0.1.1's SARIF path is production-ready.

PR comment — bug found

The PR comment posted by the workflow contains the literal string @/home/runner/work/_temp/skil-lock-pr-comment.md instead of the markdown body. Root cause: gh api -f body=@$BODY was relying on a curl convention that gh CLI does not implement.

Fix in flight at skills-lock/skil-lock-action#2 — pipes the body file through jq -Rs '{body: .}' + gh api --input -. All CI green there; awaits review + v0.1.2 tag.

Next steps for this PR

1. Merge skil-lock-action#2.
2. Cut v0.1.2 of the Action.
3. Bump this PR's workflow file to skills-lock/skil-lock-action@v0.1.2 (and pin-binary: v0.1.2).
4. Re-run; confirm the PR comment now renders as a real markdown table with the BLOCK verdict + paste-back approval snippet.
5. After confirmation, this PR can either be closed (it's a smoke test) or merged to demonstrate the SARIF surface on main.

CI gap follow-up

The PR-comment path was never exercised by CI before this PR — composite-smoke is push-triggered, so the if: github.event_name == 'pull_request' guard skipped it. Filed as skills-lock/skil-lock-action#3 — recommended fix is a workflow_dispatch-driven synthetic-PR fixture.

SkilLock - capability delta

Comparing skills.lock (baseline) vs <working tree> (current).

Verdict: BLOCK: 2 of 2 entries at severity >= medium

To approve, append to .skil-lock-approvals.yaml:

schema_version: "0.1"
approvals:
  - skill: "changelog-summary"
    delta:
      added_shell_command: "curl"
    reviewer: "you@example.com"
    reviewed_at: "2026-05-25T06:33:42Z"
    reason: "<why this delta is acceptable>"
  - skill: "changelog-summary"
    delta:
      added_network_url: "https://internal.example.com/notify"
    reviewer: "you@example.com"
    reviewed_at: "2026-05-25T06:33:42Z"
    reason: "<why this delta is acceptable>"

v0.1.2 verified — PR comment now renders correctly

After bumping the workflow to skills-lock/skil-lock-action@v0.1.2 (commit 66d9f4d), the new run posted a real markdown PR comment with the full BLOCK verdict + capability-delta table + paste-back approval snippet (the comment a few rows above this one with the <!-- skil-lock:pr-comment --> marker).

Confirmed working:

• ✅ SARIF upload → Code Scanning alerts (SKL-SHELL, SKL-NETWORK)
• ✅ PR comment renders as real markdown
• ✅ Paste-back approval snippet appears below the verdict
• ✅ Exit code propagates correctly (job marked "failed" because BLOCK = exit 1, which is the intended UX)

The wedge is now end-to-end live. Closing this PR; the example/drift branch + main baseline remain as the demo state.

Action items finished for the maintainer

1. ✅ Action v0.1.2 tagged and released.
2. ✅ This PR's workflow updated to v0.1.2.
3. ✅ PR comment behavior re-verified.

Demo-repo main can be bumped to skills-lock/skil-lock-action@v0.1.2 whenever convenient — done in a follow-up PR (or directly to main since this is a demo repo, admin's call).

Closing: obsolete v0.1.1-era SARIF live-test branch. SARIF upload is verified working end-to-end through this repo's CI on v0.2.0 (skil-lock-action pinned to v0.2.0 SHA c7a3b9f). Superseded.