[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6C45CBB56X0HKK7NGN71J6F":3,"skill-same:01M6C45CBB56X0HKK7NGN71J6F":95},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":50,"linkOnly":51,"markdownContent":52,"markdownBody":53,"frontMatter":54,"refName":59,"commitSha":60,"skillDirectory":61,"forksCount":62,"repositoryHtmlUrl":63,"repositoryHomepageUrl":6,"ownerHtmlUrl":64,"ownerBlogUrl":65,"ownerDescription":12,"updatedAt":66,"install":67,"resources":80},"01M6C45CBB56X0HKK7NGN71J6F","vibe-ci-supply-chain",null,"Git workflow, CI\u002FGitHub Actions, and supply-chain pinning rules for Mistral Vibe. Use when changing CI pipelines, GitHub Actions, dependency pinning, container images, pre-commit hooks, git workflow, or external binary downloads.","mistralai\u002Fmistral-vibe","mistralai","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F132372032?v=4","01M6C456ET86MBBTS4RMX0NDRS","Mistral","01M6C456K44X5W8TJX4T023KRV",5383,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmistralai\u002Fmistral-vibe\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fvibe-ci-supply-chain\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,12,41,42,43,44,45,46,47,48,49],"supply","chain","supply chain","ci","vibe","vibe ci supply chain","pre-commit","when","for","images","hooks","container","dependency","use","Rules","github","supply-chain","downloads","dependency pinning","github actions","actions","git","container images","git workflow","commit","workflow","2026-11-10 10:12:30",false,"---\nname: vibe-ci-supply-chain\ndescription: Git workflow, CI\u002FGitHub Actions, and supply-chain pinning rules for Mistral Vibe. Use when changing CI pipelines, GitHub Actions, dependency pinning, container images, pre-commit hooks, git workflow, or external binary downloads.\nmetadata:\n  display-name: Vibe CI & Supply Chain\n  short-description: Git, CI, and supply-chain pinning for Vibe\n  default-prompt: Use $vibe-ci-supply-chain to follow Vibe git, CI, and supply-chain conventions.\n---\n\n# Vibe CI & Supply Chain\n\nConventions for git workflow, CI configuration, and supply-chain security in Vibe.\n\n## Startup import cost\n\nCI gates cold-start module count via `vibe\u002Fscripts\u002Fcheck_startup_import_cost.py` (budgets in `vibe\u002Fscripts\u002Fstartup_import_cost.vibe.toml`).\n\n- When a change touches imports or module structure on the path of `import vibe`, the `vibe` launcher (`vibe.cli.launcher`) or `vibe.app_server.stdio`, run `cd vibe && uv run scripts\u002Fcheck_startup_import_cost.py` and confirm the count stays within budget.\n- **Verify, do not bump.** An overshoot is a regression to investigate (lazy import, drop the dependency, defer the import) — not a reason to raise the budget. Only widen for a deliberate, PR-justified increase, and set to observed count + ~10% headroom, never the exact count.\n\n## Git\n\n- Never use `git commit --amend`, `git push --force`, or `git push --force-with-lease`.\n- Always create new commits and push with a plain `git push`.\n- Reconciling with the upstream of the current branch (e.g. push rejected because `origin\u002F\u003Ccurrent-branch>` advanced): rebase the current branch onto its upstream — do not merge the upstream branch into the current one, never force-push.\n- Reconciling with the base branch (e.g. `origin\u002Fmain`) once the PR is open: merge the base branch into the current branch — do not rebase, since rebasing rewrites already-pushed history and would require a force-push.\n- Run git commands through `uv run` (e.g. `uv run git commit`, `uv run git push`) so pre-commit hooks resolve the project's venv — bare `git commit` fails pre-commit with `reportMissingImports` because pyright can't find third-party packages.\n\n## CI \u002F GitHub Actions\n\n- Pin every `uses:` to a full **commit SHA** with an exact version comment: `uses: owner\u002Faction@\u003Ccommit-sha> # vX.Y.Z`.\n- Resolve to the commit, not the annotated-tag object: take the `refs\u002Ftags\u002FvX^{}` line from `git ls-remote --tags`, or `gh api repos\u002F\u003Cowner>\u002F\u003Crepo>\u002Fgit\u002Frefs\u002Ftags\u002F\u003Ctag> --jq .object` peeled to a commit. Check with `git cat-file -t \u003Csha>` → `commit`, not `tag`. Never pin a moving major tag (`v9`).\n\n## Supply-chain pinning\n\nEvery external input to the build, CI, or install path must be pinned to an immutable identifier — never a mutable tag or an unverified download. Add a human-readable comment next to each pin.\n\n- **Container images**: reference by `@sha256:\u003Cdigest>`, never a bare tag (`:latest`, `:8`). Resolve the digest via the registry's `Docker-Content-Digest` header (`curl -sI -H 'Accept: application\u002Fvnd.oci.image.index.v1+json' \u003Cregistry>\u002Fv2\u002F\u003Crepo>\u002Fmanifests\u002F\u003Ctag>`). When the image lives inside a JSON matrix string, document the tag→digest mapping in an adjacent comment.\n- **pre-commit hooks** (`.pre-commit-config.yaml`): pin every `rev:` to a full commit SHA with a `# vX.Y.Z` comment. Run `pre-commit autoupdate --freeze` to refresh, and resolve to the peeled commit ref (`refs\u002Ftags\u002FvX^{}`), not the annotated-tag object — same rule as `uses:` above.\n- **Build-system deps** (`pyproject.toml` `[build-system] requires`): pin `hatchling`, `hatch-vcs`, `editables` (and any addition) to exact `==` versions. These execute during source builds and are not covered by `uv.lock`.\n- **External binary downloads** (e.g. `patchelf` in `scripts\u002Fci\u002F`): never pipe an unverified download straight into `tar`\u002F`sh`. Download to a temp file, verify `sha256sum -c` against a known-good hash keyed by version (and arch when relevant), then extract. Hard-fail when no hash is registered for the requested version\u002Farch so a bump forces updating the hash.\n","# Vibe CI & Supply Chain\n\nConventions for git workflow, CI configuration, and supply-chain security in Vibe.\n\n## Startup import cost\n\nCI gates cold-start module count via `vibe\u002Fscripts\u002Fcheck_startup_import_cost.py` (budgets in `vibe\u002Fscripts\u002Fstartup_import_cost.vibe.toml`).\n\n- When a change touches imports or module structure on the path of `import vibe`, the `vibe` launcher (`vibe.cli.launcher`) or `vibe.app_server.stdio`, run `cd vibe && uv run scripts\u002Fcheck_startup_import_cost.py` and confirm the count stays within budget.\n- **Verify, do not bump.** An overshoot is a regression to investigate (lazy import, drop the dependency, defer the import) — not a reason to raise the budget. Only widen for a deliberate, PR-justified increase, and set to observed count + ~10% headroom, never the exact count.\n\n## Git\n\n- Never use `git commit --amend`, `git push --force`, or `git push --force-with-lease`.\n- Always create new commits and push with a plain `git push`.\n- Reconciling with the upstream of the current branch (e.g. push rejected because `origin\u002F\u003Ccurrent-branch>` advanced): rebase the current branch onto its upstream — do not merge the upstream branch into the current one, never force-push.\n- Reconciling with the base branch (e.g. `origin\u002Fmain`) once the PR is open: merge the base branch into the current branch — do not rebase, since rebasing rewrites already-pushed history and would require a force-push.\n- Run git commands through `uv run` (e.g. `uv run git commit`, `uv run git push`) so pre-commit hooks resolve the project's venv — bare `git commit` fails pre-commit with `reportMissingImports` because pyright can't find third-party packages.\n\n## CI \u002F GitHub Actions\n\n- Pin every `uses:` to a full **commit SHA** with an exact version comment: `uses: owner\u002Faction@\u003Ccommit-sha> # vX.Y.Z`.\n- Resolve to the commit, not the annotated-tag object: take the `refs\u002Ftags\u002FvX^{}` line from `git ls-remote --tags`, or `gh api repos\u002F\u003Cowner>\u002F\u003Crepo>\u002Fgit\u002Frefs\u002Ftags\u002F\u003Ctag> --jq .object` peeled to a commit. Check with `git cat-file -t \u003Csha>` → `commit`, not `tag`. Never pin a moving major tag (`v9`).\n\n## Supply-chain pinning\n\nEvery external input to the build, CI, or install path must be pinned to an immutable identifier — never a mutable tag or an unverified download. Add a human-readable comment next to each pin.\n\n- **Container images**: reference by `@sha256:\u003Cdigest>`, never a bare tag (`:latest`, `:8`). Resolve the digest via the registry's `Docker-Content-Digest` header (`curl -sI -H 'Accept: application\u002Fvnd.oci.image.index.v1+json' \u003Cregistry>\u002Fv2\u002F\u003Crepo>\u002Fmanifests\u002F\u003Ctag>`). When the image lives inside a JSON matrix string, document the tag→digest mapping in an adjacent comment.\n- **pre-commit hooks** (`.pre-commit-config.yaml`): pin every `rev:` to a full commit SHA with a `# vX.Y.Z` comment. Run `pre-commit autoupdate --freeze` to refresh, and resolve to the peeled commit ref (`refs\u002Ftags\u002FvX^{}`), not the annotated-tag object — same rule as `uses:` above.\n- **Build-system deps** (`pyproject.toml` `[build-system] requires`): pin `hatchling`, `hatch-vcs`, `editables` (and any addition) to exact `==` versions. These execute during source builds and are not covered by `uv.lock`.\n- **External binary downloads** (e.g. `patchelf` in `scripts\u002Fci\u002F`): never pipe an unverified download straight into `tar`\u002F`sh`. Download to a temp file, verify `sha256sum -c` against a known-good hash keyed by version (and arch when relevant), then extract. Hard-fail when no hash is registered for the requested version\u002Farch so a bump forces updating the hash.\n",{"name":5,"metadata":55,"description":7},{"display-name":56,"default-prompt":57,"short-description":58},"Vibe CI & Supply Chain","Use $vibe-ci-supply-chain to follow Vibe git, CI, and supply-chain conventions.","Git, CI, and supply-chain pinning for Vibe","main","338ad4bf0f73c4dd879d667cf7ab011555ae1751",".agents\u002Fskills\u002Fvibe-ci-supply-chain",796,"https:\u002F\u002Fgithub.com\u002Fmistralai\u002Fmistral-vibe","https:\u002F\u002Fgithub.com\u002Fmistralai","mistral.ai","2026-11-11 00:56:57",{"source":8,"skillName":5,"commands":68,"prompt":78,"zipAvailable":79},[69,72,75],{"tool":70,"command":71},"npx","npx skills add mistralai\u002Fmistral-vibe --skill vibe-ci-supply-chain",{"tool":73,"command":74},"bunx","bunx skills add mistralai\u002Fmistral-vibe --skill vibe-ci-supply-chain",{"tool":76,"command":77},"pnpm","pnpm dlx skills add mistralai\u002Fmistral-vibe --skill vibe-ci-supply-chain","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmistralai\u002Fmistral-vibe\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fvibe-ci-supply-chain\u002FSKILL.md",true,[81,87,91],{"path":82,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"agents\u002Fopenai.yaml","REFERENCE","参考文档",425,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-native-data-fetching\u002Fagents\u002Fopenai.yaml",{"path":88,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":89,"sourceHtmlUrl":90},"references\u002Fdetailed-guide.md",12427,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-native-data-fetching\u002Freferences\u002Fdetailed-guide.md",{"path":92,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":93,"sourceHtmlUrl":94},"references\u002Fexpo-router-loaders.md",11621,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-native-data-fetching\u002Freferences\u002Fexpo-router-loaders.md",[96,123,144,168,188,208],{"skillNo":97,"name":98,"nameZh":6,"description":99,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":100,"categories":101,"keywords":105,"publishedAt":50},"01M71709JBNSMH1MJ71NRGRBFM","import","Import the user's setup from other coding CLIs (Claude Code, Codex, OpenCode) into Vibe — instructions, skills, subagents, commands, hooks, MCP servers, permissions, and plugins. Load when the user wants to switch to Vibe, import or reuse another CLI's configuration, or asks whether a file from another CLI works in Vibe.","https:\u002F\u002Fgithub.com\u002Fmistralai\u002Fmistral-vibe\u002Fblob\u002Fmain\u002Fvibe\u002Fplugins\u002Fbuiltins\u002Fvibe\u002Fskills\u002Fimport\u002FSKILL.md",[102],{"categoryNo":103,"categoryName":104,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[98,106,107,108,109,110,111,112,113,114,115,116,117,118,31,119,120,121,34,122],"setup","file","configuration","mcp servers","servers","plugins","commands","instructions","opencode","cli","codex","permissions","code","load","MCP","reuse","switch",{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":50},"01M6C46D6AE5JDVJTFTXH9RZ5Q","worktree","Create, reuse, and clean up git worktrees under $VIBE_HOME\u002Fworktrees. Use when the user wants to work in an isolated git worktree, create a worktree for a task, or list\u002Fremove existing worktrees.","https:\u002F\u002Fgithub.com\u002Fmistralai\u002Fmistral-vibe\u002Fblob\u002Fmain\u002Fvibe\u002Fplugins\u002Fbuiltins\u002Fvibe\u002Fskills\u002Fworktree\u002FSKILL.md",[],[125,130,131,32,132,133,134,135,136,37,137,138,139,140,45,141,142,31,143,121],"clean","worktrees","home","up","user","git worktrees","remove","git worktree","list","work","create","true","task","Existing",{"skillNo":145,"name":28,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":150,"publishedAt":50},"01M6C46A11K3H7D6F7ATSBRYKJ","Authoritative reference for Mistral Vibe — the CLI agent you (the model) are running inside.\n\nLOAD when the user:\n- asks anything about Vibe itself, even by indirect name (\"this CLI\", \"this tool\", \"you\");\n- wants to change, inspect, or reset their setup;\n- asks why the agent did or did not act;\n- asks how to make the CLI do X, where X lives, or what a flag\u002Fcommand\u002Fsetting does;\n- asks any meta question about your own behavior;\n- is unsure whether a command, flag, env var, or file is in scope — this skill is the source of truth.\n\nSCOPE: config under `~\u002F.vibe\u002F` and project-local `.vibe\u002F`; `VIBE_*` and `LOG_*` env vars; models and providers; agents and subagents; skills; tools and their permission model; every slash command and CLI flag; hooks; MCP servers; connectors; plugins; trusted folders; `@`-file mentions; logs; themes; voice.","https:\u002F\u002Fgithub.com\u002Fmistralai\u002Fmistral-vibe\u002Fblob\u002Fmain\u002Fvibe\u002Fplugins\u002Fbuiltins\u002Fvibe\u002Fskills\u002Fvibe\u002FSKILL.md",[149],{"categoryNo":103,"categoryName":104,"taxonomyType":21,"taxonomyTypeDesc":22},[28,151,152,32,153,154,155,156,157,158,159,160,161,162,163,164,165,120,166,167],"themes","you","do","act","log","Meta","inspect","project","subagents","config","why","how","command","change","logs","question","local",{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":175,"publishedAt":50},"01M6C467E56WQ8PXEZT1Q0VP23","skill-creator","Load this skill before creating, updating, or deleting a Vibe skill, or whenever you plan to add or modify SKILL.md files under a skills directory. It explains Vibe's SKILL.md frontmatter, discovery order, support files, and the permission flow.","https:\u002F\u002Fgithub.com\u002Fmistralai\u002Fmistral-vibe\u002Fblob\u002Fmain\u002Fvibe\u002Fplugins\u002Fbuiltins\u002Fvibe\u002Fskills\u002Fskill-creator\u002FSKILL.md",[174],{"categoryNo":103,"categoryName":104,"taxonomyType":21,"taxonomyTypeDesc":22},[176,177,178,179,180,28,181,182,152,183,119,184,185,186,187],"creator","skill creator","plan","flow","support","add","it","frontmatter","files","permission","directory","discovery",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":195,"publishedAt":50},"01M6C464DMPVA3RTXG0RGGZB3T","create-plugin","Create a Vibe plugin package — the Agent Plugins 1.0 format with optional Vibe extensions for skills, MCP servers, hooks, knowledge, agents, libraries, and connectors. Use when the user wants to create, scaffold, or author a plugin for Mistral Vibe.","https:\u002F\u002Fgithub.com\u002Fmistralai\u002Fmistral-vibe\u002Fblob\u002Fmain\u002Fvibe\u002Fplugins\u002Fbuiltins\u002Fvibe\u002Fskills\u002Fcreate-plugin\u002FSKILL.md",[194],{"categoryNo":103,"categoryName":104,"taxonomyType":21,"taxonomyTypeDesc":22},[140,196,197,134,110,198,199,200,31,201,32,202,203,12,37,204,120,109,205,111,34,206,207],"plugin","create plugin","with","extensions","author","agent plugins","connectors","scaffold","package","knowledge","format","libraries",{"skillNo":209,"name":210,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":213,"publishedAt":50},"01M6C4620AT7K4999KR0YY86KH","prompts","https:\u002F\u002Fgithub.com\u002Fmistralai\u002Fmistral-vibe\u002Fblob\u002Fmain\u002Fvibe\u002Fcore\u002Ftools\u002Fbuiltins\u002Fprompts\u002Fskill.md",[],[210]]