From 7352f0c1486a599aa3dc297e3e022384fcc87ab7 Mon Sep 17 00:00:00 2001
From: Sanjith Sambath <sanjith.sambath07@gmail.com>
Date: Tue, 14 Jul 2026 15:37:04 -0700
Subject: [PATCH 1/2] Add mirror-skills workflow to sync skills/ into
 agentmail-skills

Syncs skills/ to the agentmail-skills mirror root on every push to
main that touches skills/, recreates the agentmail-sdk alias for
pinned external lockfiles, and guards that all pinned skillPaths
still resolve before pushing with the deploy key.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/mirror.yml | 49 ++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 .github/workflows/mirror.yml

diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
new file mode 100644
index 0000000..0e21fc7
--- /dev/null
+++ b/.github/workflows/mirror.yml
@@ -0,0 +1,49 @@
+name: mirror-skills
+on:
+  push:
+    branches: [main]
+    paths: ['skills/**']
+  workflow_dispatch:
+
+concurrency:
+  group: mirror-skills          # serializes racing merges; no cancel-in-progress
+
+permissions:
+  contents: read                # write to the mirror comes from the deploy key
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with: { path: plugins }
+      - uses: actions/checkout@v4
+        with:
+          repository: agentmail-to/agentmail-skills
+          ssh-key: ${{ secrets.MIRROR_DEPLOY_KEY }}
+          path: mirror
+      - name: Sync skills to mirror root
+        run: |
+          rsync -a --delete \
+            --exclude '.git' --exclude 'README.md' --exclude 'LICENSE' \
+            --exclude 'agents/' \
+            plugins/skills/ mirror/
+      - name: Recreate agentmail-sdk alias   # 3 external lockfiles pin this path
+        run: |
+          cp -R mirror/agentmail mirror/agentmail-sdk
+          sed -i 's/^name: agentmail$/name: agentmail-sdk/' mirror/agentmail-sdk/SKILL.md
+      - name: Guard pinned skillPaths
+        run: |
+          for s in agentmail agentmail-cli agentmail-mcp agentmail-toolkit \
+                   agentmail-sdk agent-email-patterns email-for-ai-agents; do
+            test -f "mirror/$s/SKILL.md" || { echo "missing $s/SKILL.md"; exit 1; }
+          done
+      - name: Commit and push if changed
+        working-directory: mirror
+        run: |
+          git config user.name  "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add -A
+          git diff --cached --quiet && { echo "no changes"; exit 0; }
+          git commit -m "sync from agentmail-plugins@${GITHUB_SHA}"
+          git push

From bfc99626b2cae3f1f4929f1de2fd507cd9e12842 Mon Sep 17 00:00:00 2001
From: Sanjith Sambath <sanjith.sambath07@gmail.com>
Date: Tue, 14 Jul 2026 15:54:44 -0700
Subject: [PATCH 2/2] Use MIRROR_TOKEN PAT instead of deploy key (org disables
 deploy keys)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/mirror.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 0e21fc7..3ab68dc 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -9,7 +9,7 @@ concurrency:
   group: mirror-skills          # serializes racing merges; no cancel-in-progress
 
 permissions:
-  contents: read                # write to the mirror comes from the deploy key
+  contents: read                # write to the mirror comes from MIRROR_TOKEN
 
 jobs:
   sync:
@@ -20,7 +20,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           repository: agentmail-to/agentmail-skills
-          ssh-key: ${{ secrets.MIRROR_DEPLOY_KEY }}
+          token: ${{ secrets.MIRROR_TOKEN }}    # fine-grained PAT, contents:write on agentmail-skills only (org disables deploy keys)
           path: mirror
       - name: Sync skills to mirror root
         run: |