From c5133f3fba015b0d60365aa7c2388975aa0f3dba Mon Sep 17 00:00:00 2001
From: Christoph Blecker <admin@toph.ca>
Date: Fri, 3 Jul 2026 11:22:36 -0700
Subject: [PATCH] ci(skillsaw): migrate to official GitHub Action with PR
 review comments

Replace uvx-based skillsaw invocation with the official stbenjam/skillsaw
composite action (SHA-pinned at v0.15.0) for version pinning and dependabot
support. Add a companion skillsaw-review workflow that posts inline PR
comments on lint violations using the two-workflow security pattern.

Assisted-by: Claude:claude-opus-4-6
---
 .github/workflows/lint.yml            |  7 +++----
 .github/workflows/skillsaw-review.yml | 21 +++++++++++++++++++++
 .skillsaw.yaml                        |  2 +-
 3 files changed, 25 insertions(+), 5 deletions(-)
 create mode 100644 .github/workflows/skillsaw-review.yml

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index d586c3d..9bfdb32 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -18,11 +18,10 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Set up uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 #v8.2.0
-
       - name: Run skillsaw
-        run: uvx skillsaw --strict
+        uses: stbenjam/skillsaw@a1d7340ef19cd0949f884a5381155843589dbad8 #v0.15.0
+        with:
+          strict: true
 
   markdown-lint:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/skillsaw-review.yml b/.github/workflows/skillsaw-review.yml
new file mode 100644
index 0000000..266f997
--- /dev/null
+++ b/.github/workflows/skillsaw-review.yml
@@ -0,0 +1,21 @@
+name: Skillsaw Review
+
+on:
+  workflow_run:
+    workflows: ["Lint Plugins"]
+    types:
+      - completed
+
+jobs:
+  review:
+    if: github.event.workflow_run.event == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Post PR review comments
+        uses: stbenjam/skillsaw/review@a1d7340ef19cd0949f884a5381155843589dbad8 #v0.15.0
diff --git a/.skillsaw.yaml b/.skillsaw.yaml
index 27389f7..5d4add0 100644
--- a/.skillsaw.yaml
+++ b/.skillsaw.yaml
@@ -1,4 +1,4 @@
-version: "0.11.1"
+version: "0.15.0"
 
 exclude:
   - "gws/skills/**"