The skill packages under skills/ are vendored from jfrog/jfrog-skills and committed to main.
| Repository | https://github.com/jfrog/jfrog-skills |
| Pinned release | see pin in .github/scripts/sync-skills-vendor.json |
Included directories: jfrog/, jfrog-ai-catalog-skills/, jfrog-package-curation/, jfrog-reference-architecture/, jfrog-setup-package-managers/ (as of the pinned release).
When the upstream repo publishes a new release, refresh the vendored tree via a PR that:
- Bumps
pinin.github/scripts/sync-skills-vendor.jsonto the new tag. - Re-syncs and commits the refreshed
skills/tree. - Bumps
versionin.claude-plugin/plugin.jsonso users actually receive the update (Claude Code skips installs whose resolved version hasn't changed).
To regenerate the tree locally before opening the PR:
node .github/scripts/sync-skills.mjsThe script reads its sibling sync-skills-vendor.json, downloads the pinned upstream tarball from codeload.github.com, and replaces the directories listed in paths (today: skills/).
The modules/ bundle is vendored from jfrog-agent-hooks (GHE) and committed to main.
| Repository | github.jfrog.info/JFROG/jfrog-agent-hooks |
| Pinned release | see pin in .github/scripts/sync-modules-vendor.json |
The bundle contains harness runners (core/, *-session-start.mjs), the package-resolution/ capability, and assets/agents-default-conf.json. Automated sync PRs (chore/sync-modules-v*) update this tree on each jfrog-agent-hooks release.
Harness-specific scripts (for example scripts/claude-align-mcp-json.mjs and claude-mcp-json-discover.mjs) live outside modules/ so sync does not wipe them. They call shared orchestration in synced modules/core/ (for example rewrite-mcp-json.mjs).
JFROG_AGENT_HOOKS_PATH=/path/to/jfrog-agent-hooks node .github/scripts/sync-modules.mjsThe script reads paths from sync-modules-vendor.json (today: ["modules"]) and replaces the whole modules/ tree.