Switch releases to npm trusted publishing; fix multi-word search

You had already made the repo public, so I verified the CLI end to end
against the live repo rather than only against the mock: unauthenticated
index fetch, a two-skill install with references and scripts, and the
installed script executable and running. It works.

That also means no NPM_TOKEN is needed. npm supports trusted publishing over
OIDC, so release.yml now relies on `id-token: write` and there is no secret
to store or rotate, with provenance generated automatically. The one
constraint is ordering: trusted publishing cannot be configured for a
package that does not exist yet, so the first publish is a local
`npm publish` and every release after that is just a tag. The workflow header
documents that sequence.

Verified before touching the workflow: the name is still free, the tarball is
four files and 20 kB, it contains no credential-shaped strings, and
installing it into a throwaway prefix produces a working binary — which is
what actually catches a bin or shebang problem, since `npm pack` will happily
build a tarball whose executable does nothing.

The live run also surfaced a real UX bug: `search "revenue at risk"` returned
nothing despite cx-revenue-at-risk existing, because it substring-matched the
raw query against a hyphenated slug. Search now normalises both sides and
requires every token, so the obvious thing to type works — quoted or not.

Also removes the README's private-repository caveat, which is no longer true.

149 skills, 213 tests, strict validation clean.

Author: chidiwilliams

.github/workflows/release.yml

@@ -5,9 +5,25 @@ name: release
 #   npm version patch          # bumps package.json and creates the tag
 #   git push --follow-tags
 #
-# Requires an NPM_TOKEN repository secret (npm → Access Tokens → Automation).
-# `id-token: write` lets npm attach a provenance attestation, which links the
-# published tarball to this workflow run and this commit.
+# This uses npm **trusted publishing** (OIDC), so there is no NPM_TOKEN secret to
+# create, store or rotate. `id-token: write` lets GitHub mint a short-lived token
+# that npm verifies against the trusted-publisher config on the package.
+#
+# One-time setup, in this order — trusted publishing cannot be configured for a
+# package that does not exist yet:
+#
+#   1. Publish the first version from your own machine:
+#        npm login && npm publish --access public
+#   2. On npmjs.com → Packages → rulebase-skills → Settings → Trusted publishing,
+#      add GitHub Actions with:
+#        organization/user  rulebase-co
+#        repository         rulebase-skills
+#        workflow filename  release.yml
+#   3. Every release after that is just a tag.
+#
+# Provenance attestations are generated automatically under trusted publishing —
+# no --provenance flag needed. Note that npm does not generate provenance for
+# private repositories, so this only produces one once the repo is public.
 
 on:
   push:
@@ -25,6 +41,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      # Required for trusted publishing. Without it, npm falls back to looking
+      # for a token and the publish fails.
       id-token: write
 
     steps:
@@ -35,6 +53,14 @@ jobs:
           node-version: 22
           registry-url: 'https://registry.npmjs.org'
 
+      # Trusted publishing needs npm >= 11.5.1, which is newer than the npm
+      # bundled with Node 22. Upgrading explicitly is cheaper than pinning a
+      # Node version and hoping.
+      - name: Use an npm that supports trusted publishing
+        run: |
+          npm install -g npm@latest
+          npm --version
+
       # The catalog has to be valid and the index current before anything ships:
       # the published CLI reads skills-index.json from the repo, so a stale index
       # is a broken release even though the tarball itself is fine.
@@ -61,23 +87,23 @@ jobs:
           fi
           echo "tag and package.json agree on $PKG"
 
-      - name: Pack
+      # A package whose executable was excluded by `files` installs cleanly and
+      # then does nothing, so assert the bin is actually in the tarball.
+      - name: Pack and check the tarball
         run: |
-          npm pack --dry-run
-          echo "---"
-          # The bin must be in the tarball or `npx rulebase-skills` resolves to nothing.
+          set -euo pipefail
           npm pack --json | node -e "
             const p = JSON.parse(require('fs').readFileSync(0, 'utf8'))[0];
             const files = p.files.map((f) => f.path);
-            if (!files.includes('bin/rulebase-skills.js')) {
-              console.error('::error::bin/rulebase-skills.js is not in the tarball');
-              process.exit(1);
+            for (const required of ['bin/rulebase-skills.js', 'package.json', 'README.md', 'LICENSE']) {
+              if (!files.includes(required)) {
+                console.error('::error::' + required + ' is missing from the tarball');
+                process.exit(1);
+              }
             }
-            console.error('tarball contains ' + files.length + ' file(s), bin present');
+            console.error('tarball ok: ' + files.length + ' files, ' + (p.size / 1024).toFixed(1) + ' kB');
           "
 
       - name: Publish
         if: startsWith(github.ref, 'refs/tags/v')
-        run: npm publish --access public --provenance
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish --access public

README.md

@@ -19,11 +19,6 @@ Vendor-neutral by design, with no per-helpdesk exporters. Land your conversation
 [one canonical shape](skills/data-and-integration/cx-conversation-schema) and every
 analysis here runs against it.
 
-> **While this repository is private**, the `npx rulebase-skills` commands below cannot
-> reach it — `raw.githubusercontent.com` returns 404 without a token. Use
-> `npx skills add rulebase-co/rulebase-skills`, which picks up your `gh auth token`.
-> Delete this note when the repository goes public.
-
 ## Install
 
 ```bash
@@ -61,8 +56,7 @@ so nothing here depends on us guessing right.
 <details>
 <summary>Other ways in</summary>
 
-The [Vercel `skills` CLI](https://github.com/vercel-labs/skills) also works, and is the
-one to use while this repository is private because it can authenticate:
+The [Vercel `skills` CLI](https://github.com/vercel-labs/skills) also works:
 
 ```bash
 npx skills add rulebase-co/rulebase-skills

bin/rulebase-skills.js

@@ -169,14 +169,25 @@ async function cmdList() {
   out(`${skills.length} of ${index.count} skills. \`npx rulebase-skills info <slug>\` for detail.`);
 }
 
+/** Lowercase, and treat every non-alphanumeric run as a space, so a hyphenated
+ *  slug and a spaced query meet in the middle. */
+const normalise = (s) => (s || '').toLowerCase().replace(/[^a-z0-9]+/g, ' ').trim();
+
 async function cmdSearch() {
-  const query = positionals()[0];
-  if (!query) die('usage: npx rulebase-skills search <query>');
+  // Everything after the command, so `search revenue at risk` works unquoted.
+  const words = positionals();
+  if (words.length === 0) die('usage: npx rulebase-skills search <query>');
+  const query = words.join(' ');
   const index = await loadIndex();
-  const q = query.toLowerCase();
-  const hits = index.skills.filter(
-    (s) => s.slug.toLowerCase().includes(q) || (s.description || '').toLowerCase().includes(q),
-  );
+
+  // All tokens must appear somewhere. Substring-matching the raw query fails on
+  // "revenue at risk" vs the slug cx-revenue-at-risk, which is the obvious thing
+  // for someone to type.
+  const tokens = normalise(query).split(' ').filter(Boolean);
+  const hits = index.skills.filter((s) => {
+    const haystack = `${normalise(s.slug)} ${normalise(s.category)} ${normalise(s.description)}`;
+    return tokens.every((t) => haystack.includes(t));
+  });
   if (hits.length === 0) {
     out(`no match for "${query}". \`npx rulebase-skills list\` shows all ${index.count}.`);
     return;

tests/cli.test.mjs

@@ -120,6 +120,30 @@ test('search matches slug and description', async () => {
   });
 });
 
+test('a spaced query matches a hyphenated slug', async () => {
+  // The obvious thing to type for cx-revenue-at-risk. Substring-matching the raw
+  // query against the slug fails here, which is why search tokenises.
+  await withMockApi(planner(), async ({ base }) => {
+    const quoted = await runScript(CLI, ['search', 'revenue at risk'], env(base));
+    assert.match(quoted.stdout, /cx-revenue-at-risk/);
+
+    // Unquoted, too — the words arrive as separate argv entries.
+    const unquoted = await runScript(CLI, ['search', 'revenue', 'at', 'risk'], env(base));
+    assert.match(unquoted.stdout, /cx-revenue-at-risk/);
+  });
+});
+
+test('search requires every token, not just one', async () => {
+  await withMockApi(planner(), async ({ base }) => {
+    const both = await runScript(CLI, ['search', 'complaint', 'deadline'], env(base));
+    assert.match(both.stdout, /cx-complaints-sla/);
+    // "complaint" alone matches several; adding "deadline" must narrow it.
+    const one = await runScript(CLI, ['search', 'complaint'], env(base));
+    const countOf = (out) => Number((out.match(/(\d+) match/) || [0, 0])[1]);
+    assert.ok(countOf(one.stdout) > countOf(both.stdout), 'a second token should narrow the result');
+  });
+});
+
 test('info prints the frontmatter and the install line', async () => {
   await withMockApi(planner(), async ({ base }) => {
     const res = await runScript(CLI, ['info', 'cx-complaints-sla'], env(base));