• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

stacklok / toolhive / 22226885244
63%

Build:
DEFAULT BRANCH: main
Ran 20 Feb 2026 02:06PM UTC
Jobs 1
Files 540
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

20 Feb 2026 01:57PM UTC coverage: 62.781% (+0.02%) from 62.758%
22226885244

push

github

web-flow
Add OCI pull-based install flow for skills (#3898)

* Add OCI pull-based install flow for skills (#3650)

When the Install() Name field contains an OCI reference (detected by
the presence of '/', ':', or '@'), the service pulls the artifact from
the remote registry, extracts metadata and layer data, then feeds it
through the existing extraction pipeline.

The two-step detection uses a structural pre-check
(strings.ContainsAny) followed by go-containerregistry's
ParseReference to distinguish OCI references from plain skill names.
The character sets are provably disjoint since skill names only allow
lowercase alphanumeric and hyphens.

Security hardening:
- 5-minute context timeout on registry pulls
- Name mismatch between artifact config and OCI reference repository
  is a hard error (supply chain defense per Agent Skills spec)
- Compressed layer size limit (50MB) before loading into memory
- Layer media type validation (must be tar+gzip)
- ValidateSkillName on the config-extracted name
- All existing extraction protections apply (decompression bomb limit,
  path traversal, symlink rejection, permission sanitization)

Closes #3650

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Refine OCI install handling

Add OCI ref helper, clarify optional version, and document single-layer assumptions. Improve pull error status and cover oversized layers in tests.

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

116 of 148 new or added lines in 1 file covered. (78.38%)

11 existing lines in 5 files now uncovered.

46293 of 73737 relevant lines covered (62.78%)

76.2 hits per line

New Missed Lines in Diff

Lines Coverage ∆ File
32
86.39
-3.86% pkg/skills/skillsvc/skillsvc.go

Uncovered Existing Lines

Lines Coverage ∆ File
2
79.79
-0.52% pkg/transport/proxy/httpsse/http_proxy.go
2
57.89
-3.51% pkg/transport/session/sse_session.go
2
82.83
-0.26% pkg/vmcp/composer/workflow_engine.go
2
71.43
-1.68% pkg/vmcp/k8s/manager.go
3
71.85
-1.11% pkg/ignore/processor.go
Jobs
ID Job ID Ran Files Coverage
1 22226885244.1 20 Feb 2026 02:06PM UTC 540
62.78
GitHub Action Run
Source Files on build 22226885244
  • Tree
  • List 540
  • Changed 7
  • Source Changed 1
  • Coverage Changed 7
Coverage ∆ File Lines Relevant Covered Missed Hits/Line
  • Back to Repo
  • Github Actions Build #22226885244
  • 1dcec0a7 on github
  • Prev Build on main (#22224589896)
  • Next Build on main (#22227981405)
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc