CI and pre-commit

skillhash verify exits with code 1 when an installed skill differs from skills.lock, when the manifest and lock disagree, or when a locked skill grades below min_grade. That is all CI needs.

GitHub Actions

name: skills
on: [pull_request, push]
jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v6
      - run: uvx skillhash verify
      # Optional: block new high-severity findings anywhere in the repo
      - run: uvx skillhash scan .claude/skills --fail-on high

GitLab CI

skills:
  image: ghcr.io/astral-sh/uv:python3.12-bookworm-slim
  script:
    - uvx skillhash verify

pre-commit

# .pre-commit-config.yaml
repos:
  - repo: local
    hooks:
      - id: skillhash-verify
        name: skillhash verify
        entry: uvx skillhash verify
        language: system
        pass_filenames: false

Private registry in CI

Create a token under Dashboard, Tokens and store it as the SKILLHASH_TOKEN secret. The CLI reads it automatically for registry: sources.