feat: serve agent skills from .well-known/agent-skills at build time by Rodriguespn · Pull Request #45641 · supabase/supabase

Rodriguespn · 2026-05-06T14:58:23Z

Summary

This PR makes fetchAgentSkills.mjs a spec-compliant client of the agent-skills .well-known URI spec, and updates the script to match the current release structure in supabase/agent-skills.

1. Spec-compliant URL resolution and digest verification

fetchAgentSkills.mjs acts as a client consuming the .well-known discovery index. The agent-skills .well-known spec is explicit on two points:

URL resolution — skill artifact URLs in index.json must be resolved per RFC 3986 §5.2.2 using the index URL as the base URI:

"The url field specifies where to fetch the skill artifact. URLs are resolved per RFC 3986 Section 5 using the index URL as the base URI."

This means skill.url can be relative (supabase.tar.gz), path-absolute (/.well-known/agent-skills/supabase.tar.gz), or fully absolute (e.g. a CDN URL like https://cdn.example.com/supabase.tar.gz). The previous implementation extracted a filename with .split('/').pop() which happened to work for bare relative URLs but was not doing RFC 3986 resolution.

Digest verification — clients must verify artifact integrity before use:

"Clients must verify downloaded content against the digest in the index. A mismatch indicates the content is corrupted or tampered with — clients must not use unverified content."

The updated script uses new URL(skill.url, githubReleaseIndexUrl) for compliant resolution, verifies each artifact's SHA-256 digest from the in-memory buffer before any disk writes, and only writes to public/.well-known/agent-skills/ once all digests pass.

Acknowledged overhead: since Supabase owns both the publisher (scripts/build-release.ts in supabase/agent-skills) and this consumer, the practical risk of non-compliant URL handling is currently low — the publisher always emits bare relative filenames. However, being spec-compliant here gives us full flexibility to change how skills are packaged or hosted in supabase/agent-skills in the future (e.g. moving artifacts to a CDN) without needing to update this script.

2. Semver release tags

#44878 referenced supabase/agent-skills#66 (date+SHA tags). supabase/agent-skills#77 has since merged, moving releases to semver tags managed by Release Please. /releases/latest works for both formats — no code change needed, just a rebase.

vercel · 2026-05-06T14:58:29Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
zone-www-dot-com	Ready	Preview, Comment, Open in v0	May 13, 2026 10:45pm

7 Skipped Deployments

Project	Deployment	Updated (UTC)
studio	Ignored	May 13, 2026 10:45pm
design-system	Skipped	May 13, 2026 10:45pm
docs	Skipped	May 13, 2026 10:45pm
learn	Skipped	May 13, 2026 10:45pm
studio-self-hosted	Skipped	May 13, 2026 10:45pm
studio-staging	Skipped	May 13, 2026 10:45pm
ui-library	Skipped	May 13, 2026 10:45pm

supabase · 2026-05-06T14:58:43Z

This pull request has been ignored for the connected project xguihxuzqibwxjnimxev because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

coderabbitai · 2026-05-06T14:59:12Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

develop

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 4d646a18-e3f1-40ab-a4c0-f7a9b1ae8fa9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

📝 Walkthrough

Walkthrough

The PR adds an automated agent skills fetching step to the build process. A new Node.js script downloads the latest release assets from the supabase/agent-skills GitHub repository, stores them in public/.well-known/agent-skills, and verifies file digests when an index is available. This script is integrated into the build workflow via package.json.

Changes

Agent Skills Build Integration

Layer / File(s)	Summary
Script Implementation `apps/www/scripts/fetchAgentSkills.mjs`	New ESM script fetches latest GitHub release, downloads all assets to `public/.well-known/agent-skills`, and validates SHA-256 digests against `index.json` when present. Includes HTTP helpers, file writing, digest computation, and error handling.
Build Process Integration `apps/www/package.json`	`content:build` script updated to execute `scripts/fetchAgentSkills.mjs` alongside existing `generateStaticContent.mjs` and `generateMdContent.mjs` steps.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 A script so clever, quick to run,
Fetches skills when build's begun,
From GitHub's vault, the assets fly,
Digests checked, no need to sigh!
Agent skills now at hand, the deed is done! ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: serving agent skills from a .well-known endpoint at build time, which matches the core functionality introduced in the PR.
Description check	✅ Passed	The description provides comprehensive context including motivation (supersedes `#44878`), clear explanation of what the PR does, specific artifacts output, digest verification details, comparison with prior PR, and implementation notes. However, it does not follow the required template structure with sections like 'What kind of change', 'Current behavior', and 'New behavior'.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/well-known-agent-skills

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

Generate code and open pull requests
Plan features and break down work
Investigate incidents and troubleshoot customer tickets together
Automate recurring tasks and respond to alerts with triggers
Summarize progress and report instantly

Built for teams:

Shared memory across your entire org—no repeating context
Per-thread sandboxes to safely plan and execute work
Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Fetches the latest supabase/agent-skills semver release at build time and writes index.json + skill tarballs to public/.well-known/agent-skills/. Adds digest verification: each skill artifact is verified against the sha256 digest in index.json per the agent-skills .well-known URI spec v0.2.0. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

- Resolve each skill artifact URL against the index URL per RFC 3986 §5.2.2 so relative, path-absolute, and fully-absolute (e.g. CDN) URLs all work - Verify each artifact digest from the in-memory buffer before writing to disk - Buffer all downloads first; only write to public/.well-known/agent-skills/ after all digests pass Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

…ll hosting Following Greg's review: the RFC 3986 URL resolution complexity isn't needed since we control both ends and skill.url is always relative. Going further: tarballs no longer downloaded or hosted. The index.json is rewritten with absolute GitHub Release URLs so clients fetch tarballs directly from GitHub. The digest is the trust anchor (same as SRI on the web) — the URL is just a location hint. Result: one fetch (index.json), one rewrite, one write to disk. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

…45641) ## Summary This PR makes `fetchAgentSkills.mjs` a spec-compliant client of the [agent-skills `.well-known` URI spec](agentskills/agentskills#254), and updates the script to match the current release structure in [`supabase/agent-skills`](https://github.com/supabase/agent-skills). --- ## 1. Spec-compliant URL resolution and digest verification `fetchAgentSkills.mjs` acts as a client consuming the `.well-known` discovery index. The [agent-skills `.well-known` spec](agentskills/agentskills#254) is explicit on two points: **URL resolution** — skill artifact URLs in `index.json` must be resolved per [RFC 3986 §5.2.2](https://datatracker.ietf.org/doc/html/rfc3986#section-5.2.2) using the index URL as the base URI: > "The `url` field specifies where to fetch the skill artifact. URLs are resolved per RFC 3986 Section 5 using the index URL as the base URI." This means `skill.url` can be relative (`supabase.tar.gz`), path-absolute (`/.well-known/agent-skills/supabase.tar.gz`), or fully absolute (e.g. a CDN URL like `https://cdn.example.com/supabase.tar.gz`). The previous implementation extracted a filename with `.split('/').pop()` which happened to work for bare relative URLs but was not doing RFC 3986 resolution. **Digest verification** — clients must verify artifact integrity before use: > "Clients **must** verify downloaded content against the `digest` in the index. A mismatch indicates the content is corrupted or tampered with — clients **must not** use unverified content." The updated script uses `new URL(skill.url, githubReleaseIndexUrl)` for compliant resolution, verifies each artifact's SHA-256 digest from the in-memory buffer before any disk writes, and only writes to `public/.well-known/agent-skills/` once all digests pass. **Acknowledged overhead**: since Supabase owns both the publisher ([`scripts/build-release.ts`](https://github.com/supabase/agent-skills/blob/main/scripts/build-release.ts) in `supabase/agent-skills`) and this consumer, the practical risk of non-compliant URL handling is currently low — the publisher always emits bare relative filenames. However, being spec-compliant here gives us full flexibility to change how skills are packaged or hosted in `supabase/agent-skills` in the future (e.g. moving artifacts to a CDN) without needing to update this script. --- ## 2. Semver release tags #44878 referenced `supabase/agent-skills#66` (date+SHA tags). [supabase/agent-skills#77](supabase/agent-skills#77) has since merged, moving releases to semver tags managed by Release Please. `/releases/latest` works for both formats — no code change needed, just a rebase. --------- Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Rodriguespn requested a review from a team as a code owner May 6, 2026 14:58

Rodriguespn mentioned this pull request May 6, 2026

feat: build index.json for .well-known/agent-skills in release pipeline supabase/agent-skills#77

Merged

Rodriguespn marked this pull request as draft May 6, 2026 15:01

Rodriguespn changed the base branch from master to feat/agent-skill-discovery May 12, 2026 08:22

Rodriguespn force-pushed the feat/well-known-agent-skills branch from 7de1588 to 0136b0f Compare May 12, 2026 10:15

gregnr reviewed May 12, 2026

View reviewed changes

Comment thread apps/www/scripts/fetchAgentSkills.mjs Outdated

This was referenced May 13, 2026

feat: add optional skill versioning to .well-known spec agentskills/agentskills#380

Open

Add spec for .well-known URI agentskills/agentskills#254

Open

Rodriguespn marked this pull request as ready for review May 13, 2026 14:27

gregnr reviewed May 13, 2026

View reviewed changes

Comment thread apps/www/scripts/fetchAgentSkills.mjs Outdated

Rodriguespn requested a review from gregnr May 14, 2026 15:52

Rodriguespn merged commit 3845043 into feat/agent-skill-discovery May 15, 2026
21 checks passed

Rodriguespn deleted the feat/well-known-agent-skills branch May 15, 2026 21:41

coderabbitai Bot mentioned this pull request May 19, 2026

feat: advertise and serve agent skills from .well-known #44878

Merged

This was referenced May 30, 2026

Multigres blog to be posted on Monday #46518

Merged

chore(studio): marketplace styling #46574

Merged

Added new Series F fundraising announcement blog post #46641

Merged

coderabbitai Bot mentioned this pull request Jun 8, 2026

feat(www): Partner Catalog update #46757

Merged

Navigation Menu

Uh oh!

Uh oh!

feat: serve agent skills from .well-known/agent-skills at build time - #45641

feat: serve agent skills from .well-known/agent-skills at build time#45641
Rodriguespn merged 3 commits into
feat/agent-skill-discoveryfrom
feat/well-known-agent-skills

Rodriguespn commented May 6, 2026 •

edited

Loading

Uh oh!

vercel Bot commented May 6, 2026 •

edited

Loading

Uh oh!

supabase Bot commented May 6, 2026

Uh oh!

coderabbitai Bot commented May 6, 2026 •

edited

Loading

Review skipped

Walkthrough

Changes

Estimated code review effort

Poem

❌ Failed checks (1 warning)

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

Rodriguespn commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

1. Spec-compliant URL resolution and digest verification

2. Semver release tags

Uh oh!

vercel Bot commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

supabase Bot commented May 6, 2026

Uh oh!

coderabbitai Bot commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Walkthrough

Changes

Estimated code review effort

Poem

❌ Failed checks (1 warning)

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Rodriguespn commented May 6, 2026 •

edited

Loading

vercel Bot commented May 6, 2026 •

edited

Loading

coderabbitai Bot commented May 6, 2026 •

edited

Loading