Release v0.3.0: CI, ensure-yang.sh --help and GITHUB_TOKEN support, changelog

Author: antoinekh

.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "nokia-sr-skills",
       "description": "Learn how to inspect and operate Nokia SR network OSes - SR OS (SROS) and SR Linux (SRL).",
-      "version": "0.2.1",
+      "version": "0.3.0",
       "source": "./",
       "author": {
         "name": "Antoine Keranflec'h",

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "nokia-sr-skills",
   "description": "Learn how to inspect and operate Nokia SR network OSes - SR OS (SROS) and SR Linux (SRL): tell the two apart, fetch YANG models on demand, read the software version, understand config formats, and apply NETCONF / MD-CLI / gNMI behaviors.",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "author": {
     "name": "Antoine Keranflec'h",
     "email": "antoine.keranflech@gmail.com"

.github/workflows/ci.yml

@@ -0,0 +1,16 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: ShellCheck
+        run: shellcheck skills/nokia-sr/scripts/ensure-yang.sh tests/*.sh
+      - name: Run tests
+        run: bash tests/test_ensure_yang.sh

CHANGELOG.md

@@ -0,0 +1,24 @@
+# Changelog
+
+## v0.3.0 - 2026-06-09
+
+### Added
+
+- CI workflow (GitHub Actions): ShellCheck and the offline test suite run on every push and pull request.
+- `ensure-yang.sh`: `-h`/`--help` handler backed by a single `usage()` function, also printed on the missing-argument error path.
+- `ensure-yang.sh`: `GITHUB_TOKEN` / `GH_TOKEN` are sent as an Authorization header when set, lifting the unauthenticated api.github.com rate limit (60 requests/hour per IP); transient download failures are retried (`curl --retry 3`).
+- This changelog, and a release checklist in the README (the plugin version lives in both `plugin.json` and `marketplace.json`).
+
+### Fixed
+
+- Test suite: failures inside subshell tests were not counted, so the suite could print `FAIL` lines yet still exit 0 ("all tests passed"). Failures are now tracked in a file so they propagate from subshells.
+
+## v0.2.1 - 2026-06-04
+
+### Fixed
+
+- Quote the SKILL.md `description` to fix invalid YAML frontmatter.
+
+## v0.2.0 - 2026-06-04
+
+- Initial release: `nokia-sr` skill - NOS detection (SR OS vs SR Linux), on-demand YANG models via `ensure-yang.sh`, per-NOS version detection, config formats, NETCONF / MD-CLI / gNMI operations, and srpls language server pointers.

README.md

@@ -23,6 +23,7 @@ A Claude Code skill plugin that teaches Claude how to inspect and operate Nokia'
 | Environment variable | Default | Purpose |
 |----------------------|---------|---------|
 | `NOKIA_SR_YANG_DIR` | `${XDG_CACHE_HOME:-~/.cache}/nokia-sr/yang` | Override the directory where YANG releases are cached and looked up. |
+| `GITHUB_TOKEN` / `GH_TOKEN` | unset | Sent as an Authorization header on GitHub API requests; lifts the unauthenticated rate limit (60 requests/hour per IP). |
 
 ## Layout
 
@@ -42,6 +43,16 @@ skills/nokia-sr/
 bash tests/test_ensure_yang.sh
 ```
 
+CI runs ShellCheck and this suite on every push and pull request.
+
+## Releasing
+
+The plugin version is duplicated in two files that must stay in sync:
+
+1. Bump `version` in `.claude-plugin/plugin.json` **and** `.claude-plugin/marketplace.json`.
+2. Move the `## Unreleased` entries of `CHANGELOG.md` into a new `## vX.Y.Z - <date>` block.
+3. Commit and tag `vX.Y.Z`.
+
 ## Attribution
 
 YANG models are downloaded from Nokia's public [7x50_YangModels](https://github.com/nokia/7x50_YangModels) and [srlinux-yang-models](https://github.com/nokia/srlinux-yang-models) repositories and are subject to Nokia's license. This plugin does not redistribute them.

skills/nokia-sr/scripts/ensure-yang.sh

@@ -1,21 +1,50 @@
 #!/bin/bash
 # ensure-yang.sh - make Nokia SR YANG models available locally.
-#
-# Usage: ensure-yang.sh <nos> <version>
-#   nos      sros | srlinux
-#   version  sros:    MAJOR.MINOR.Rn     e.g. 25.10.R4   (a revision is required)
-#            srlinux: [v]MAJOR.MINOR.PATCH  e.g. 25.10.3 or v25.10.3
-#            either:  latest             resolve the newest release from GitHub
+# Run with --help (or see usage() below) for arguments, environment, and sources.
 #
 # Downloads the matching release as a GitHub tarball - the same source the
 # srpls language server / vscode-sr extension use - and caches it locally.
 # Prints the local YANG release directory on stdout (grep it recursively).
-#
-#   sros    -> github.com/nokia/7x50_YangModels     tag sros_<mm>.r<n> (branch sros_<mm> fallback)
-#   srlinux -> github.com/nokia/srlinux-yang-models  tag v<maj>.<min>.<patch>
 
 GITHUB_API="https://api.github.com/repos"
-CURL_OPTS=(-fsSL -H "Accept: application/vnd.github+json" -A "nokia-sr-skill")
+CURL_OPTS=(-fsSL --retry 3 -H "Accept: application/vnd.github+json" -A "nokia-sr-skill")
+# Unauthenticated api.github.com allows only 60 requests/hour per IP; a token lifts that.
+if [[ -n ${GITHUB_TOKEN:-${GH_TOKEN:-}} ]]; then
+  CURL_OPTS+=(-H "Authorization: Bearer ${GITHUB_TOKEN:-$GH_TOKEN}")
+fi
+
+usage() {
+  cat << 'EOF'
+Usage: ensure-yang.sh <nos> <version>
+
+Make Nokia SR YANG models available locally: check the cache and download the
+matching GitHub release tarball only if missing. Prints the local YANG release
+directory on stdout (grep it recursively).
+
+Arguments:
+  nos      sros | srlinux
+  version  sros:    MAJOR.MINOR.Rn        e.g. 25.10.R4 (a revision is required)
+           srlinux: [v]MAJOR.MINOR.PATCH  e.g. 25.10.3 or v25.10.3
+           either:  latest                resolve the newest release from GitHub
+
+Options:
+  -h, --help  Show this help and exit.
+
+Environment:
+  NOKIA_SR_YANG_DIR       Cache directory (default: ${XDG_CACHE_HOME:-~/.cache}/nokia-sr/yang).
+  GITHUB_TOKEN / GH_TOKEN GitHub token sent as an Authorization header; lifts the
+                          unauthenticated api.github.com rate limit (60 requests/hour per IP).
+
+Sources:
+  sros    -> github.com/nokia/7x50_YangModels      tag sros_<mm>.r<n> (branch sros_<mm> fallback)
+  srlinux -> github.com/nokia/srlinux-yang-models  tag v<maj>.<min>.<patch>
+
+Examples:
+  ensure-yang.sh sros 25.10.R4
+  ensure-yang.sh srlinux 25.10.3
+  ensure-yang.sh sros latest
+EOF
+}
 
 # set_repo <nos> -> sets REPO. Returns 2 for an unknown nos.
 set_repo() {
@@ -154,9 +183,12 @@ fetch_yang() {
 
 main() {
   set -euo pipefail
+  case ${1:-} in
+    -h|--help) usage; exit 0 ;;
+  esac
   local nos=${1:-} version=${2:-}
   if [[ -z $nos || -z $version ]]; then
-    echo "usage: ensure-yang.sh <nos> <version>   e.g. sros 25.10.R4  |  srlinux 25.10.3  |  sros latest" >&2
+    usage >&2
     exit 2
   fi
   if ! set_repo "$nos"; then
@@ -190,7 +222,8 @@ main() {
     exit 0
   fi
 
-  local manual="curl -fsSL $GITHUB_API/$REPO/tarball/${REFS[0]} -o /tmp/yang.tar.gz && mkdir -p $(version_dir "$nos") && tar -xz --strip-components=1 -f /tmp/yang.tar.gz -C $(version_dir "$nos")"
+  local manual
+  manual="curl -fsSL $GITHUB_API/$REPO/tarball/${REFS[0]} -o /tmp/yang.tar.gz && mkdir -p $(version_dir "$nos") && tar -xz --strip-components=1 -f /tmp/yang.tar.gz -C $(version_dir "$nos")"
   if ! command -v curl > /dev/null 2>&1 || ! command -v tar > /dev/null 2>&1; then
     echo "error: need both 'curl' and 'tar'. Install them, or fetch manually:" >&2
     echo "  $manual" >&2

tests/test_ensure_yang.sh

@@ -1,14 +1,22 @@
 #!/bin/bash
 # Plain-bash test suite for ensure-yang.sh. Sources the script for unit tests and
 # execs it (with stubbed curl + tar on PATH) for integration tests. No network, no bats.
+#
+# shellcheck disable=SC2015,SC2030,SC2031
+# SC2015: '&& pass || fail' is safe here - pass() never fails.
+# SC2030/SC2031: env changes being local to each ( ) subshell is the point - it is
+# how tests stay isolated from each other.
 set -uo pipefail
 
 TEST_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 SUT="$TEST_DIR/../skills/nokia-sr/scripts/ensure-yang.sh"
-FAILS=0
+# Failures are recorded in a file, not a counter: most tests run in ( ) subshells,
+# where a counter increment would be lost and the suite would wrongly exit 0.
+FAIL_FLAG=$(mktemp)
+trap 'rm -f "$FAIL_FLAG"' EXIT
 
 pass() { printf 'ok   - %s\n' "$1"; }
-fail() { printf 'FAIL - %s (expected [%s] got [%s])\n' "$1" "$3" "$2"; FAILS=$((FAILS + 1)); }
+fail() { printf 'FAIL - %s (expected [%s] got [%s])\n' "$1" "$3" "$2"; echo "$1" >> "$FAIL_FLAG"; }
 assert_eq() { [[ $2 == "$3" ]] && pass "$1" || fail "$1" "$2" "$3"; }
 
 # Fresh sandbox HOME + stubbed curl/tar on PATH for one integration run.
@@ -20,10 +28,11 @@ make_sandbox() {
   chmod +x "$SANDBOX/bin/curl" "$SANDBOX/bin/tar"
   export CURL_STUB_LOG="$SANDBOX/curl.log"
   : > "$CURL_STUB_LOG"
-  unset CURL_STUB_FAIL_REFS TAR_STUB_NOS
+  unset CURL_STUB_FAIL_REFS TAR_STUB_NOS GITHUB_TOKEN GH_TOKEN
 }
 
 # --- unit: source the script, call pure functions directly ---
+unset GITHUB_TOKEN GH_TOKEN  # keep CURL_OPTS deterministic regardless of caller env
 # shellcheck disable=SC1090
 source "$SUT"
 
@@ -191,11 +200,41 @@ set_repo frobnos; assert_eq "set_repo unknown nos returns 2" "$?" "2"
 ( bash "$SUT" frobnos 25.10.R4 > /dev/null 2>&1; rc=$?
   assert_eq "e2e: exit 2 on unknown nos" "$rc" "2" )
 
-# missing args -> exit 2
+# missing args -> exit 2, usage on stderr
 ( bash "$SUT" sros > /dev/null 2>&1; rc=$?
   assert_eq "e2e: exit 2 on missing version" "$rc" "2" )
-( bash "$SUT" > /dev/null 2>&1; rc=$?
-  assert_eq "e2e: exit 2 on no args" "$rc" "2" )
+( err=$(bash "$SUT" 2>&1 >/dev/null); rc=$?
+  assert_eq "e2e: exit 2 on no args" "$rc" "2"
+  case "$err" in
+    *"Usage: ensure-yang.sh"*) pass "e2e: no args prints usage on stderr" ;;
+    *) fail "e2e: no args prints usage on stderr" "$err" "contains 'Usage: ensure-yang.sh'" ;;
+  esac )
+
+# --help / -h -> usage on stdout, exit 0
+( out=$(bash "$SUT" --help); rc=$?
+  assert_eq "e2e: --help exits 0" "$rc" "0"
+  case "$out" in
+    *"Usage: ensure-yang.sh"*) pass "e2e: --help prints usage" ;;
+    *) fail "e2e: --help prints usage" "$out" "contains 'Usage: ensure-yang.sh'" ;;
+  esac )
+( bash "$SUT" -h > /dev/null; rc=$?
+  assert_eq "e2e: -h exits 0" "$rc" "0" )
+
+# GITHUB_TOKEN -> Authorization header on every GitHub request
+( make_sandbox; export HOME="$SANDBOX" PATH="$SANDBOX/bin:$PATH" GITHUB_TOKEN="t0ken"
+  unset NOKIA_SR_YANG_DIR XDG_CACHE_HOME
+  bash "$SUT" sros 25.10.R4 > /dev/null
+  grep -q -- "Authorization: Bearer t0ken" "$CURL_STUB_LOG" \
+    && pass "e2e: token sent as Authorization header" \
+    || fail "e2e: token sent as Authorization header" "missing" "present" )
+
+# no token -> no Authorization header
+( make_sandbox; export HOME="$SANDBOX" PATH="$SANDBOX/bin:$PATH"
+  unset NOKIA_SR_YANG_DIR XDG_CACHE_HOME
+  bash "$SUT" sros 25.10.R4 > /dev/null
+  grep -q -- "Authorization:" "$CURL_STUB_LOG" \
+    && fail "e2e: no Authorization header without token" "present" "absent" \
+    || pass "e2e: no Authorization header without token" )
 
 # relative cache dir is rejected (rm -rf safety guard)
 ( export NOKIA_SR_YANG_DIR="relative/cache"
@@ -223,6 +262,7 @@ set_repo frobnos; assert_eq "set_repo unknown nos returns 2" "$?" "2"
   esac )
 
 echo
+FAILS=$(wc -l < "$FAIL_FLAG")
 if (( FAILS > 0 )); then
   printf '%d test(s) failed\n' "$FAILS"; exit 1
 fi