skillshare v0.25.12 Release Notes

TL;DR

1. Git tokens no longer show up in ps. A token from GITHUB_TOKEN or another token variable now reaches git through a credential helper, never through process arguments.
2. update --all leaves unchanged skills alone. Skills already at the upstream commit are counted as up to date instead of being reinstalled on every run.
3. update reports a repository it cannot fetch, and updates skills whose symlinked files changed upstream.
4. An open dashboard keeps working after upgrade.

Fixed: git tokens visible in ps

A token from GITHUB_TOKEN, GITLAB_TOKEN, BITBUCKET_TOKEN, AZURE_DEVOPS_TOKEN, GITEA_TOKEN, CNB_TOKEN or SKILLSHARE_GIT_TOKEN was written into the clone URL that git hands to its HTTPS helper. Any user on the machine could read it with ps while a clone or fetch ran.

• git now gets the token from a credential helper scoped to the host. The token stays in the git process's environment and never appears in an argument list.
• While a token applies to a host, git no longer asks your own credential helper or keychain for that host, and stores nothing there.

Thanks to @masonc15 for reporting it (#565).

Fixed: update --all reinstalls every skill

Grouped updates reinstalled every skill on every run and reported each one as updated. The up-to-date check read per-skill metadata files that the move to .metadata.json had removed, so it never matched.

skillshare update --all          # unchanged skills are counted as up to date
skillshare update --all --force  # reinstall every skill

• A skill already at the upstream commit, or whose folder did not change, is skipped and counted as up to date: in the summary, as up_to_date in --json, and in the operations log.
• This applies to --all, --group, and several skills named with -p. A single skill, and skills named in global mode, are still always reinstalled.
• --force reinstalls every skill anyway.

Thanks to @masonc15 for reporting and fixing it (#564, #569).

Fixed: a repository that cannot be fetched goes unreported

When update --all or --group could not clone a repository, its skills were counted as skipped with no explanation, which hid a repository that failed on every run. update now prints a warning that names the repository and the git error. Credentials in the URL, including query tokens, are removed from both. Thanks to @masonc15 (#570).

Fixed: skills with symlinks miss updates

A skill folder can hold a symlink to a file elsewhere in its repository. Install copies the target's content, but the folder's git tree hash ignores it, so after the target changed update skipped the skill and check reported it up to date.

A skill whose folder contains a symlink is now compared by commit: update reinstalls it whenever the upstream commit moves, and check reports an update (#572).

Fixed: the open dashboard breaks after upgrade

upgrade pre-downloads the new version's UI assets and removed every other cached version, including the one a running skillshare ui server still loads pages from, so navigating the open dashboard broke. The pre-upgrade version's assets are now kept as well. Restart the UI server between upgrades: a second upgrade without a restart can still remove the oldest server's assets.

Contributors

@masonc15