From bd08b00291a6e46a8bf135148a6fa5b1ca8da02b Mon Sep 17 00:00:00 2001
From: Michael Brooks <mbrooks@slack-corp.com>
Date: Thu, 29 Oct 2026 12:02:04 -0700
Subject: [PATCH 1/2] ci: sync the slack-cli skill from slack-skills-plugin
 each day

A scheduled job downloads the skill from the plugin's main branch and
opens a pull request when it changed, the same way the golang job bumps
the Go version.
---
 .github/workflows/dependencies.yml | 36 ++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml
index 2ae5c582..f453bcfd 100644
--- a/.github/workflows/dependencies.yml
+++ b/.github/workflows/dependencies.yml
@@ -87,3 +87,39 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ steps.credentials.outputs.token }}
           VERSION: ${{ steps.version.outputs.latest }}
+  skill:
+    name: Sync the agent skill
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request'
+    permissions:
+      contents: none # Permissions are set with an application token
+    steps:
+      - name: Gather credentials
+        id: credentials
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ secrets.GH_APP_CLIENT_ID_RELEASER }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY_RELEASER }}
+      - name: Checkout the repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: true
+          ref: main
+          token: ${{ steps.credentials.outputs.token }}
+      - name: Download the latest skill
+        run: |
+          curl -fsSL "https://raw.githubusercontent.com/slackapi/slack-skills-plugin/main/skills/slack-cli/SKILL.md" -o cmd/skill/SKILL.md
+      - name: Open a change request
+        run: |
+          git config --global user.name 'github-actions[bot]'
+          git config --global user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git checkout -b chore-sync-skill
+          if git diff --quiet; then
+            echo "No changes to commit, exiting."
+            exit 0
+          fi
+          git commit --all -m "chore: sync the slack-cli skill from slack-skills-plugin"
+          git push -u origin chore-sync-skill
+          gh pr create --title "chore: sync the slack-cli skill from slack-skills-plugin" --body "Automatic update to the latest \`slack-cli\` skill in [slackapi/slack-skills-plugin](https://github.com/slackapi/slack-skills-plugin/blob/main/skills/slack-cli/SKILL.md)" --milestone "Next Release" --label "code health" --label "semver:patch"
+        env:
+          GITHUB_TOKEN: ${{ steps.credentials.outputs.token }}

From e00279a8604f322badd924018a49fd27a12795b7 Mon Sep 17 00:00:00 2001
From: Michael Brooks <mbrooks@slack-corp.com>
Date: Mon, 2 Nov 2026 11:26:17 -0700
Subject: [PATCH 2/2] ci: scope the skill sync token and update an open sync
 pull request

The app token gets only the contents and pull requests permissions it
needs. When a sync pull request is already open, the job replaces its
branch with the latest skill on main instead of failing the push.
---
 .github/workflows/dependencies.yml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml
index f453bcfd..6c82c99f 100644
--- a/.github/workflows/dependencies.yml
+++ b/.github/workflows/dependencies.yml
@@ -100,6 +100,8 @@ jobs:
         with:
           client-id: ${{ secrets.GH_APP_CLIENT_ID_RELEASER }}
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY_RELEASER }}
+          permission-contents: write
+          permission-pull-requests: write
       - name: Checkout the repo
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -119,7 +121,12 @@ jobs:
             exit 0
           fi
           git commit --all -m "chore: sync the slack-cli skill from slack-skills-plugin"
-          git push -u origin chore-sync-skill
+          # Replace the branch so an open change request has the latest skill and main
+          git push --force -u origin chore-sync-skill
+          if [ -n "$(gh pr list --head chore-sync-skill --state open --json number --jq '.[].number')" ]; then
+            echo "Updated the open change request, exiting."
+            exit 0
+          fi
           gh pr create --title "chore: sync the slack-cli skill from slack-skills-plugin" --body "Automatic update to the latest \`slack-cli\` skill in [slackapi/slack-skills-plugin](https://github.com/slackapi/slack-skills-plugin/blob/main/skills/slack-cli/SKILL.md)" --milestone "Next Release" --label "code health" --label "semver:patch"
         env:
           GITHUB_TOKEN: ${{ steps.credentials.outputs.token }}