# Keeps the packaging consistent: one version across every manifest,
# MCP configs that point at uxkin.com with no stored credentials, no
# tokens anywhere, valid skills, and files that exist. Weekly (and by
# hand) it also checks the library numbers we quote against uxkin.com.
name: Checks

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: "41 6 * * 1"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  repository:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
      - name: Packaging checks
        run: node scripts/check.mjs ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && '--live' || '' }}