ci: add daily upstream sync + custom skills lint

.github/workflows/lint.yml

@@ -0,0 +1,38 @@
+name: Lint
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  verify-custom-skills-sync:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Verify custom skills list consistency
+        run: |
+          set -euo pipefail
+
+          # Extract CUSTOM_SKILLS from workflow (anchor to line start + optional whitespace)
+          WORKFLOW_SKILLS=$(grep "^[[:space:]]*CUSTOM_SKILLS=(" .github/workflows/sync-upstream.yml | sed 's/.*CUSTOM_SKILLS=(\([^)]*\)).*/\1/' | tr ' ' '\n' | sed 's/"//g' | sort)
+
+          # Extract custom skills from README (markdown table between sentinel comments)
+          README_SKILLS=$(sed -n '/<!-- custom-skills-start -->/,/<!-- custom-skills-end -->/p' README.md | grep '| `' | awk -F'`' '{print $2}' | sort)
+
+          echo "Workflow CUSTOM_SKILLS:"
+          echo "$WORKFLOW_SKILLS"
+          echo ""
+          echo "README custom skills:"
+          echo "$README_SKILLS"
+          echo ""
+
+          if [ "$WORKFLOW_SKILLS" = "$README_SKILLS" ]; then
+            echo "✅ Custom skills lists are in sync"
+          else
+            echo "❌ Custom skills lists are out of sync!"
+            echo "Workflow has: $WORKFLOW_SKILLS"
+            echo "README has: $README_SKILLS"
+            exit 1
+          fi

.github/workflows/sync-upstream.yml

@@ -0,0 +1,130 @@
+name: Sync from upstream Kiro Powers
+
+on:
+  schedule:
+    # Daily at 08:00 UTC (11:00 Israel time)
+    - cron: '0 8 * * *'
+  workflow_dispatch:
+
+concurrency:
+  group: sync-upstream
+  cancel-in-progress: false
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout loki-skills
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+
+      - name: Clone upstream Kiro Powers (main branch)
+        run: |
+          set -euo pipefail
+
+          # Clone from main branch (upstream has no release tags)
+          # This is safe because we filter to SKILL.md files and preserve custom skills
+          echo "✅ Cloning from main branch"
+          git clone --depth 1 https://github.com/kirodotdev/powers.git /tmp/powers
+
+      - name: Sync upstream skills (preserve custom ones)
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+
+          # Custom skills to preserve (not from upstream)
+          # Synced from README.md "Custom (loki-only)" section
+          CUSTOM_SKILLS=("claude-agent-sdk" "cross-agent-test" "lambda-durable" "mcporter" "module-organizer" "playwright-cli" "refactoring" "unit-testing")
+
+          # Copy/update all upstream skills except custom ones
+          # Filter: only dirs containing SKILL.md (actual skills, not docs/scripts/etc)
+          for skill_dir in /tmp/powers/*/; do
+            # Guard: skip if dir doesn't exist (nullglob edge case)
+            [ -d "$skill_dir" ] || continue
+
+            # Filter: only process if SKILL.md exists (is a real skill)
+            [ -f "$skill_dir/SKILL.md" ] || {
+              echo "⏭️  Skipping non-skill dir: $(basename "$skill_dir")"
+              continue
+            }
+
+            skill_name=$(basename "$skill_dir")
+
+            # Skip if custom skill (exact match, no regex interpretation)
+            if printf '%s\n' "${CUSTOM_SKILLS[@]}" | grep -qxF -- "$skill_name"; then
+              echo "⏭️  Skipping custom skill: $skill_name"
+              continue
+            fi
+
+            # Copy or update skill
+            if [ -d "$skill_name" ]; then
+              echo "🔄 Updating: $skill_name"
+              rm -rf "$skill_name"
+            else
+              echo "✨ Adding new: $skill_name"
+            fi
+            cp -r "${skill_dir%/}" "$skill_name"
+          done
+
+          # Note: Deletions of removed upstream skills are intentionally NOT performed.
+          # Skills removed upstream stay in loki-skills (manual review + cleanup).
+          # This prevents accidental deletion of valuable but deprecated skills.
+
+      - name: Cleanup temp directory
+        run: |
+          set -euo pipefail
+          rm -rf /tmp/powers
+
+      - name: Check for changes
+        id: check
+        run: |
+          set -euo pipefail
+          if [ -z "$(git status --porcelain)" ]; then
+            echo "has_changes=false" >> $GITHUB_OUTPUT
+          else
+            echo "has_changes=true" >> $GITHUB_OUTPUT
+            echo "📋 Changed files:"
+            git status --porcelain
+          fi
+
+      - name: Update README sync date
+        if: steps.check.outputs.has_changes == 'true'
+        run: |
+          set -euo pipefail
+          TODAY=$(date -u +"%Y-%m-%d")
+          sed -i "s/Last synced: .*/Last synced: $TODAY/" README.md
+
+      - name: Create PR if changes detected
+        if: steps.check.outputs.has_changes == 'true'
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7
+        with:
+          commit-message: 'chore: sync upstream Kiro Powers skills'
+          title: 'chore: sync upstream Kiro Powers skills'
+          body: |
+            Automated daily sync from [kirodotdev/powers](https://github.com/kirodotdev/powers).
+
+            **Preserved custom skills:**
+            - `claude-agent-sdk`
+            - `cross-agent-test`
+            - `lambda-durable`
+            - `mcporter`
+            - `module-organizer`
+            - `playwright-cli`
+            - `refactoring`
+            - `unit-testing`
+
+            **Sync details:**
+            - Adds new upstream skills
+            - Updates existing skills
+            - Does NOT delete skills removed upstream (manual review required)
+            - Filters: only dirs with `SKILL.md` are synced (skips docs/scripts)
+            - Synced at: ${{ github.run_started_at }}
+            - Workflow run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          branch: chore/sync-upstream-skills
+          delete-branch: true
+          labels: 'chore, automated'

README.md

@@ -58,20 +58,38 @@ done
 
 ### Custom (loki-only)
 
+<!-- custom-skills-start -->
 | Skill | Description |
 |-------|-------------|
 | `claude-agent-sdk` | Build AI agents using Claude Agent SDK |
 | `cross-agent-test` | Zero-context cross-agent testing of CLI tools |
 | `lambda-durable` | AWS Lambda durable functions |
+| `mcporter` | Use MCP servers via CLI |
+| `module-organizer` | Prevent namespace drift in TypeScript projects |
+| `playwright-cli` | Browser automation via playwright-cli |
+| `refactoring` | Refactoring patterns & safe code transformation |
+| `unit-testing` | Unit testing with ATAT (3rd Edition) |
+
+**Note:** Custom skills list must match the `CUSTOM_SKILLS` array in `.github/workflows/sync-upstream.yml`. Consistency is verified by CI (`.github/workflows/lint.yml`).
+
+<!-- custom-skills-end -->
 
 ## Sync with upstream
 
+**Automated:** Daily sync via GitHub Actions (`.github/workflows/sync-upstream.yml`).
+- Runs at 08:00 UTC daily
+- Creates PR if changes detected (manual review before merge)
+- Clones from `main` branch (upstream has no release tags)
+- Preserves custom skills (see above)
+- **Prerequisite:** Enable "Allow GitHub Actions to create and approve pull requests" in repo settings (Settings → Actions → General)
+
+**Manual sync:**
 ```bash
 git clone --depth 1 https://github.com/kirodotdev/powers.git /tmp/powers
-# Copy new/updated skills, preserve custom ones
+# Copy new/updated skills, preserve custom ones (see CUSTOM_SKILLS array in workflow)
 ```
 
-Last synced: 2026-05-07
+Last synced: 2026-05-17
 
 ## License