v1.3.0: release pipeline + SKILL drift detection + agent skills positioning

- .github/workflows/validate.yml: lints gemini-extension.json (jq empty)
  and asserts skills/using-ship/SKILL.md is byte-identical to the canonical
  https://github.com/shipstatic/ship/blob/main/SKILL.md. Runs on every push
  and PR. Permanently solves the propagation gap between the two repos.
- .github/workflows/release.yml: triggers on v* tag push, verifies the tag
  matches gemini-extension.json version, creates a GitHub Release with
  auto-generated notes. Aligns with how 5/6 official Gemini extensions ship.
- README: clarifies that the plugin is distributed as a Gemini CLI extension
  but the underlying SKILL.md uses the open Agent Skills standard
  (agentskills.io) — same content powers 35+ skills-aware tools including
  Claude, Claude Code, Cursor, GitHub Copilot, VS Code, and Codex.
- SKILL.md: re-synced to current canonical at shipstatic/ship main; future
  drift will be caught by validate.yml.

Author: constantintovisi

.github/workflows/release.yml

@@ -0,0 +1,33 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Verify tag matches gemini-extension.json version
+        run: |
+          TAG="${GITHUB_REF_NAME#v}"
+          MANIFEST=$(jq -r .version gemini-extension.json)
+          if [ "$TAG" != "$MANIFEST" ]; then
+            echo "::error title=Version mismatch::Tag $GITHUB_REF_NAME does not match gemini-extension.json version ($MANIFEST)"
+            exit 1
+          fi
+
+      - name: Create GitHub Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "$GITHUB_REF_NAME" \
+            --title "$GITHUB_REF_NAME" \
+            --generate-notes

.github/workflows/validate.yml

@@ -0,0 +1,29 @@
+name: Validate
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Validate gemini-extension.json is well-formed JSON
+        run: jq empty gemini-extension.json
+
+      - name: Detect SKILL.md drift from canonical (npm/ship/SKILL.md)
+        # The canonical SKILL.md lives next to the @shipstatic/ship CLI it teaches.
+        # This plugin's copy must stay byte-identical — drift = stale instructions.
+        run: |
+          curl -fsSL https://raw.githubusercontent.com/shipstatic/ship/main/SKILL.md \
+            -o /tmp/canonical-SKILL.md
+          if ! diff -q /tmp/canonical-SKILL.md skills/using-ship/SKILL.md; then
+            echo "::error title=SKILL drift detected::skills/using-ship/SKILL.md has drifted from https://github.com/shipstatic/ship/blob/main/SKILL.md. Sync with: cp ../../npm/ship/SKILL.md skills/using-ship/SKILL.md"
+            diff /tmp/canonical-SKILL.md skills/using-ship/SKILL.md || true
+            exit 1
+          fi

README.md

@@ -2,7 +2,7 @@
 
 AI plugin for [ShipStatic](https://shipstatic.com) — deploy static websites, landing pages, and prototypes instantly from your AI assistant.
 
-Supports Claude Code, Cursor, and Gemini.
+Distributed as a Gemini CLI extension. The underlying SKILL.md uses the open [Agent Skills](https://agentskills.io) standard, so the same instructional content powers any of the [35+ skills-aware tools](https://agentskills.io/clients) — Claude, Claude Code, Cursor, GitHub Copilot, VS Code, OpenAI Codex, Goose, and more.
 
 ## Prerequisite
 

gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "ship",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "description": "Deploy static sites instantly — no account required",
   "contextFileName": "skills/using-ship/SKILL.md",
   "settings": [

skills/using-ship/SKILL.md

@@ -91,7 +91,7 @@ ship ./dist --password "hunter22"          # protect deployment
 SHIP_PASSWORD="hunter22" ship ./dist        # via env var
 ```
 
-Visitors get an unlock page until they enter the password. Length: 6–128 characters; whitespace is significant. Set per-deployment at upload time — cannot be added or changed later (deploy a new version to rotate). Works on both internal (`*.shipstatic.com`) and custom domains. **Always show the password to the user** if you set one — they need it to view the site.
+Visitors get an unlock page until they enter the password. Length: 6–128 characters. Set per-deployment at upload time — cannot be added or changed later (deploy a new version to rotate). Works on both internal (`*.shipstatic.com`) and custom domains.
 
 ### SPA routing