refactor: migrate to rust

.github/workflows/build.yml

@@ -3,54 +3,34 @@ name: Build
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   cli:
     name: CLI
+
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    container:
+      image: rust:1.89-bookworm
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         name: Checkout Code
 
-      - uses: actions/setup-python@v6
-        name: Setup Python
-
-        with:
-          python-version: "3.10"
-
-      - run: python -m pip install --upgrade pip
-        name: Upgrade pip
-
-      - run: python -m pip install -e '.[dev]'
-        name: Install Dependencies
+      - run: cargo build --release --locked
+        name: Build Release Binaries
 
-      - run: python -m pip install build twine
-        name: Install Build Tools
+      - run: target/release/agentskill --help
+        name: Test agentskill CLI
 
-      - run: python -m build --sdist --wheel --no-isolation
-        name: Build Package
+      - run: target/release/agsk --version
+        name: Test agsk CLI
 
-      - run: python -m twine check dist/*
-        name: Check Distribution
-
-      - run: python -m venv /tmp/agentskill-build-venv
-        name: Create Virtual Environment
-
-      - run: /tmp/agentskill-build-venv/bin/pip install dist/agsk-*.whl
-        name: Install Built Package
-
-      - run: /tmp/agentskill-build-venv/bin/agentskill --help
-        name: Test CLI
-
-      - run: /tmp/agentskill-build-venv/bin/agentskill analyze examples/python --pretty
+      - run: target/release/agentskill analyze agentskill-skill/examples/python --pretty
         name: Test Analyze
 
-      - run: /tmp/agentskill-build-venv/bin/agentskill generate examples/python > /tmp/generated-AGENTS.md
+      - run: target/release/agentskill generate agentskill-skill/examples/python > /tmp/generated-AGENTS.md
         name: Test Generate
-
-      - uses: actions/upload-artifact@v6
-        name: Upload Distribution
-
-        with:
-          name: dist
-          path: dist/*

.github/workflows/checksum.yml

@@ -0,0 +1,46 @@
+name: Checksum
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  cli:
+    name: CLI
+
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/download-artifact@v8
+        name: Download Release Archives
+
+        with:
+          pattern: agentskill-${{ inputs.version }}-*
+          path: dist
+          merge-multiple: true
+
+      - run: |
+          set -euo pipefail
+
+          find dist -maxdepth 1 -type f \( -name '*.tar.gz' -o -name '*.zip' \) | sort > archives.txt
+
+          test "$(wc -l < archives.txt)" -eq 6
+
+          (cd dist && while read -r archive; do sha256sum "$(basename "$archive")"; done < ../archives.txt > SHA256SUMS)
+
+        name: Generate Checksums
+
+      - uses: actions/upload-artifact@v7
+        name: Upload Checksums
+
+        with:
+          name: agentskill-${{ inputs.version }}-checksums
+          path: dist/SHA256SUMS
+          if-no-files-found: error

.github/workflows/main.yml

@@ -9,6 +9,13 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: main-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   verify:
     name: Verify
@@ -23,3 +30,7 @@ jobs:
     name: Test
     needs: build
     uses: ./.github/workflows/test.yml
+
+  security:
+    name: Security
+    uses: ./.github/workflows/security.yml

.github/workflows/package.yml

@@ -0,0 +1,147 @@
+name: Package
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        required: true
+        type: string
+
+      version:
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  cli:
+    name: CLI
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
+
+    strategy:
+      fail-fast: false
+
+      matrix:
+        include:
+          - os: ubuntu-24.04
+            target: x86_64-unknown-linux-gnu
+            archive: tar.gz
+
+          - os: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-gnu
+            archive: tar.gz
+
+          - os: macos-15-intel
+            target: x86_64-apple-darwin
+            archive: tar.gz
+
+          - os: macos-15
+            target: aarch64-apple-darwin
+            archive: tar.gz
+
+          - os: windows-2025
+            target: x86_64-pc-windows-msvc
+            archive: zip
+
+          - os: windows-11-arm
+            target: aarch64-pc-windows-msvc
+            archive: zip
+
+    steps:
+      - uses: actions/checkout@v7
+        name: Checkout Code
+
+        with:
+          ref: ${{ inputs.ref }}
+
+      - uses: dtolnay/rust-toolchain@stable
+        name: Install Rust Toolchain
+
+        with:
+          targets: ${{ matrix.target }}
+
+      - uses: Swatinem/rust-cache@v2
+        name: Cache Cargo
+
+      - run: cargo build --release --locked --target ${{ matrix.target }}
+        name: Build Release Binaries
+
+        env:
+          CARGO_BUILD_JOBS: 4
+
+      - if: matrix.archive == 'tar.gz'
+        run: |
+          set -euo pipefail
+
+          ./target/${{ matrix.target }}/release/agentskill --version
+          ./target/${{ matrix.target }}/release/agsk --version
+
+        name: Smoke Test Unix Binaries
+
+      - if: matrix.archive == 'zip'
+        shell: pwsh
+
+        run: |
+          $ErrorActionPreference = "Stop"
+
+          & "target/${{ matrix.target }}/release/agentskill.exe" --version
+          & "target/${{ matrix.target }}/release/agsk.exe" --version
+
+        name: Smoke Test Windows Binaries
+
+      - if: matrix.archive == 'tar.gz'
+
+        run: |
+          set -euo pipefail
+
+          version="${{ inputs.version }}"
+          target="${{ matrix.target }}"
+          package_dir="agentskill-${version}-${target}"
+          archive="${package_dir}.tar.gz"
+
+          mkdir -p "$package_dir"
+          cp "target/${target}/release/agentskill" "$package_dir/"
+          cp "target/${target}/release/agsk" "$package_dir/"
+          cp LICENSE "$package_dir/"
+
+          tar -czf "$archive" "$package_dir"
+          bash agentskill-scripts/verify-release-archive.sh "$archive" "$target"
+
+        name: Package Unix Archive
+
+      - if: matrix.archive == 'zip'
+        shell: pwsh
+
+        run: |
+          $ErrorActionPreference = "Stop"
+
+          $version = "${{ inputs.version }}"
+          $target = "${{ matrix.target }}"
+          $packageDir = "agentskill-$version-$target"
+          $archive = "$packageDir.zip"
+
+          New-Item -ItemType Directory -Force -Path $packageDir | Out-Null
+          Copy-Item "target/$target/release/agentskill.exe" "$packageDir/"
+          Copy-Item "target/$target/release/agsk.exe" "$packageDir/"
+          Copy-Item "LICENSE" "$packageDir/"
+
+          Compress-Archive -Path $packageDir -DestinationPath $archive
+          $verifyDir = Join-Path $env:RUNNER_TEMP "agentskill-release-verify-$target"
+          Remove-Item -Recurse -Force -ErrorAction SilentlyContinue $verifyDir
+          Expand-Archive -LiteralPath $archive -DestinationPath $verifyDir
+
+          foreach ($required in @("agentskill.exe", "agsk.exe", "LICENSE")) {
+            if (-not (Get-ChildItem -Path $verifyDir -Recurse -File -Filter $required)) { throw "archive is missing $required" }
+          }
+
+        name: Package Windows Archive
+
+      - uses: actions/upload-artifact@v7
+        name: Upload Release Archive
+
+        with:
+          name: agentskill-${{ inputs.version }}-${{ matrix.target }}
+          path: agentskill-${{ inputs.version }}-${{ matrix.target }}.${{ matrix.archive }}
+          if-no-files-found: error

.github/workflows/prepare.yml

@@ -0,0 +1,67 @@
+name: Prepare
+
+on:
+  workflow_call:
+    inputs:
+      tag:
+        required: true
+        type: string
+
+    outputs:
+      version:
+        value: ${{ jobs.cli.outputs.version }}
+
+      prerelease:
+        value: ${{ jobs.cli.outputs.prerelease }}
+
+      tag:
+        value: ${{ jobs.cli.outputs.tag }}
+
+permissions:
+  contents: read
+
+jobs:
+  cli:
+    name: CLI
+    runs-on: ubuntu-latest
+
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+      prerelease: ${{ steps.version.outputs.prerelease }}
+      tag: ${{ steps.version.outputs.tag }}
+
+    steps:
+      - uses: actions/checkout@v7
+        name: Checkout Code
+
+        with:
+          ref: ${{ inputs.tag }}
+
+      - id: version
+        env:
+          RELEASE_TAG: ${{ inputs.tag }}
+
+        run: |
+          set -euo pipefail
+
+          tag="$RELEASE_TAG"
+          bash agentskill-scripts/release-notes.sh "$tag" release-notes.md
+          version="${tag%-rc.*}"
+          prerelease=false
+          if [[ "$tag" == *-rc.* ]]; then prerelease=true; fi
+
+          {
+            echo "tag=$tag"
+            echo "version=$version"
+            echo "prerelease=$prerelease"
+          } >> "$GITHUB_OUTPUT"
+
+        name: Validate Release Version
+
+      - uses: actions/upload-artifact@v7
+        name: Upload Release Notes
+
+        with:
+          name: agentskill-release-notes-${{ steps.version.outputs.version }}
+          path: release-notes.md
+          if-no-files-found: error