Knowledge Release (knowledge-release.yaml)

Knowledge Release (knowledge-release.yaml)

.github/workflows/knowledge-release.yaml is the workflow named “Knowledge Release”. It attaches the knowledge bundle to a GitHub release as a zip file, so that a reader can take the bundle as it stood at that release without cloning the repository.¹ Beside it go the domain schema and, when .lokf/m365/ is installed, the Microsoft 365 Copilot skills. It runs no LLM or agent, and it never commits or pushes. NOTICE says that it is a copy of a ktl-sidecar template from the Knowledge Trust Ladder (KTL) repository.²

How it starts

A person, or Semantic release, dispatches it with an existing release’s tag and an optional force input. A published release starts it too, but only once the repository variable KNOWLEDGE_RELEASE_ENABLED is true. A header comment says that GitHub starts no workflow for a release created with the default GITHUB_TOKEN, so a release job that makes the release that way dispatches this workflow instead.

Its two jobs

• pack, named “Validate and pack the bundle (read-only)”, runs with contents: read. It compares the bundle’s git tree at the tag with its tree at the newest other published release that carries a bundle. When the two match and force is not set, the run ends with a notice and packs nothing. Otherwise it validates the bundle and its relation targets, runs the conventions script, and packs knowledge-<tag>-<name>.zip with its .sha256. <name> is the repository’s name unless the repository variable KNOWLEDGE_RELEASE_NAME sets another. Because .lokf/justfile names a domain schema, it also packs that file as schema-<tag>-<name>.yaml with its .sha256, and one Copilot skill zip for each instructions file in .lokf/m365/.
• attach, named “Attach the zip to the release (privileged)”, runs only when pack packed something, with contents: write, id-token: write and attestations: write. It runs no third-party packages, checks each file against its checksum, attests build provenance when the repository is public, and uploads the files to the release, replacing an earlier upload of the same name.

So the domain schema goes onto a release only when the bundle changed since the last release that carries a bundle, or when force is set. CONTRIBUTING.md says the same, and that a release that changes only the schema needs a run by hand with force. The README points there for the terms on which a release carries the schema copy.

Footnotes

1. .github/workflows/knowledge-release.yaml, the header comment, the on key, the compare and pack steps and the attach job ↩

2. NOTICE, the Knowledge bundle section ↩