coding-net-integration — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited coding-net-integration (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Unified CLI:./coding <module> <command> [options]Full command reference:references/api_reference.md
Before executing any command, verify credentials:
If CODING_TEAM + CODING_TOKEN are set, no init needed — CodingClient resolves them automatically.
Ask user for team name and Personal Access Token, then run:
./coding auth init --team "their-team" --token "their-token"This verifies connectivity and persists credentials to ~/.coding/credentials.json.
⚠️ NEVER run `./coding auth setup` from Agent — it uses input() and will block.project:depot:rw (代码仓库)project:ci:rw (持续集成)project:artifacts:rw (制品库)team:profile:ro (团队信息,用于验证连通性)After init/setup succeeds, credentials auto-persist. No further user action needed.
核心原则: 本地有仓库用 git,跨仓库/平台操作用本技能。
git add/commit/pushgit pushgit log/diff/blame⛔ Agent 只能向最低级别的集成分支提交 MR,严禁直接向 master/main 提交。
Before creating branches or MRs, MUST list branches via DescribeGitBranches and detect the branching model:
branches = list all branch names
if 'dev' in branches: target = 'dev'
elif 'develop' in branches: target = 'develop'
elif 'test' in branches: target = 'test'
elif 'staging' in branches: target = 'staging'
elif 'main' in branches: target = 'main'
else: target = default_branchtarget (lowest-level integration branch)target: feature/<descriptive-name>ModifyGitFilesfeature/<name> → targetmaster/main directly unless it is the ONLY branch| Purpose | Pattern | Example |
|---|---|---|
| Feature | feature/<name> | feature/add-auth-module |
| Bugfix | fix/<name> | fix/null-pointer-crash |
| Probe/Test | probe/<name> | probe/api-integration |
master or main when dev/develop existsmaster, main, test)temp, test123)Coding.net Open API uses a unified POST endpoint with Action-based routing:
https://{team}.coding.net/open-api?Action={ActionName}Authorization: Bearer {personal_access_token}{"Response": {"RequestId": "...", ...data}} or {"Response": {"Error": {...}}}This is different from REST-style APIs — there are no path-based routes.
| User intent | Command |
|---|---|
| "查看项目仓库" | depot list --project <ID> |
| "看看分支" | depot branches --depot-id <ID> |
| "看看标签" | depot tags --depot-id <ID> |
| "最近提交记录" | depot commits --depot-id <ID> [--ref dev] |
| "查看文件" | depot file --depot-id <ID> --path README.md [--ref dev] |
| "查看目录" | depot tree --depot-id <ID> [--path src] [--ref dev] |
| "提交文件" | depot commit-files --depot-id <ID> --ref feature/x --message "fix" --create path=content |
| "创建分支" | depot create-branch --depot-id <ID> --branch feature/x |
| "删除分支" | depot delete-branch --depot-id <ID> --branch feature/x |
| "创建 MR" | depot mr-create --depot-id <ID> --title "..." --src feature/x |
| "MR 列表" | depot mr-list --project <name> [--status open] |
| "MR diff" | depot mr-diff --depot-id <ID> --merge-id 1 |
| "MR 评论" | depot mr-comments --depot-path team/project/depot --merge-id 1 |
| "发评论" | depot mr-comment --depot-path team/project/depot --merge-id 1 --content "LGTM" |
| "修改 MR" | depot mr-update --depot-id <ID> --merge-id 1 --title "new title" |
| "commit diff" | depot commit-diff --depot-id <ID> --sha abc123 |
| "合并 MR" | depot mr-merge --depot-id <ID> --merge-id 1 [--delete-branch] |
| "关闭 MR" | depot mr-close --depot-id <ID> --merge-id 1 |
| User intent | Command |
|---|---|
| "查看所有项目" | project list |
| "项目详情" | project info --id <ID> |
| "按名称查项目" | project find --name my-project |
| "项目成员" | project members --id <ID> |
| "项目仓库" | project depots --id <ID> |
| User intent | Command |
|---|---|
| "查看构建任务" | ci jobs --project <ID> |
| "构建记录" | ci builds --project <ID> --job <jobId> |
| "触发构建" | ci trigger --project <ID> --job <jobId> [--ref main] |
| "停止构建" | ci stop --project <ID> --id <buildId> |
| "查看构建日志" | ci log --project <ID> --id <buildId> [--raw] |
| "构建阶段" | ci stage --project <ID> --id <buildId> |
| User intent | Command |
|---|---|
| "查看制品库" | artifact repos --project <ID> [--type docker] |
| "创建制品库" | artifact create-repo --project <ID> --name my-docker --type docker |
| "查看包列表" | artifact packages --project <ID> --repo my-docker |
| "查看版本" | artifact versions --project <ID> --repo my-docker --pkg my-app |
| "下载地址" | artifact download-url --project <ID> --repo ... --pkg ... --version v1.0 |
Many Coding APIs require either Project Name or Project ID, and either Depot Name or Depot ID, depending on the specific Action. The convention is:
--project with a string = Project Name (e.g., "my-project")--project with an integer = Project ID (e.g., 12345)--depot = Depot Name, --depot-id = Depot IDWhen the user gives a project name but you need an ID (or vice versa), use:
DescribeCodingProjects to look up Project ID from nameDescribeProjectDepots to look up Depot ID from project + depot nameRaw CLI output is JSON. Always transform for the user:
| Situation | Agent action |
|---|---|
| Auth failed (401) | Verify token: ./coding auth status, guide re-setup |
| AuthFailure / InvalidParameter | Check parameter names/types match the Action spec |
| ResourceNotFound | Verify project name/ID and depot name/ID exist |
| RequestLimitExceeded (429) | Built-in retry with exponential backoff (max 3) |
| Server error (5xx) | Built-in retry with exponential backoff (max 3) |
| No credentials | Trigger First-Use Detection flow |
?Action= query parameter, not URL pathProjectName, DepotId){"Response": {...}}, errors in {"Response": {"Error": {...}}}PageNumber/PageSize for paginated resultscoding-net-integration/
├── coding ← Unified CLI entry point (bash)
├── SKILL.md ← This file (Agent execution standard)
├── scripts/
│ ├── coding_api.py ← Core engine (auth + HTTP + retry)
│ ├── auth.py ← Authentication (init / setup / status / clean)
│ ├── depot.py ← Git repos + MR review (branches / commits / mr-diff / mr-comment)
│ ├── project.py ← Project management (list / info / find / members)
│ ├── ci.py ← CI build management
│ └── artifact.py ← Artifact repository management
├── evals/
│ └── evals.json ← Test cases for skill evaluation
└── references/
└── api_reference.md ← Action parameter reference~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.