{"owner":"rorkai","repo":"App-Store-Connect-CLI","hasSkills":true,"hasMcp":false,"mcpConfig":null,"found":["AGENTS.md"],"skills":{"AGENTS.md":"# AGENTS.md\n\nUnofficial, fast, lightweight, agent-assisted, reviewer-owned CLI for the App Store Connect API. Built in Go with [ffcli](https://github.com/peterbourgon/ff).\n\n## Skills\n\nSkills for using `asc` in app workflows live at https://github.com/rorkai/app-store-connect-cli-skills.\n\nRepository-maintainer workflows live under `.agents/skills/`:\n\n- `$develop-asc-change`: design, implement, and verify commands, flags, endpoints, bug fixes, and behavior-changing refactors.\n- `$audit-asc-pr`: audit a complete PR and fix proven defects.\n- `$watch-asc-pr`: recheck PR comments, checks, head changes, and merge readiness.\n- `$triage-asc-issue`: reproduce, classify, label, and scope an issue.\n- `$review-wall-of-apps-prs`: validate, approve, and merge Wall of Apps submissions safely.\n- `$release-asc-cli`: publish and verify an end-to-end CLI repository release.\n- `$sync-asc-skills`: check the external ASC workflow skills for CLI-surface drift.\n\nUse these skills for their matching workflows instead of expanding this always-loaded file with task-specific procedures.\n\n## Core CLI contract\n\n- Use long-form flags in docs, tests, and examples (`--app`, `--output`).\n- Output defaults are TTY-aware: `table` in terminals and minified `json` for pipes or CI. Explicit `--output` wins.\n- Do not add interactive prompts. Require `--confirm` for destructive operations.\n- Use `--paginate` when callers request every page.\n- Write data to stdout and errors or diagnostics to stderr.\n- Never accept and silently ignore an unsupported flag or value.\n\n## Discover current behavior\n\nNever rely on memorized command shapes. Before implementing, testing, or documenting a command, inspect its current help:\n\n```bash\nasc --help\nasc builds --help\nasc builds list --help\n```\n\nFor App Store Connect API documentation, prefer the `sosumi.ai` mirror over `developer.apple.com`.\n\nUse the offline OpenAPI snapshot for endpoint and schema truth:\n\n- `docs/openapi/latest.json`: complete snapshot.\n- `docs/openapi/paths.txt`: quick endpoint index.\n- `docs/openapi/README.md`: update procedure.\n\nValidate attributes against the exact create or update request schema. Validate filters and includes against the specific endpoint; related top-level and relationship endpoints often differ.\n\n## Development workflow\n\n- Work on a branch and use an isolated worktree when the main checkout is dirty or other work is in progress.\n- Do not push directly to `main`, bypass hooks, use `--no-verify`, or skip checks to force a result.\n- Use TDD for behavior changes: reproduce or establish RED, implement the smallest coherent change, then reach GREEN.\n- Keep one logical change per commit. Do not mix unrelated refactors, fixes, and test rewrites.\n- Re-run the focused failing test after each fix before broad validation.\n- Preserve and report pre-existing failures honestly.\n- Parallel exploration is allowed, but do not concurrently edit the same command group; integrate final changes in one coherent pass.\n\nUser-facing commands and flags follow `experimental` -> `stable` -> `deprecated` -> `removed`. Do not delete stable behavior directly. Deprecations require warning text, transition tests, migration guidance, and a release-note entry.\n\n## Implementation invariants\n\n- Put command implementations in `internal/cli/<domain>` and register new top-level commands in `internal/cli/registry/registry.go`.\n- Set `UsageFunc: shared.DefaultUsageFunc` on command groups and subcommands.\n- Use `shared.ContextWithTimeout` or `shared.ContextWithUploadTimeout` for outbound HTTP.\n- Read and write repository-controlled or API-supplied paths through `internal/rootfs`, anchored to the operator-selected root for that command, instead of plain `os` file operations.\n- Validate required flags before side effects and assert stderr messages in tests.\n- Use `internal/cli/cmdtest` for CLI-level coverage and `httptest` for HTTP payload coverage.\n- Remove shared wrappers or helpers made obsolete by a refactor.\n\n## Build and validation\n\n```bash\nmake build\nmake format\nmake check-docs\nmake lint\nASC_BYPASS_KEYCHAIN=1 make test\nmake install-hooks\n```\n\nEvery manual test command must use `ASC_BYPASS_KEYCHAIN=1` to prevent host keychain prompts and profile bleed-through. The `make test` target enforces the same environment internally.\n\nBefore opening or merging a PR, run `make format`, `make check-docs`, `make lint`, and `ASC_BYPASS_KEYCHAIN=1 make test`. If command help changed, run `make generate-command-docs` and commit `docs/COMMANDS.md` before those checks. Run `make check-wall-of-apps` for Wall changes.\n\nDo not weaken CI: formatting, documentation, lint, and tests must run on PR and `main` workflows.\n\n## GitHub and issue guardrails\n\n- Inspect thread-aware GitHub review state before declaring a PR clean; flat comments do not prove every thread is resolved.\n- A PR is ready only when the latest head was reviewed, required checks pass, actionable threads are resolved, and GitHub reports it mergeable.\n- Fix-forward is the default for `$audit-asc-pr`; approval and merge still require explicit user intent.\n- Every newly created or triaged issue must end with exactly one type (`bug`, `enhancement`, `question`), one priority (`p0`-`p3`), and one difficulty (`easy`, `medium`, `hard`) label.\n\n## Authentication and live testing\n\nApp Store Connect API keys come from https://appstoreconnect.apple.com/access/integrations/api and must never be committed.\n\nTests touching auth must isolate relevant environment and config state. For live verification, prefer read-only calls. When mutation is necessary during PR audits, prefer disposable app `6759231657`, clean up temporary resources, and record anything left behind. Never mutate a non-disposable app without explicit approval.\n\n## Handoff contract\n\nFor substantial changes, explain the chosen approach, alternatives and trade-offs, expected invocations and outputs, compatibility impact, edge cases, failure modes, commands run, tests, live verification, commits or pushes, and unresolved risks.\n\n## References\n\n- Go standards: `docs/GO_STANDARDS.md`\n- Testing patterns: `docs/TESTING.md`\n- Git workflow and CLI structure: `docs/CONTRIBUTING.md`\n- API quirks: `docs/API_NOTES.md`\n- Development setup, PRs, labels, and Wall submissions: `CONTRIBUTING.md`\n"},"files":{"AGENTS.md":"# AGENTS.md\n\nUnofficial, fast, lightweight, agent-assisted, reviewer-owned CLI for the App Store Connect API. Built in Go with [ffcli](https://github.com/peterbourgon/ff).\n\n## Skills\n\nSkills for using `asc` in app workflows live at https://github.com/rorkai/app-store-connect-cli-skills.\n\nRepository-maintainer workflows live under `.agents/skills/`:\n\n- `$develop-asc-change`: design, implement, and verify commands, flags, endpoints, bug fixes, and behavior-changing refactors.\n- `$audit-asc-pr`: audit a complete PR and fix proven defects.\n- `$watch-asc-pr`: recheck PR comments, checks, head changes, and merge readiness.\n- `$triage-asc-issue`: reproduce, classify, label, and scope an issue.\n- `$review-wall-of-apps-prs`: validate, approve, and merge Wall of Apps submissions safely.\n- `$release-asc-cli`: publish and verify an end-to-end CLI repository release.\n- `$sync-asc-skills`: check the external ASC workflow skills for CLI-surface drift.\n\nUse these skills for their matching workflows instead of expanding this always-loaded file with task-specific procedures.\n\n## Core CLI contract\n\n- Use long-form flags in docs, tests, and examples (`--app`, `--output`).\n- Output defaults are TTY-aware: `table` in terminals and minified `json` for pipes or CI. Explicit `--output` wins.\n- Do not add interactive prompts. Require `--confirm` for destructive operations.\n- Use `--paginate` when callers request every page.\n- Write data to stdout and errors or diagnostics to stderr.\n- Never accept and silently ignore an unsupported flag or value.\n\n## Discover current behavior\n\nNever rely on memorized command shapes. Before implementing, testing, or documenting a command, inspect its current help:\n\n```bash\nasc --help\nasc builds --help\nasc builds list --help\n```\n\nFor App Store Connect API documentation, prefer the `sosumi.ai` mirror over `developer.apple.com`.\n\nUse the offline OpenAPI snapshot for endpoint and schema truth:\n\n- `docs/openapi/latest.json`: complete snapshot.\n- `docs/openapi/paths.txt`: quick endpoint index.\n- `docs/openapi/README.md`: update procedure.\n\nValidate attributes against the exact create or update request schema. Validate filters and includes against the specific endpoint; related top-level and relationship endpoints often differ.\n\n## Development workflow\n\n- Work on a branch and use an isolated worktree when the main checkout is dirty or other work is in progress.\n- Do not push directly to `main`, bypass hooks, use `--no-verify`, or skip checks to force a result.\n- Use TDD for behavior changes: reproduce or establish RED, implement the smallest coherent change, then reach GREEN.\n- Keep one logical change per commit. Do not mix unrelated refactors, fixes, and test rewrites.\n- Re-run the focused failing test after each fix before broad validation.\n- Preserve and report pre-existing failures honestly.\n- Parallel exploration is allowed, but do not concurrently edit the same command group; integrate final changes in one coherent pass.\n\nUser-facing commands and flags follow `experimental` -> `stable` -> `deprecated` -> `removed`. Do not delete stable behavior directly. Deprecations require warning text, transition tests, migration guidance, and a release-note entry.\n\n## Implementation invariants\n\n- Put command implementations in `internal/cli/<domain>` and register new top-level commands in `internal/cli/registry/registry.go`.\n- Set `UsageFunc: shared.DefaultUsageFunc` on command groups and subcommands.\n- Use `shared.ContextWithTimeout` or `shared.ContextWithUploadTimeout` for outbound HTTP.\n- Read and write repository-controlled or API-supplied paths through `internal/rootfs`, anchored to the operator-selected root for that command, instead of plain `os` file operations.\n- Validate required flags before side effects and assert stderr messages in tests.\n- Use `internal/cli/cmdtest` for CLI-level coverage and `httptest` for HTTP payload coverage.\n- Remove shared wrappers or helpers made obsolete by a refactor.\n\n## Build and validation\n\n```bash\nmake build\nmake format\nmake check-docs\nmake lint\nASC_BYPASS_KEYCHAIN=1 make test\nmake install-hooks\n```\n\nEvery manual test command must use `ASC_BYPASS_KEYCHAIN=1` to prevent host keychain prompts and profile bleed-through. The `make test` target enforces the same environment internally.\n\nBefore opening or merging a PR, run `make format`, `make check-docs`, `make lint`, and `ASC_BYPASS_KEYCHAIN=1 make test`. If command help changed, run `make generate-command-docs` and commit `docs/COMMANDS.md` before those checks. Run `make check-wall-of-apps` for Wall changes.\n\nDo not weaken CI: formatting, documentation, lint, and tests must run on PR and `main` workflows.\n\n## GitHub and issue guardrails\n\n- Inspect thread-aware GitHub review state before declaring a PR clean; flat comments do not prove every thread is resolved.\n- A PR is ready only when the latest head was reviewed, required checks pass, actionable threads are resolved, and GitHub reports it mergeable.\n- Fix-forward is the default for `$audit-asc-pr`; approval and merge still require explicit user intent.\n- Every newly created or triaged issue must end with exactly one type (`bug`, `enhancement`, `question`), one priority (`p0`-`p3`), and one difficulty (`easy`, `medium`, `hard`) label.\n\n## Authentication and live testing\n\nApp Store Connect API keys come from https://appstoreconnect.apple.com/access/integrations/api and must never be committed.\n\nTests touching auth must isolate relevant environment and config state. For live verification, prefer read-only calls. When mutation is necessary during PR audits, prefer disposable app `6759231657`, clean up temporary resources, and record anything left behind. Never mutate a non-disposable app without explicit approval.\n\n## Handoff contract\n\nFor substantial changes, explain the chosen approach, alternatives and trade-offs, expected invocations and outputs, compatibility impact, edge cases, failure modes, commands run, tests, live verification, commits or pushes, and unresolved risks.\n\n## References\n\n- Go standards: `docs/GO_STANDARDS.md`\n- Testing patterns: `docs/TESTING.md`\n- Git workflow and CLI structure: `docs/CONTRIBUTING.md`\n- API quirks: `docs/API_NOTES.md`\n- Development setup, PRs, labels, and Wall submissions: `CONTRIBUTING.md`\n"},"items":[{"name":"AGENTS.md","path":"AGENTS.md","title":"AGENTS.md","content":"# AGENTS.md\n\nUnofficial, fast, lightweight, agent-assisted, reviewer-owned CLI for the App Store Connect API. Built in Go with [ffcli](https://github.com/peterbourgon/ff).\n\n## Skills\n\nSkills for using `asc` in app workflows live at https://github.com/rorkai/app-store-connect-cli-skills.\n\nRepository-maintainer workflows live under `.agents/skills/`:\n\n- `$develop-asc-change`: design, implement, and verify commands, flags, endpoints, bug fixes, and behavior-changing refactors.\n- `$audit-asc-pr`: audit a complete PR and fix proven defects.\n- `$watch-asc-pr`: recheck PR comments, checks, head changes, and merge readiness.\n- `$triage-asc-issue`: reproduce, classify, label, and scope an issue.\n- `$review-wall-of-apps-prs`: validate, approve, and merge Wall of Apps submissions safely.\n- `$release-asc-cli`: publish and verify an end-to-end CLI repository release.\n- `$sync-asc-skills`: check the external ASC workflow skills for CLI-surface drift.\n\nUse these skills for their matching workflows instead of expanding this always-loaded file with task-specific procedures.\n\n## Core CLI contract\n\n- Use long-form flags in docs, tests, and examples (`--app`, `--output`).\n- Output defaults are TTY-aware: `table` in terminals and minified `json` for pipes or CI. Explicit `--output` wins.\n- Do not add interactive prompts. Require `--confirm` for destructive operations.\n- Use `--paginate` when callers request every page.\n- Write data to stdout and errors or diagnostics to stderr.\n- Never accept and silently ignore an unsupported flag or value.\n\n## Discover current behavior\n\nNever rely on memorized command shapes. Before implementing, testing, or documenting a command, inspect its current help:\n\n```bash\nasc --help\nasc builds --help\nasc builds list --help\n```\n\nFor App Store Connect API documentation, prefer the `sosumi.ai` mirror over `developer.apple.com`.\n\nUse the offline OpenAPI snapshot for endpoint and schema truth:\n\n- `docs/openapi/latest.json`: complete snapshot.\n- `docs/openapi/paths.txt`: quick endpoint index.\n- `docs/openapi/README.md`: update procedure.\n\nValidate attributes against the exact create or update request schema. Validate filters and includes against the specific endpoint; related top-level and relationship endpoints often differ.\n\n## Development workflow\n\n- Work on a branch and use an isolated worktree when the main checkout is dirty or other work is in progress.\n- Do not push directly to `main`, bypass hooks, use `--no-verify`, or skip checks to force a result.\n- Use TDD for behavior changes: reproduce or establish RED, implement the smallest coherent change, then reach GREEN.\n- Keep one logical change per commit. Do not mix unrelated refactors, fixes, and test rewrites.\n- Re-run the focused failing test after each fix before broad validation.\n- Preserve and report pre-existing failures honestly.\n- Parallel exploration is allowed, but do not concurrently edit the same command group; integrate final changes in one coherent pass.\n\nUser-facing commands and flags follow `experimental` -> `stable` -> `deprecated` -> `removed`. Do not delete stable behavior directly. Deprecations require warning text, transition tests, migration guidance, and a release-note entry.\n\n## Implementation invariants\n\n- Put command implementations in `internal/cli/<domain>` and register new top-level commands in `internal/cli/registry/registry.go`.\n- Set `UsageFunc: shared.DefaultUsageFunc` on command groups and subcommands.\n- Use `shared.ContextWithTimeout` or `shared.ContextWithUploadTimeout` for outbound HTTP.\n- Read and write repository-controlled or API-supplied paths through `internal/rootfs`, anchored to the operator-selected root for that command, instead of plain `os` file operations.\n- Validate required flags before side effects and assert stderr messages in tests.\n- Use `internal/cli/cmdtest` for CLI-level coverage and `httptest` for HTTP payload coverage.\n- Remove shared wrappers or helpers made obsolete by a refactor.\n\n## Build and validation\n\n```bash\nmake build\nmake format\nmake check-docs\nmake lint\nASC_BYPASS_KEYCHAIN=1 make test\nmake install-hooks\n```\n\nEvery manual test command must use `ASC_BYPASS_KEYCHAIN=1` to prevent host keychain prompts and profile bleed-through. The `make test` target enforces the same environment internally.\n\nBefore opening or merging a PR, run `make format`, `make check-docs`, `make lint`, and `ASC_BYPASS_KEYCHAIN=1 make test`. If command help changed, run `make generate-command-docs` and commit `docs/COMMANDS.md` before those checks. Run `make check-wall-of-apps` for Wall changes.\n\nDo not weaken CI: formatting, documentation, lint, and tests must run on PR and `main` workflows.\n\n## GitHub and issue guardrails\n\n- Inspect thread-aware GitHub review state before declaring a PR clean; flat comments do not prove every thread is resolved.\n- A PR is ready only when the latest head was reviewed, required checks pass, actionable threads are resolved, and GitHub reports it mergeable.\n- Fix-forward is the default for `$audit-asc-pr`; approval and merge still require explicit user intent.\n- Every newly created or triaged issue must end with exactly one type (`bug`, `enhancement`, `question`), one priority (`p0`-`p3`), and one difficulty (`easy`, `medium`, `hard`) label.\n\n## Authentication and live testing\n\nApp Store Connect API keys come from https://appstoreconnect.apple.com/access/integrations/api and must never be committed.\n\nTests touching auth must isolate relevant environment and config state. For live verification, prefer read-only calls. When mutation is necessary during PR audits, prefer disposable app `6759231657`, clean up temporary resources, and record anything left behind. Never mutate a non-disposable app without explicit approval.\n\n## Handoff contract\n\nFor substantial changes, explain the chosen approach, alternatives and trade-offs, expected invocations and outputs, compatibility impact, edge cases, failure modes, commands run, tests, live verification, commits or pushes, and unresolved risks.\n\n## References\n\n- Go standards: `docs/GO_STANDARDS.md`\n- Testing patterns: `docs/TESTING.md`\n- Git workflow and CLI structure: `docs/CONTRIBUTING.md`\n- API quirks: `docs/API_NOTES.md`\n- Development setup, PRs, labels, and Wall submissions: `CONTRIBUTING.md`\n","category":"root","tokens":1571}]}