wix-app: one SDK lookup call per feature, with the call shape

.github/actions/evalforge-skill-gate/README.md

@@ -239,11 +239,12 @@ Changed paths are classified in a **fixed precedence, first match wins**:
 
 | # | Changed path | Result |
 |---|---|---|
-| 1 | matches `ignore-globs` | ignored, silently |
-| 2 | matches `broad-impact-globs` | **broad impact** → the whole suite is in play |
-| 3 | `<reference-dir>/DASHBOARD_PAGE.md` | tag `dashboard-page` — lowercase, `_` → `-`, drop `.md` |
-| 4 | `<reference-dir>/dashboard-page/API_SPEC.md` | tag `dashboard-page` — the directory name is already the tag |
-| 5 | any other file under `skill-dir` | **unmapped** — warned about, triggers nothing |
+| 1 | matches a `tag-globs` glob | the tags that line names — a script the skill tells the agent to run, inside an ignored directory |
+| 2 | matches `ignore-globs` | ignored, silently |
+| 3 | matches `broad-impact-globs` | **broad impact** → the whole suite is in play |
+| 4 | `<reference-dir>/DASHBOARD_PAGE.md` | tag `dashboard-page` — lowercase, `_` → `-`, drop `.md` |
+| 5 | `<reference-dir>/dashboard-page/API_SPEC.md` | tag `dashboard-page` — the directory name is already the tag |
+| 6 | any other file under `skill-dir` | **unmapped** — warned about, triggers nothing |
 | — | the scenario glob | no tag; changed scenarios are included in the run directly |
 | — | anything else | ignored |
 
@@ -294,6 +295,7 @@ capability version, no run — so a coverage failure reports in seconds and cost
 | `reference-dir` | `gate` | `references` | Relative to `skill-dir` |
 | `ignore-globs` | `gate` | `scripts/**` | Newline-separated, relative to `skill-dir` |
 | `broad-impact-globs` | `gate` | `SKILL.md` + the six cross-cutting references | Newline-separated, relative to `skill-dir` |
+| `tag-globs` | `gate` | none | Newline-separated `glob: tag[, tag]`, relative to `skill-dir`; checked before `ignore-globs` |
 | `max-scenarios` | `gate` | `25` | Touched scenarios kept first; anything cut is named in the comment |
 | `runs-per-scenario` | `gate` | `1` | Max `20`. Each scenario repeats this many times **per arm**, so an intermittent failure is visible instead of indistinguishable from a regression — at proportional cost. An intermittent failure counts as a failure |
 | `base-arm-grace-seconds` | `gate` | `60` | Max `300`. `0` means "don't wait for the base arm at all". Window the base arm gets after the PR arm completes before its poll is cancelled. Exceeding it degrades the comment to "attribution unavailable" without affecting the verdict — the base eval run itself still completes server-side either way |

.github/actions/evalforge-skill-gate/action.yml

@@ -47,6 +47,10 @@ inputs:
     required: false
     default: |
       scripts/**
+  tag-globs:
+    description: 'Newline-separated "glob: tag[, tag]" lines, relative to skill-dir. A changed file that matches derives those tags; checked before ignore-globs, so it can name a script under scripts/'
+    required: false
+    default: ''
   broad-impact-globs:
     description: 'Newline-separated globs, relative to skill-dir, whose changes put the whole suite in play. These derive no tag of their own and are never coverage-checked'
     required: false

.github/actions/evalforge-skill-gate/src/utils/config.ts

@@ -4,7 +4,7 @@ import * as github from '@actions/github';
 import {
   DEFAULT_BASE_ARM_GRACE_SECONDS, DEFAULT_BROAD_IMPACT_GLOBS, DEFAULT_IGNORE_GLOBS, DEFAULT_MAX_SCENARIOS,
   DEFAULT_REFERENCE_DIR, DEFAULT_RUNS_PER_SCENARIO, ensureHttps, safeGetSecret, getPrNumber,
-  readHeadRepoFullName,
+  parseTagGlobs, readHeadRepoFullName, type TagGlob,
 } from '@wix/evalforge-core';
 
 /** Subdirectory the base-SHA checkout lands in, matching the yaml-gate workflows. */
@@ -77,6 +77,7 @@ export type GateConfig = {
   referenceDir: string;
   ignoreGlobs: string[];
   broadImpactGlobs: string[];
+  tagGlobs: TagGlob[];
   maxScenarios: number;
   /** The action input stays `blocking` — that name is the public contract and reads right in YAML. */
   isBlocking: boolean;
@@ -266,6 +267,7 @@ export function getGateConfig(): GateConfig {
     referenceDir: core.getInput('reference-dir') || DEFAULT_REFERENCE_DIR,
     ignoreGlobs: getMultilineList('ignore-globs', DEFAULT_IGNORE_GLOBS),
     broadImpactGlobs: getMultilineList('broad-impact-globs', DEFAULT_BROAD_IMPACT_GLOBS),
+    tagGlobs: parseTagGlobs(getMultilineList('tag-globs', [])),
     maxScenarios,
     isBlocking: core.getInput('blocking') === 'true',
     owner,

.github/actions/evalforge-skill-gate/src/utils/gate-scope.ts

@@ -83,6 +83,7 @@ function deriveChangeScope(
     referenceDir: config.referenceDir,
     ignoreGlobs: config.ignoreGlobs,
     broadImpactGlobs: config.broadImpactGlobs,
+    tagGlobs: config.tagGlobs,
   });
   const touchedPaths = new Set(touchedScenarioPaths(
     changedFiles.map(file => ({ path: file.filename, status: file.status })),

.github/actions/evalforge-skill-gate/tests/action-yml.test.ts

@@ -26,7 +26,7 @@ describe('action.yml', () => {
       'mode', 'github-token', 'evalforge-url', 'evalforge-project-id',
       'evalforge-app-id', 'evalforge-app-secret', 'evals-glob',
       'capability-id', 'agent-id', 'skill-dir', 'reference-dir',
-      'ignore-globs', 'broad-impact-globs', 'max-scenarios', 'blocking', 'runs-per-scenario',
+      'ignore-globs', 'broad-impact-globs', 'tag-globs', 'max-scenarios', 'blocking', 'runs-per-scenario',
       'base-arm-grace-seconds', 'eval-run-id',
     ]) {
       expect(Object.keys(action.inputs), name).toContain(name);

.github/actions/evalforge-skill-gate/tests/comparison-arms.test.ts

@@ -20,6 +20,7 @@ const CONFIG: GateConfig = {
   referenceDir: 'references',
   ignoreGlobs: ['scripts/**'],
   broadImpactGlobs: ['SKILL.md'],
+  tagGlobs: [],
   maxScenarios: 25,
   isBlocking: true,
   owner: 'wix',

.github/actions/evalforge-skill-gate/tests/config.test.ts

@@ -104,6 +104,24 @@ describe('getGateConfig', () => {
     expect(getGateConfig().broadImpactGlobs).toEqual(['SKILL.md', 'docs/README.md']);
   });
 
+  it('parses tag-globs lines into a glob and its tags', async () => {
+    setInputs({ ...REQUIRED_GATE_INPUTS, 'tag-globs': 'scripts/sdk-lookup.cjs: sdk-module-map, dashboard-page\n' });
+    const { getGateConfig } = await import('../src/utils/config');
+    expect(getGateConfig().tagGlobs).toEqual([{ glob: 'scripts/sdk-lookup.cjs', tags: ['sdk-module-map', 'dashboard-page'] }]);
+  });
+
+  it('defaults tag-globs to none', async () => {
+    setInputs(REQUIRED_GATE_INPUTS);
+    const { getGateConfig } = await import('../src/utils/config');
+    expect(getGateConfig().tagGlobs).toEqual([]);
+  });
+
+  it('rejects a tag-globs line with no tag', async () => {
+    setInputs({ ...REQUIRED_GATE_INPUTS, 'tag-globs': 'scripts/sdk-lookup.cjs' });
+    const { getGateConfig } = await import('../src/utils/config');
+    expect(() => getGateConfig()).toThrow(/tag-globs line must be/);
+  });
+
   it('treats blocking: true as blocking and anything else as soaking', async () => {
     setInputs({ ...REQUIRED_GATE_INPUTS, blocking: 'true' });
     const { getGateConfig } = await import('../src/utils/config');

.github/actions/evalforge-skill-gate/tests/gate-run.test.ts

@@ -63,6 +63,7 @@ const CONFIG: GateConfig = {
   referenceDir: 'references',
   ignoreGlobs: ['scripts/**'],
   broadImpactGlobs: ['SKILL.md'],
+  tagGlobs: [],
   maxScenarios: 25,
   isBlocking: true,
   owner: 'wix',

.github/actions/evalforge-skill-gate/tests/run-and-report.test.ts

@@ -34,6 +34,7 @@ const CONFIG: GateConfig = {
   referenceDir: 'references',
   ignoreGlobs: ['scripts/**'],
   broadImpactGlobs: ['SKILL.md'],
+  tagGlobs: [],
   maxScenarios: 25,
   isBlocking: true,
   owner: 'wix',

.github/workflows/ci.yml

@@ -56,8 +56,9 @@ jobs:
           match() { echo "$changed" | grep -qE "$1"; }
 
           # The wix-app harness itself is included: a change to extract.mjs or its deps can
-          # break the typecheck just as a reference-doc change can.
-          if match '^skills/wix-app/|^\.github/wix-app-typecheck/'; then
+          # break the typecheck just as a reference-doc change can. So is the sdk-lookup
+          # test and its fixtures, which test a wix-app script.
+          if match '^skills/wix-app/|^\.github/wix-app-typecheck/|^scripts/test-sdk-lookup\.cjs$|^scripts/fixtures/sdk-lookup/'; then
             echo "wix_app=true" >> "$GITHUB_OUTPUT"
           else
             echo "wix_app=false" >> "$GITHUB_OUTPUT"
@@ -272,9 +273,21 @@ jobs:
             exit 1
           fi
 
+      # The skill's scripts ship without a build or an eval of their own (derive-tags
+      # gives scripts/** no tag), so this is what catches a broken sdk-lookup.cjs.
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
+        if: ${{ needs.detect.outputs.wix_app == 'true' }}
+        with:
+          node-version: '22'
+
+      - name: wix-app — sdk-lookup tests
+        if: ${{ needs.detect.outputs.wix_app == 'true' }}
+        run: node --test scripts/test-sdk-lookup.cjs
+
       - name: Summary
         run: |
           echo "evalforge: ${{ needs.detect.outputs.evalforge }}"
-          if [ "${{ needs.detect.outputs.evalforge }}" = "false" ]; then
+          echo "wix-app sdk-lookup: ${{ needs.detect.outputs.wix_app }}"
+          if [ "${{ needs.detect.outputs.evalforge }}" = "false" ] && [ "${{ needs.detect.outputs.wix_app }}" = "false" ]; then
             echo "No tested areas changed — nothing to do."
           fi

.github/workflows/evalforge-wix-app-gate.yml

@@ -102,6 +102,11 @@ jobs:
           evalforge-app-secret: ${{ secrets.AUTO_SKILLS_PIPELINE_APP_SECRET }}
           evals-glob: 'yaml/wix-app-evals/**/*.{yml,yaml}'
           skill-dir: skills/wix-app
+          # SKILL.md tells the agent to trust the SDK lookup over the typings, so a change to it
+          # runs the scenarios that call it rather than nothing (scripts/** is ignored).
+          tag-globs: |
+            scripts/sdk-lookup.cjs: sdk-module-map, dashboard-page
+            scripts/sdk-curated.json: sdk-module-map, dashboard-page
           # Inline rather than repo vars: neither is a secret, and in the workflow file they
           # appear in the diff, get reviewed when they change, and document what the gate
           # evaluates against. As repo vars they could be edited silently.