jrmatherly/release-and-publish
.claude/skills/release-and-publish/SKILL.md
Bump version, tag, push, wait for CI build, and publish the GitHub release in one step
development
Updated Apr 16, 2026
$ install --global
skillsauthnpx skillsauth add jrmatherly/1dev release-and-publishInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 16, 2026, 2:21 PM5.3s1 file scanned
SKILL.md
- name:
- release-and-publish
- description:
- Bump version, tag, push, wait for CI build, and publish the GitHub release in one step
- disable-model-invocation:
- true
Release and Publish
Full release pipeline: version bump, commit, tag, push, wait for CI, and publish.
Usage
/release-and-publish
/release-and-publish minor
Default is patch. Pass minor or major as argument.
Steps
-
Pre-flight checks:
- Working tree must be clean (
git status --shortempty) - All quality gates must pass (
ts:check,test,build) - Current branch must be
main
- Working tree must be clean (
-
Version bump:
npm version <patch|minor|major> --no-git-tag-version -
Commit + annotated tag + push:
git add package.json bun.lock git commit -m "chore: bump version to v<VERSION>" git tag -a v<VERSION> -m "v<VERSION>" git push origin main v<VERSION> -
Verify workflow fired:
git ls-remote --tags origin v<VERSION> gh run list --workflow=release.yml --limit 1 -
Wait for build (~17 min):
gh run watch <run-id> --exit-status -
Publish the draft release:
gh release edit v<VERSION> --draft=false -
Report the release URL.
Important Notes
- The release workflow uses a shared concurrency group with cancel-in-progress — triggering a new release cancels any in-progress older build.
- Releases are created as drafts by the workflow. The publish step makes them visible.
- Unsigned builds — macOS users need
xattr -rd com.apple.quarantine /Applications/1Code.app. - If GitHub secrets
ENTRA_CLIENT_IDandENTRA_TENANT_IDare not set, enterprise auth will not work in the packaged build. - See
docs/operations/release.mdfor the full runbook.
Related Skills
jrmatherly/verify-strategy-compliance
development
VerifiedTrustedCommunity
Background knowledge for AI agents before editing any file that handles authentication tokens or spawn environment variables in the 1Code enterprise fork. Triggers when touching src/main/lib/trpc/routers/claude.ts, claude-code.ts, claude/env.ts, feature-flags.ts, or claude-token.ts. Reminds the agent to consult the frozen Envoy Gateway strategy doc (auth-strategy-envoy-gateway.md v2.1) sections that impose hard rules on credential handling.
SKILL.mdUpdated Apr 16, 2026
jrmatherly/verify-pin
tools
VerifiedTrustedCommunity
Background knowledge for safely bumping the pinned versions of Claude CLI binary, Codex CLI binary, Electron, Vite, Tailwind, or Shiki in this repo. Each pin is load-bearing for a different reason — this skill encodes the per-pin rationale and the regression test that must pass before the bump can land. Use proactively whenever editing package.json, scripts/download-claude-binary.mjs, scripts/download-codex-binary.mjs, or any file that mentions these versions. Claude-only (background knowledge, not user-invocable).
SKILL.mdUpdated Apr 16, 2026
jrmatherly/upstream-boundary-check
development
VerifiedTrustedCommunity
Use when reading or writing any file under src/renderer/ that calls remoteTrpc.* or fetch(${apiUrl}/...). Verifies the call site is documented in docs/enterprise/upstream-features.md and warns if a new upstream-backend dependency is being introduced without a corresponding F-entry. This skill enforces the enterprise-fork posture documented in CLAUDE.md.
SKILL.mdUpdated Apr 16, 2026
jrmatherly/session-sync
development
VerifiedTrustedCommunity
End-of-task sync — update CLAUDE.md, rebuild code graph, sync Serena memories, check roadmap drift, and commit. Run after completing any significant work to ensure all drift surfaces are current.
SKILL.mdUpdated Apr 16, 2026