skills/local/cali-releases/SKILL.md
--- name: cali-releases description: Create GitHub releases following project conventions. Triggers when: user says "release", "create release", "push release", "deploy to main", "merge to main", user merges a PR to main, or when git push to main is detected. Also triggers on mentions of: gh release, semver, version bump, changelog. Covers: versioning rules, release creation via gh CLI, tag management, and the mandatory release-on-merge convention. --- # Releases **Rule:** Any merge/push to `m
npx skillsauth add renatocaliari/agent-sync-public-skills skills/local/cali-releasesInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Rule: Any merge/push to main MUST include a GitHub release.
Do not wait to be asked — generate release automatically.
Read first: {project}/.pi/instructions.md (if exists)
| Section | What | When to consult | |---------|------|------------------| | Versioning Rules | Alpha/beta convention, version increments | Before creating any release | | Release Flow | 5-step process from checks to verification | On every merge to main | | Emergency Hotfix | Critical fix release process | When production is broken | | CI/CD Integration | ko build trigger on release | When project uses ko | | References | ko build pipeline details | When configuring builds |
| Rule | Example |
|------|---------|
| Use alpha/beta only | 0.2.0-alpha, 0.3.1-beta |
| NEVER 1.0.0 without owner confirmation | ❌ 1.0.0 → ✅ 0.9.0 |
| Increment patch for fixes | 0.2.0 → 0.2.1 |
| Increment minor for features | 0.2.0 → 0.3.0 |
| Increment major for breaking | 0.2.0 → 1.0.0 (with approval) |
# Run tests
npm run test # or: go test ./... / make test
# Run linter
npm run lint # or: golangci-lint run
# Check for uncommitted changes
git status
# Check current version
git tag --sort=-v:refname | head -5
# Or check package.json / go module version
# Create release (interactive — pick or type version)
gh release create
# Or explicit:
gh release create v0.X.Y-alpha \
--title "v0.X.Y-alpha: <summary>" \
--notes "## Changes
- Feature: description
- Fix: description
## Breaking Changes
- None (or list)
## Testing
- [ ] All tests pass
- [ ] Manual verification done"
git push origin v0.X.Y-alpha
# Check release appears
gh release list
# Check tag exists
git tag -l "v0.X.Y*"
## v0.X.Y-alpha
### What's Changed
- Feature: description (#PR)
- Fix: description (#PR)
### Breaking Changes
- None (or list)
### Testing
- [ ] Unit tests pass
- [ ] Integration tests pass
- [ ] Manual smoke test done
# 1. Create hotfix branch
git checkout -b hotfix/fix-critical main
# 2. Make fix, commit
git commit -m "fix: critical issue description"
# 3. Merge to main
git checkout main
git merge hotfix/fix-critical
# 4. Create release immediately
gh release create v0.X.Y-alpha \
--title "v0.X.Y-alpha: Hotfix - description" \
--notes "Critical fix for..."
# 5. Clean up
git branch -d hotfix/fix-critical
If project uses ko for builds, the release can trigger image builds:
# .github/workflows/deploy.yml (triggered on release)
on:
release:
types: [published]
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: ko-build/[email protected]
- run: ko build --platform=linux/amd64,linux/arm64 --bare ./cmd/web/
Input: "Just merged the auth feature to main"
Steps:
git tag --sort=-v:refname | head -3 → last tag was v0.2.0-alphagh release create v0.3.0-alpha --title "v0.3.0-alpha: Auth feature" --notes "..."git push origin v0.3.0-alphaOutput: "Released v0.3.0-alpha with auth feature. Tag pushed."
Input: "Production is down, critical bug in auth"
Steps:
git checkout -b hotfix/fix-auth-crash maingh release create v0.2.1-alpha --title "v0.2.1-alpha: Hotfix auth crash" --notes "..."Output: "Hotfix released v0.2.1-alpha. Production should recover."
Input: "What version should I use for this release?"
Steps:
git tag --sort=-v:refname | head -5git log v0.2.0-alpha..HEAD --oneline0.3.0-alpha. If feature: 0.2.1-alpha. If fix: 0.2.0.1-alphaOutput: "Based on 3 feature commits since v0.2.0-alpha, recommend v0.3.0-alpha."
go test ./... or npm testgit diff v0.X.Y-alpha..HEAD --statgh auth statusgh auth login (interactive)git tag -l "v0.X.Y*"references/ko-build.md — ko build pipeline referencedevelopment
PocketBase v0.39+ development - API rules, auth, collections, SDK, realtime, files, Go/JS extending, deployment, production tuning.
tools
Auto-initialize structured documentation for any project using lat.md (knowledge graph of markdown files with [[wiki links]], // @lat: code refs, and semantic search). Detects cali-product-workflow artifacts (spec-product.md, spec-tech.md, critiques) and uses them as seed material. Falls back to extracting business rules, architecture, and design decisions directly from the codebase. Use when a project lacks structured documentation or when lat.md/ is missing. After seeding, lat.md extension hooks keep documentation alive automatically.
testing
[Cali] Server security audit and hardening for private servers behind Tailscale. Use when: auditing server security, hardening SSH/firewall/Docker, checking for vulnerabilities, setting up fail2ban, reviewing port exposure, or responding to security alerts. Covers 6 layers: CloudFlare, UFW, Tailscale, SSH, Docker, Application. Triggers: "server security", "security audit", "harden server", "SSH hardening", "firewall rules", "UFW config", "fail2ban", "port security", "Docker security", "vulnerability check", "security review".
tools
Run supply chain security scans before installing packages or before releases. Triggers when: user installs a package (npm, pip, go get, brew), user asks to 'scan dependencies', 'check vulnerabilities', 'supply chain', 'security audit', 'run trivy', 'run socket', or before any release/deployment. Also triggers on mentions of: socket.dev, trivy, OSV-scanner, dotenvx, CVE, dependency audit. Covers all four tools with concrete commands.