release — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited release (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Bump version, tag, and publish to PyPI via the existing GitHub Actions workflow.
<version> — explicit version (e.g. 0.4.0). Optional.major / minor / patch — bump type. Optional.If no explicit version given, auto-detect from commit history:
# Find last tag
LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
# Get commits since last tag (or all commits if no tag)
if [ -n "$LAST_TAG" ]; then
COMMITS=$(git log "$LAST_TAG"..HEAD --oneline)
else
COMMITS=$(git log --oneline)
fiScan commit messages for the highest bump level:
| Pattern | Bump |
|---|---|
feat!: or BREAKING CHANGE: in body | MAJOR |
feat: or feat(scope): | MINOR |
fix:, perf:, ref:, docs:, chore:, build:, ci:, test:, style: | PATCH |
Rules:
pyproject.toml: grep '^version' pyproject.tomlShow the user: commit summary, detected bump level, and proposed version. Wait for confirmation before proceeding.
main branch: git branch --show-currentgit status --short (ignore .claude/settings.json)v<version> does not already exist: git tag -l v<version>gh run list --branch main --workflow ci.yml --limit 1 --json conclusion --jq '.[0].conclusion'If any check fails, stop and explain why.
Update the version string in two files:
# pyproject.toml — version = "X.Y.Z"
# src/distill_mcp/__init__.py — __version__ = "X.Y.Z"Use the Edit tool (not sed) to replace the old version with the new one.
git add pyproject.toml src/distill_mcp/__init__.py
git commit -m "chore: bump version to <version>"
git tag v<version>git push origin main
git push origin v<version>gh release create v<version> --title "v<version>" --generate-notesThis triggers .github/workflows/publish.yml which builds and publishes to PyPI via trusted publishing.
Wait for the publish workflow to complete:
gh run list --workflow=publish.yml --limit 1Report the PyPI URL: https://pypi.org/project/distill-mcp/<version>/
main. The no-commit-to-branch pre-commit hook must be bypassed for version bumps. Use git commit --no-verify for the version bump commit only.main after all PRs are merged.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.