release-pypi — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited release-pypi (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This repository publishes to PyPI from GitHub Releases. The workflow in .github/workflows/publish-pypi.yml only succeeds when:
release/* branchpyproject.toml version exactly, as v<version>pyproject.toml, existing tags, GitHub releases, and PyPI state.release/x.y.z from the intended base commit, usually main.pyproject.toml to x.y.z on that branch.vx.y.z from the release branch tip.vx.y.z with release/x.y.z as the target.publish-pypi.yml workflow starts and watch for success or failure.Use non-interactive commands.
Check state:
git status --short --branch
git tag --sort=-version:refname | head
sed -n '1,120p' pyproject.toml
gh release list --limit 10Cut branch and bump version:
git checkout -b release/1.1.2Edit pyproject.toml so:
version = "1.1.2"Commit and push:
git add pyproject.toml
git commit -m "chore: bump version to 1.1.2"
git push -u origin release/1.1.2
git tag v1.1.2
git push origin v1.1.2Create the GitHub Release:
gh release create v1.1.2 \
--target release/1.1.2 \
--title v1.1.2 \
--notes "Release v1.1.2"Check workflow status:
gh run list --workflow publish-pypi.yml --limit 5 \
--json databaseId,status,conclusion,headSha,displayTitle,event,createdAt,urlmain directly unless the user explicitly changes the repository policy.pyproject.toml.Read these files when needed:
.github/workflows/publish-pypi.ymldocs/RELEASE.mdpyproject.toml~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.