gumroad-cli-release — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited gumroad-cli-release (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this only after the intended changes are merged to origin/main.
Do not use it to release from a feature branch, local HEAD, or an unmerged PR branch. The release workflow is tag-driven: push an annotated tag that points at the current origin/main commit.
Tags use Go-compatible date versioning:
v0.YYYYMMDD.NYYYYMMDD is the UTC release date.N starts at 0 and increments only for multiple releases on the same UTC date.v0.20260609.0 as 2026.06.09.v2026.06.09; it is not a valid Go module release shape for this repo.git status --short --branch
git remote -vgit fetch origin main --tagslatest_tag="$(git describe --tags --abbrev=0 origin/main)"
git log --oneline --first-parent "${latest_tag}..origin/main"
git rev-parse origin/mainIf there are no first-parent changes since latest_tag, stop and report that no new release is needed.
release_date="$(date -u +%Y%m%d)"
release_seq=0
tag="$(make release-tag RELEASE_DATE="$release_date" RELEASE_SEQ="$release_seq")"
while git rev-parse -q --verify "refs/tags/${tag}" >/dev/null ||
git ls-remote --exit-code --tags origin "${tag}" >/dev/null 2>&1; do
release_seq=$((release_seq + 1))
tag="$(make release-tag RELEASE_DATE="$release_date" RELEASE_SEQ="$release_seq")"
doneorigin/main explicitly:./script/validate-release-tag.sh "$tag"
git tag -a "$tag" origin/main -m "Release $tag"git push origin "refs/tags/${tag}"Never force-push or rewrite an existing release tag unless the user explicitly asks for a tag repair and understands the release artifact implications.
origin/main:main_sha="$(git rev-parse origin/main)"
local_tag_sha="$(git rev-parse "${tag}^{}")"
remote_tag_sha="$(git ls-remote --tags origin "${tag}^{}" | awk '{print $1}')"
test "$main_sha" = "$local_tag_sha"
test "$main_sha" = "$remote_tag_sha"gh run list --workflow Release --event push --limit 5
gh release view "$tag" --json tagName,name,isDraft,isPrerelease,publishedAt,urlIf the workflow is still running, watch the relevant run:
gh run watch <run-id>Report:
If Homebrew publishing is part of the workflow result, verify it from the workflow logs or the antiwork/homebrew-cli update before calling the release complete.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.