ca-release — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ca-release (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
patch, minor, or major release of containerization-assistCHANGELOG.md with changes since the last tagpackage.json, package-lock.json, and server.jsonCreate a branch named release-<next-version> from main:
git checkout main && git pull
git checkout -b release-<next-version>Get all commits since the last version tag:
git log --oneline <last-tag>..HEADThe tag format used in this repo is bare semver (e.g. 1.4.0, not v1.4.0).
Group the commits into categories for the changelog:
feat: prefixed or meaningful capability additionsfix: prefixed commitsbuild(deps): / build(deps-dev): bumps — list PR numbers together on one linePrepend a new ## [<next-version>] section at the top of CHANGELOG.md, following the established format:
## [1.4.1]
- feat: database detection + AKS workload identity support (#630)
- add AKS-loop pre-deployment checks (#664)
- fix: add static redirect pages for VS Code MCP install links (#668, #669)
- fix(scan): treat scanType "all" as vulnerability scan (#665)
- dependency updates (#657, #662, #663, #666)Rules:
Run npm version with --no-git-tag-version (so no commit or tag is created — those are managed manually). The postversion lifecycle hook automatically syncs server.json:
npm version patch --no-git-tag-version # x.y.Z
npm version minor --no-git-tag-version # x.Y.0
npm version major --no-git-tag-version # X.0.0This updates three files:
| File | Field(s) updated |
|---|---|
package.json | version |
package-lock.json | version |
server.json | .version and .packages[0].version (via postversion hook) |
Confirm all three files reflect the new version:
node -e "const p=require('./package.json'); const s=require('./server.json'); console.log('pkg:', p.version, 'server:', s.version, s.packages[0].version)"All three values must match.
git add package.json package-lock.json server.json CHANGELOG.md
git commit -m "prepare for release <next-version>"
git push origin release-<next-version>Then open a PR from the release branch into main.
| File | Role |
|---|---|
| scripts/postversion.ts | npm postversion hook — syncs server.json after npm version runs |
| CHANGELOG.md | Human-readable release notes |
package.json | Canonical version source |
server.json | MCP registry manifest — must stay in sync |
1.4.0, not v1.4.0) — use this form in git commands--no-git-tag-version to npm version; git commits and tags are managed manuallypostversion npm lifecycle hook runs automatically and updates server.json — no separate step needed~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.