release-prep — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited release-prep (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A version bump is about to happen. The CI preflight enforces the mechanical facts — version match across pyproject.toml / server.json, server.json schema, and numeric counts of phases / MCP tools / detectors via scripts/check_doc_counts.py. CI cannot tell you whether the prose still matches reality. That's this skill's job.
Run this BEFORE creating the release commit and tag.
This skill is scoped to `packages/engine` — the Python engine + FastAPI shell, which is the only package with a semver release process today. The cockpit and api packages currently ship via docker image (no per-package tag); revisit this skill when that changes.
All commands and paths below are relative to `packages/engine/`. Run them from that directory, or prefix with (cd packages/engine && ...).
$ARGUMENTS is the target version, e.g. 0.2.2. If empty, read the version from pyproject.toml and ask the user whether that's the target.
Past releases shipped with stale facts (e.g. README claiming "17-phase pipeline" after we added phase 18, missing tool rows in the tool table). The CI count-check now catches numeric drift, but tool rows, descriptions, examples, and links rot quietly. A 5-minute editorial pass before tagging is cheaper than a docs-only patch release.
Find the previous release tag and the diff since:
PREV=$(git tag --sort=-creatordate | head -1)
echo "Previous release: $PREV"
git log --oneline "$PREV"..HEAD
git diff --stat "$PREV"..HEADIf $ARGUMENTS was empty, also confirm the target version with the user before proceeding.
uv run python scripts/check_doc_counts.pyIf it reports drift, fix the doc files it points to before going further. This check covers:
user-facing docs in DOC_FILES
src/dataraum/mcp/server.py
For each file below, skim the diff since `$PREV` for behavior changes that affect prose, then read the file and update anything that's now wrong.
Files to review (in order):
README.md — quick start commands, tool table descriptions, workflowexample, doc links, badges, install instructions
CHANGELOG.md — must have a section for $ARGUMENTS summarizing user-facingchanges (added / changed / removed / fixed). Don't list internal refactors.
docs/index.md — landing page claims and entry pointsdocs/pipeline.md — phase list and per-phase descriptions if phases wereadded/removed/renamed
docs/entropy.md — detector list, scores, thresholdsdocs/architecture.md — module diagram, tool count, data flowdocs/configuration.md — env vars, paths, contractsdocs/data-model.md — tables, schema fieldsdocs/contributing.md — module tree, dev commandsFor each: ask "what would surprise a new user who reads this against today's behavior?" — that's what to fix.
If the docs claim a CLI command exists, run --help on it. If they show a shell example, sanity-check that it parses (bash -n on snippets, or just read carefully). Tool descriptions in the README table should match the descriptions registered in src/dataraum/mcp/server.py at the spirit level (don't mechanically copy the multi-paragraph server description into the table — keep the README terse).
Confirm the version bump touches all three places (CI will enforce this on tag, but catching it now is cheaper than a failed release):
grep '^version = ' pyproject.toml
python -c 'import json; print(json.load(open("server.json"))["version"])'
python -c 'import json; print(json.load(open("server.json"))["packages"][0]["version"])'All three must equal $ARGUMENTS.
uv run python scripts/check_doc_counts.py
uv run pytest --testmon tests -qReport to the user:
needed product judgment)
Then stop. Do NOT create the release commit, tag, or PR yourself — the user does that. The skill ends with "ready for tagging".
summary so the user can decide whether to defer.
plans/ (gitignored), Confluence, or Jira from here.loudly in the summary — that's the most important thing this skill catches.
scripts/check_doc_counts.py exits non-zero after your edits, you arenot done.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.