draft-release — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited draft-release (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are creating a new release for the mcp-grafana project. The user has provided a bump level: major, minor, or patch.
release/v* branch with a CHANGELOG.md update and opens a PRauto-tag.yml workflow automatically creates the git tagrelease.yml (goreleaser → GitHub Release + binaries) and docker.yml (Docker images + MCP Registry)Your job is step 1 only. Do NOT create tags manually.
git tag --sort=-version:refname | head -1vMAJOR.MINOR.PATCH and bump according to the argument:major → increment MAJOR, reset MINOR and PATCH to 0minor → increment MINOR, reset PATCH to 0patch → increment PATCHv<MAJOR>.<MINOR>.<PATCH> (e.g. v0.11.0). The previous tag is the "from" ref.git checkout main
git pull origin main
git checkout -b release/v<NEW_VERSION>Run:
git log <PREV_TAG>..HEAD --no-merges --format="%H %s"For each commit, categorize by its conventional commit prefix:
| Prefix | CHANGELOG Section |
|---|---|
feat | Added |
fix (security-related) | Security |
fix | Fixed |
refactor, perf | Changed |
BREAKING CHANGE or !: | Removed (or note as breaking in relevant section) |
Skip these commits entirely:
chore(deps) — dependency bumpschore commits that only touch CI config, GitHub Actions, or similardocs commits that only update README or non-user-facing docstest commits that only add/fix testsci commitsFor each significant commit:
git log <hash> -1 --format="%B"(#NNN) in the subject or a PR: line)git remote get-url origin → extract https://github.com/<org>/<repo>- Description of the change ([#NNN](https://github.com/<org>/<repo>/pull/NNN))If a commit lacks a PR number, omit the link.
The CHANGELOG follows Keep a Changelog format.
Read the existing file. Insert the new version section after the header block and before any existing version sections. Preserve all existing content below.
Create it with the full header.
# Changelog
All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
## [<NEW_VERSION_WITHOUT_V>] - <YYYY-MM-DD>
### Added
- Entry one ([#123](https://github.com/<org>/<repo>/pull/123))
- Entry two ([#456](https://github.com/<org>/<repo>/pull/456))
### Fixed
- Entry three ([#789](https://github.com/<org>/<repo>/pull/789))
### Changed
- Entry four ([#101](https://github.com/<org>/<repo>/pull/101))
### Security
- Entry five ([#102](https://github.com/<org>/<repo>/pull/102))
## [<PREV_VERSION_WITHOUT_V>] - <PREV_DATE>
...existing entries...
[<NEW_VERSION_WITHOUT_V>]: https://github.com/<org>/<repo>/compare/<PREV_TAG>...<NEW_TAG>
[<PREV_VERSION_WITHOUT_V>]: https://github.com/<org>/<repo>/compare/...Rules:
v prefix (e.g. [0.11.0])v prefix (e.g. v0.11.0)YYYY-MM-DD (use date +%Y-%m-%d)For every major release, or minor release containing breaking changes, prepare customer communications:
Identify the required entries by inspecting the source PRs and compatibility changes, not just the commit prefixes or the CHANGELOG you just wrote. Reuse existing contributions where appropriate.
Read the relevant upstream skill and its required references, using gh to retrieve them if they are not installed. Follow their content and formatting guidance, but override their advance-notice timing: prepare the content during the release, without requiring a 2–4 week lead time or delaying the release to create one. Describe the actual release timing; do not present an already available change as upcoming.
Include affected users, exact before/after behaviour, and concrete migration instructions for breaking changes. Verify CMS metadata rather than treating an mcp-grafana version as a Grafana self-managed release version.
Do not commit the drafts to the release branch.
git add CHANGELOG.md
git commit -m "docs: add CHANGELOG.md for v<NEW_VERSION> release"git push -u origin release/v<NEW_VERSION>Create a PR with:
gh pr create --title "Release v<NEW_VERSION>" --body "$(cat <<'EOF'
## Summary
- Bump version to v<NEW_VERSION>
- Add CHANGELOG.md entries for this release
## Checklist
- [ ] CHANGELOG entries are accurate and complete
- [ ] Version number is correct
- [ ] All significant changes are documented
> [!NOTE]
> Merging this PR will automatically create the `v<NEW_VERSION>` tag,
> which triggers goreleaser (GitHub Release + binaries) and Docker image builds.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
EOF
)"Print a summary:
v<NEW_VERSION>release/v<NEW_VERSION>gh pr create output)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.