draft-release — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited draft-release (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are creating a new release for the mcp-grafana project. The user has provided a bump level: major, minor, or patch.
release/v* branch with a CHANGELOG.md update and opens a PRauto-tag.yml workflow automatically creates the git tagrelease.yml (goreleaser → GitHub Release + binaries) and docker.yml (Docker images + MCP Registry)Your job is step 1 only. Do NOT create tags manually.
git tag --sort=-version:refname | head -1vMAJOR.MINOR.PATCH and bump according to the argument:major → increment MAJOR, reset MINOR and PATCH to 0minor → increment MINOR, reset PATCH to 0patch → increment PATCHv<MAJOR>.<MINOR>.<PATCH> (e.g. v0.11.0). The previous tag is the "from" ref.git checkout main
git pull origin main
git checkout -b release/v<NEW_VERSION>Run:
git log <PREV_TAG>..HEAD --no-merges --format="%H %s"For each commit, categorize by its conventional commit prefix:
| Prefix | CHANGELOG Section |
|---|---|
feat | Added |
fix (security-related) | Security |
fix | Fixed |
refactor, perf | Changed |
BREAKING CHANGE or !: | Removed (or note as breaking in relevant section) |
Skip these commits entirely:
chore(deps) — dependency bumpschore commits that only touch CI config, GitHub Actions, or similardocs commits that only update README or non-user-facing docstest commits that only add/fix testsci commitsFor each significant commit:
git log <hash> -1 --format="%B"(#NNN) in the subject or a PR: line)git remote get-url origin → extract https://github.com/<org>/<repo>- Description of the change ([#NNN](https://github.com/<org>/<repo>/pull/NNN))If a commit lacks a PR number, omit the link.
The CHANGELOG follows Keep a Changelog format.
Read the existing file. Insert the new version section after the header block and before any existing version sections. Preserve all existing content below.
Create it with the full header.
# Changelog
All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
## [<NEW_VERSION_WITHOUT_V>] - <YYYY-MM-DD>
### Added
- Entry one ([#123](https://github.com/<org>/<repo>/pull/123))
- Entry two ([#456](https://github.com/<org>/<repo>/pull/456))
### Fixed
- Entry three ([#789](https://github.com/<org>/<repo>/pull/789))
### Changed
- Entry four ([#101](https://github.com/<org>/<repo>/pull/101))
### Security
- Entry five ([#102](https://github.com/<org>/<repo>/pull/102))
## [<PREV_VERSION_WITHOUT_V>] - <PREV_DATE>
...existing entries...
[<NEW_VERSION_WITHOUT_V>]: https://github.com/<org>/<repo>/compare/<PREV_TAG>...<NEW_TAG>
[<PREV_VERSION_WITHOUT_V>]: https://github.com/<org>/<repo>/compare/...Rules:
v prefix (e.g. [0.11.0])v prefix (e.g. v0.11.0)YYYY-MM-DD (use date +%Y-%m-%d)git add CHANGELOG.md
git commit -m "docs: add CHANGELOG.md for v<NEW_VERSION> release"git push -u origin release/v<NEW_VERSION>Create a PR with:
gh pr create --title "Release v<NEW_VERSION>" --body "$(cat <<'EOF'
## Summary
- Bump version to v<NEW_VERSION>
- Add CHANGELOG.md entries for this release
## Checklist
- [ ] CHANGELOG entries are accurate and complete
- [ ] Version number is correct
- [ ] All significant changes are documented
> [!NOTE]
> Merging this PR will automatically create the `v<NEW_VERSION>` tag,
> which triggers goreleaser (GitHub Release + binaries) and Docker image builds.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
EOF
)"Print a summary:
v<NEW_VERSION>release/v<NEW_VERSION>gh pr create output)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.