release — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited release (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill automates the full release preparation workflow for the openroad-mcp project. It ensures every file that references the version gets updated consistently.
typescript/package.json .version fieldThe-OpenROAD-Project/openroad-mcpRead the current version from typescript/package.json:
jq -r '.version' typescript/package.jsonThen ask the user what the new version should be. Suggest the next logical semver bump based on the commits since the last release:
Show the suggestion but let the user decide.
Get the last release tag:
git tag --sort=-v:refname | head -5Then list all commits since that tag:
git log <last-tag>..HEAD --onelineIf no tag exists, use the first commit or the last "chore: release" commit:
git log --oneline --grep="chore: release" | head -1Read each commit message and sort into Keep a Changelog categories. Commits may use conventional prefixes or plain one-liner sentences — both are accepted:
| Category | Prefixed form | Plain form (keyword) |
|---|---|---|
| Added | feat: | sentence mentions "add", "new", "ship" |
| Changed | chore:, ci:, build:, refactor:, docs: | anything else |
| Fixed | fix: | sentence mentions "fix", "correct", "repair" |
For each commit, format the changelog entry as:
- Description ([#PR](https://github.com/The-OpenROAD-Project/openroad-mcp/pull/PR))Use the PR number from the commit message if present. For commits without a PR number, just use the description sentence.
These files must be updated with the new version. Update ALL of them — missing one breaks the release consistency.
typescript/package.json (+ lockfile) — the canonical version source:
npm version --prefix typescript --no-git-tag-version X.Y.ZThis updates package.json and package-lock.json together. The TypeScript server reads its advertised MCP version from package.json.
server.json — Update all version references:
"version": "X.Y.Z""version": "X.Y.Z""identifier": "ghcr.io/The-OpenROAD-Project/openroad-mcp:X.Y.Z"CHANGELOG.md — Add new section before the previous version's section. Today's date goes in the header. Add the link at the bottom:
[X.Y.Z]: https://github.com/The-OpenROAD-Project/openroad-mcp/releases/tag/vX.Y.ZRun the test suite to verify nothing is broken:
cd typescript && npm run testIf tests fail, report the failures to the user before proceeding. Do not commit a broken release.
Stage only the release-related files:
git add CHANGELOG.md server.json typescript/package.json typescript/package-lock.jsonCommit under the openroad-ci bot identity (public org member — required so the MCP Registry OIDC check passes when the release workflow runs):
git -c user.name="openroad-ci" \
-c user.email="[email protected]" \
commit -m "chore: release vX.Y.Z"Then push to a dedicated release branch and open a PR:
git checkout -b release/vX.Y.Z
git push -u origin release/vX.Y.Z
gh pr create \
--title "chore: release vX.Y.Z" \
--body "$(cat <<'EOF'
## Release vX.Y.Z
See [CHANGELOG.md](https://github.com/The-OpenROAD-Project/openroad-mcp/blob/release/vX.Y.Z/CHANGELOG.md) for full details.
/cc @vvbandeira — please review and merge when ready.
EOF
)" \
--reviewer vvbandeiraNEVER push directly to `main`. The decision to merge and tag belongs exclusively to @vvbandeira. Once the PR is open, report the PR URL to the user and stop — do not merge, squash, or tag.
Tagging is automated. When @vvbandeira squash-merges the release PR, theauto-tag.ymlworkflow detects thechore: release vX.Y.Zcommit message and pushes the tag asopenroad-ciusingOPENROAD_CI_PAT. This ensures the release workflow actor is a publicly visible org member, satisfying the MCP Registry OIDC check. No manual tagging needed.
release/vX.Y.Z branch and open a PR.with Contents: Read and write scope (and Pull requests write for Prepare Release). The auto-tag.yml / prepare-release.yml workflows use it to push the release branch/tag as openroad-ci, satisfying the MCP Registry org-membership check.
YYYY-MM-DDv prefix: v0.4.0 (but the version in files has no prefix) grep -r "OLD_VERSION" typescript/package.json typescript/package-lock.json server.json CHANGELOG.mdserver.json doesn't exist, skip it (some repos may not have it)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.