release — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited release (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Automates the CalVer release procedure defined in .claude/rules/git.md (§ Releases).
This skill exists for the parts that are tedious to run by hand: version auto-increment, CI polling, and post-release verification. Conventions (branch names, commit format, pre-flight checks) live in the rule — read it first.
REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner)
TODAY=$(date '+%Y.%-m.%-d')
if ! git tag --list "$TODAY" | grep -q .; then
VERSION="$TODAY"
else
LAST_N=$(git tag --list "${TODAY}-*" --sort=-v:refname | head -1 | grep -oP '\d+$' || echo "1")
VERSION="${TODAY}-$((LAST_N + 1))"
fi
echo "Repo: $REPO · Version: $VERSION"Follow the pre-flight checklist in .claude/rules/git.md § Releases (clean tree on the intended source branch).
If --dry-run, report version + pre-flight results and stop here.
[Unreleased]Abort if ## [Unreleased] has no real entries (only category headers / blank lines):
UNRELEASED_BODY=$(awk '
/^## \[Unreleased\]/ { in_block=1; next }
in_block && (/^## \[/ || /^---$/) { exit }
in_block { print }
' CHANGELOG.md | grep -vE '^(### |\s*$)')
if [ -z "$UNRELEASED_BODY" ]; then
echo "Aborting: [Unreleased] is empty — nothing user-visible to release." >&2
echo "Add changelog entries on this branch (or confirm with the user before continuing)." >&2
exit 1
fiPromote [Unreleased] to [$VERSION] and re-seed an empty block above it, then commit on the current branch before cutting the release branch:
RELEASE_DATE=$(date '+%Y-%m-%d')
awk -v ver="$VERSION" -v rdate="$RELEASE_DATE" '
/^## \[Unreleased\]$/ && !done {
print "## [Unreleased]"
print ""
print "### Added"
print "### Changed"
print "### Fixed"
print "### Removed"
print "### Deprecated"
print "### Security"
print ""
print "## [" ver "] - " rdate
done=1
next
}
{ print }
' CHANGELOG.md > CHANGELOG.md.tmp && mv CHANGELOG.md.tmp CHANGELOG.md
git add CHANGELOG.md
git commit -m "task: promote CHANGELOG for $VERSION"The [$VERSION] section is the source of truth for the GitHub Release body — release.yml extracts it via body_path (no generate_release_notes).
PREV_BRANCH=$(git branch --show-current)
git checkout -b "release/$VERSION"
git push origin "release/$VERSION"
git tag "$VERSION" && git push origin "$VERSION" # triggers release.ymlsleep 10
RUN_ID=$(gh api "repos/$REPO/actions/runs?branch=${VERSION}&per_page=1" \
--jq '.workflow_runs[0].id')
for i in $(seq 1 40); do
STATUS=$(gh api "repos/$REPO/actions/runs/$RUN_ID" --jq '.status')
if [ "$STATUS" = "completed" ]; then
CONCLUSION=$(gh api "repos/$REPO/actions/runs/$RUN_ID" --jq '.conclusion')
echo "Release workflow: $CONCLUSION"
break
fi
echo "Still running... ($i/40)"
sleep 15
donegh release view "$VERSION" --repo "$REPO"
gh api "users/${REPO%%/*}/packages/container/${REPO##*/}/versions" \
--jq '.[0] | {tags: .metadata.container.tags, created: .created_at}'git checkout "$PREV_BRANCH"Release $VERSION complete!
Repo: $REPO
Tag: $VERSION
Branch: release/$VERSION
Image: ghcr.io/$REPO:$VERSION
Release: https://github.com/$REPO/releases/tag/$VERSION
CI: <pass/fail with run URL>If CI failed, include failure details and suggest fixes.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.