wp-plugin-release — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited wp-plugin-release (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Model note: Mechanical file edits — works well on haiku. No reasoning across ambiguous code; all sources are explicit (header, constant, readme.txt, changelog).Bump a WP plugin version coherently. Prevents the classic drift where the plugin header says one version, the readme.txt Stable tag another, and the .pot a third.
Not for: WP.org SVN deploy (trunk/tags/assets push) — use wp-org-submission. First-time plugin submission to the WP.org directory — use wp-org-submission.
git tag # any release tags?
gh release list # any published releases?
grep -n "Version:" *.php # plugin header
grep -n "_VERSION'" *.php # version constant
grep -n "Stable tag" readme.txtIf header/constant/Stable-tag disagree, that drift IS the problem — pick the target version and sync all of them. Choose the bump by semver: new backward-compatible features → minor; fixes only → patch; breaking → major. Internal-only refactors (dir rename) don't force a major.
* Version: X.Y.Z (main plugin file).define( 'PLUGIN_VERSION', 'X.Y.Z' ).Tested up to / Requires PHP if they changed.= X.Y.Z = block listing what shipped (security, features, fixes), grouped.= X.Y.Z = one-liner (why upgrade).Project-Id-Version matches and new strings are captured: composer makepot # or: wp i18n make-pot . languages/<slug>.pot --exclude=...LicenseModel::$db_version) — independent of plugin version. Only bump when the table actually changed, since it gates data migrations.composer lint && composer analyze && composer test
grep -rn "X\.Y\.Z\|<old version>" --include=*.php --include=readme.txt . # confirm sync, spot stragglersThen commit (docs:/chore: for a pure version+readme bump), and ship via the repo's contribution flow (branch → PR → merge; never squash if the repo says so).
references/readme-txt-skeleton.txt — full WP.org readme.txt skeleton (all sections) with the release-sync checklist of every version source baked in as a trailing comment.references/release-checklist.md — pre-release checklist: code, version sync, changelog, zip hygiene, and post-release verification stepsreferences/svn-deploy.md — SVN deploy workflow: initial checkout, trunk update, assets directory, tagging a release, and Stable tag mechanics~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.