nodejs-npm-auto-release — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited nodejs-npm-auto-release (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Provide a repeatable workflow to prepare, verify, and ship npm packages with a combined auto-version-and-publish GitHub Action, plus local checks before push.
package.json{
"scripts": {
"release:patch": "npm version patch -m \"chore(release): v%s\"",
"release:minor": "npm version minor -m \"chore(release): v%s\"",
"release:major": "npm version major -m \"chore(release): v%s\""
}
}.npmignore to keep packages cleanTypical entries:
.github/.claude/docs/tests/.envnode_modules/Create .github/workflows/auto-version-publish.yml with:
name: auto version and publish
on:
push:
branches:
- main
permissions:
contents: write
id-token: write
jobs:
release:
if: ${{ !contains(github.event.head_commit.message, 'chore(release):') }}
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "18"
registry-url: "https://registry.npmjs.org"
- name: Install dependencies
run: |
npm ci
- name: Typecheck
run: |
npm run typecheck
- name: Test
run: |
npm test
- name: Configure git
run: |
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
- name: Bump patch version and tag
run: |
npm version patch -m "chore(release): v%s [skip ci]"
- name: Push version bump and tag
run: |
git push origin HEAD:main --follow-tags
- name: Publish
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
run: |
npm publish --access publicAdd NPM_TOKEN in repo Secrets with publish permission.
npm run typecheck
npm test
npm pack --dry-rungit add -A
git commit -m "feat: update package"
git push origin mainauto version and publish workflow succeedsnpm view <package-name> versionchore(release): to avoid loops.npm run release:patch then push tags.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.