release-readiness — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited release-readiness (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Most developer teams do not cut formal releases — they merge to main and deploy. A pre-release checklist that assumes git tags, a VERSION file, and a CHANGELOG is useless to them. This skill detects which workflow the project actually uses, then runs the right checklist: a lightweight pre-merge gate for continuous deployment teams, or a full release gate for teams that tag and version.
Run these in parallel:
# Does the repo use formal versioning?
cat VERSION 2>/dev/null
cat package.json 2>/dev/null | grep '"version"'
cat pyproject.toml 2>/dev/null | grep '^version'
cat Cargo.toml 2>/dev/null | grep '^version'
# Does the repo use git tags?
git describe --tags --abbrev=0 2>/dev/null || echo "(no tags)"
git tag --list | tail -5
# CHANGELOG location
ls CHANGELOG.md CHANGELOG HISTORY.md RELEASES.md 2>/dev/nullClassify the repo into one of two modes:
| Mode | Signal | Checklist to run |
|---|---|---|
| Formal release | Has git tags AND a version file (VERSION, package.json version, etc.) | Full release gate (Gates 1–8) |
| Continuous deployment | No git tags, or tags are sporadic/auto-generated (e.g. SHA-based), no dedicated version file | Pre-merge gate (Gates 3, 5, 7, 8 only) |
State the detected mode at the top of the report. If ambiguous, ask: "Does this project cut versioned releases with git tags, or does it deploy continuously from main?"
Skip version and CHANGELOG gates entirely. Run only:
Report with the header: ## Pre-Merge Readiness — <branch-name> instead of a version number.
Evaluate each gate below. Mark each PASS, FAIL, or SKIP (with reason).
Ask the user: "What version are you releasing?" if it cannot be determined from the version file.
#### Gate 1 — Version is bumped
#### Gate 2 — CHANGELOG entry exists for this version
CHANGELOG.md (or equivalent).## [1.4.0] or ## 1.4.0).write-changelog skill).#### Gate 3 — No debug code in the diff
Use the last tag as the diff base in formal release mode; use the base branch (main/master) in CD mode.
# Formal release mode
git diff $(git describe --tags --abbrev=0 2>/dev/null)..HEAD -- '*.js' '*.ts' '*.py' '*.go' '*.rb' '*.java' | grep -E "^\+" | grep -iE "console\.log|print\(|debugger|breakpoint\(\)|pdb\.set_trace|binding\.pry|TODO.*release|FIXME.*release|DO NOT MERGE|fmt\.Println"
# CD mode
git diff main..HEAD -- '*.js' '*.ts' '*.py' '*.go' '*.rb' '*.java' | grep -E "^\+" | grep -iE "console\.log|print\(|debugger|breakpoint\(\)|pdb\.set_trace|binding\.pry|DO NOT MERGE|fmt\.Println"console.error or console.warn — those are legitimate.#### Gate 4 — Feature flags cleaned up
Detect feature flag patterns in the diff since last tag:
git diff $(git describe --tags --abbrev=0 2>/dev/null)..HEAD | grep -iE "feature_flag|featureFlag|isEnabled|launch_darkly|unleash|flipper|FEATURE_" | grep "^\+"#### Gate 5 — Migration notes written (if applicable)
Check whether the diff includes database migrations, API breaking changes, or config changes:
# Formal release mode (diff from last tag)
git diff $(git describe --tags --abbrev=0 2>/dev/null)..HEAD --name-only | grep -iE "migration|migrate|schema|alembic|flyway|liquibase"
git log $(git describe --tags --abbrev=0 2>/dev/null)..HEAD --pretty=format:"%s %b" | grep -i "BREAKING CHANGE"
# CD mode (diff from base branch)
git diff main..HEAD --name-only | grep -iE "migration|migrate|schema|alembic|flyway|liquibase"
git log main..HEAD --pretty=format:"%s %b" | grep -i "BREAKING CHANGE"docs/, CHANGELOG.md, or a MIGRATION.md file.#### Gate 6 — Deployment documentation is current
Check for a deployment or operations doc:
ls docs/deployment* docs/deploy* docs/ops* DEPLOY.md OPERATIONS.md runbook* 2>/dev/null#### Gate 7 — No uncommitted changes
git status --short#### Gate 8 — Branch is up to date with base
git fetch origin --dry-run 2>&1
git rev-list HEAD..origin/main --count 2>/dev/null # replace 'main' with detected base branchOutput in this format:
## Release Readiness — v<VERSION>
<!-- or: ## Pre-Merge Readiness — <branch-name> (CD mode) -->
| Gate | Status | Notes |
|------|--------|-------|
| 1. Version bumped | ✅ PASS | v1.4.0 > v1.3.2 (last tag) |
| 2. CHANGELOG entry | ❌ FAIL | No ## [1.4.0] section found |
| 3. No debug code | ✅ PASS | |
| 4. Feature flags | ⚠️ WARN | 2 new flags added — confirm intentional |
| 5. Migration notes | ✅ PASS | No migrations detected |
| 6. Deployment docs | ⚠️ WARN | New env var STRIPE_KEY detected; DEPLOY.md unchanged |
| 7. Clean working tree | ✅ PASS | |
| 8. Branch up to date | ✅ PASS | |
### Verdict: BLOCK — 1 failure must be resolved before releasing.
### Required actions
**Gate 2 — CHANGELOG entry missing**
Run the `write-changelog` skill to generate the entry, or add a `## [1.4.0] — YYYY-MM-DD` section manually.
### Advisory (non-blocking)
**Gate 4 — Feature flags**
New flags in this diff: `FEATURE_NEW_CHECKOUT`, `featureFlagBetaDashboard`
Confirm these are intentional and document them in the CHANGELOG if user-facing.
**Gate 6 — Deployment docs**
`STRIPE_KEY` added to `.env.example` but not mentioned in `DEPLOY.md`.
Consider adding a note so operators know to provision this before deploying.Verdict rules:
After the report, offer:
"Would you like me to run write-changelog to fix Gate 2, or address another failing gate first?"Do not cut the tag, push, or deploy automatically.
write-changelog, pr-summary).write-changelog (Gate 2 remediation in formal mode), commit-history-audit (run before this skill), pr-summary (after READY verdict, to create the PR).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.