release — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited release (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Cut a release, validate the changelog, and ensure git hooks are installed.
/release 1.0.5 or /release patch (bumps patch from current version).
When the user triggers /release <version>:
skills/release/scripts/release-context.sh <version>.This silently installs git hooks and prints everything needed: version info, working directory status, commits since last release, files changed, current [Unreleased] content, and the previous release entry for style reference.
untracked files that belong in this release, commit them first. Use the /commit skill or make well-formed commits directly.
[Unreleased] is empty, write it now usingthe commits and file changes from the context output. Follow the changelog standard below. Re-run the context script after committing if needed.
scripts/release.sh <version>. This renames[Unreleased] → [X.Y.Z] - date, inserts a fresh [Unreleased], bumps package.json, commits, and tags.
[Unreleased] +minor series rollup via scripts/extract-changelog.sh <version>. Ask the user to confirm before pushing.
git push origin main --tags.publish workflow. Use interactive_shell in dispatch mode with:
gh run watch $(gh run list --workflow=publish.yml --limit=1 --json databaseId --jq '.[0].databaseId') --exit-statusThe agent will be notified when CI completes and should report the result.
updates to sqlite-vec (and platform packages), node-llama-cpp, and better-sqlite3. Run pnpm outdated and report any available updates for these packages. If updates exist, bump them (pinned, no ^ ranges) and re-run tests before proceeding.
If any step fails, stop and explain. Never force-push or skip validation.
All dependencies must be pinned to exact versions (no ^ or ~ ranges). The lockfile ensures reproducible installs. When adding or updating any dependency, always use the exact version string (e.g. "3.18.1" not "^3.18.1").
The changelog lives in CHANGELOG.md and follows Keep a Changelog conventions.
## [Unreleased] — accumulates entries between releases## [X.Y.Z] - YYYY-MM-DD — released versionsEach version entry has two parts:
1. Highlights (optional, 1-4 sentences of prose)
Immediately after the version heading, before any ### section. The elevator pitch — what would you tell someone in 30 seconds? Only for significant releases; skip for small patches.
## [1.1.0] - 2026-03-01
QMD now runs on both Node.js and Bun, with up to 2.7x faster reranking
through parallel contexts. GPU auto-detection replaces the unreliable
`gpu: "auto"` with explicit CUDA/Metal/Vulkan probing.2. Detailed changelog (`### Changes` and `### Fixes`)
### Changes
- Runtime: support Node.js (>=22) alongside Bun. The `qmd` wrapper
auto-detects a suitable install via PATH. #149 (thanks @igrigorik)
- Performance: parallel embedding & reranking — up to 2.7x faster on
multi-core machines.
### Fixes
- Prevent VRAM waste from duplicate context creation during concurrent
`embedBatch` calls. #152 (thanks @jkrems)#NNN (thanks @username) forexternal PRs. No need to credit the repo owner.
Each GitHub release includes the full changelog for the minor series back to x.x.0. The scripts/extract-changelog.sh script handles this, and the publish workflow (publish.yml) calls it to populate the GitHub release.
The pre-push hook (scripts/pre-push) blocks v* tag pushes unless:
package.json version matches the tagCHANGELOG.md has a ## [X.Y.Z] - date entry for the versionHooks are installed silently by the context script. They can also be installed manually via skills/release/scripts/install-hooks.sh or automatically via bun install (prepare script).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.