Skills DirectorySkills Directory
SkillsLearnSecurityCategoriesDocsBlogPro
Sign InSubmit Skill
Skills Directory

Security-tested agent skills for Claude, coding agents, and AI workflows.

Directory

  • Browse Skills
  • All Skills A–Z
  • Claude Skills
  • Claude Code Skills
  • Agent Skills
  • Categories
  • Authors
  • Submit a Skill

Learn

  • Learn Hub
  • Install Claude Skills
  • Write SKILL.md
  • Skills vs MCP
  • Directories Compared

Security

  • Security
  • Methodology
  • Secure Claude Skills
  • Security Badges
  • Chrome Extension
  • Skill Manager

Company

  • About
  • Community
  • Blog
  • API Docs
  • Advertise

2026 Skills Directory. All rights reserved.

ProTermsPrivacyRefunds
Back to skills

Release

ASecurity

Cut a redline release from this checkout: bump, build, test, commit, then push the tag that makes the Release workflow publish npm, marketplace, and GitHub release, after one confirmation.

3 stars
0 votes
0 copies
3 views
Added 9/19/2026
developmentgitdatabase

Works with

mcp

Security Analysis

A92/100
mediumInstalls packages at runtime which could introduce malicious dependencies

Pro shows the line behind each finding and how to fix it

Scanned 9/19/2026

$npx -y skills add NikiforovAll/redline --skill release --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Release?

Add the live security badge to your README — it updates automatically with every re-scan.

Security grade badge for Release
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/nikiforovall-release-redline/badge)](https://www.skillsdirectory.com/skills/nikiforovall-release-redline)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
Files
SKILL.md
---
name: release
description: Cut a redline release from this checkout: bump, build, test, commit, then push the tag that makes the Release workflow publish npm, marketplace, and GitHub release, after one confirmation.
argument-hint: `patch` (default), `minor`, `major`, or `X.Y.Z`; `--plugin` bumps the plugin too; `--dry-run` stops before anything is committed or pushed.
disable-model-invocation: true
---

# release

Ship the extension and the server under one version. The laptop bumps, checks, commits, and pushes the tag `v<version>`; the Release workflow (`.github/workflows/release.yml`) packages the vsix and publishes `@nikiforovall/redline-mcp` to npm, the extension to the VS Code marketplace, and the `.vsix` to a GitHub release. Nothing is packaged or published from the laptop. The plugin has its own version and only pins the server; `docs/PUBLISHING.md`, section "Two versions", has the reasons.

`$ARGUMENTS` is the bump level (`patch` when empty, `minor`, `major`) or an explicit `X.Y.Z`, plus flags: `--plugin` also moves the plugin to its next patch so installed plugins pick up the new pin; `--dry-run` ends the run after the checks with the bump left in the working tree.

## Preflight

Stop at the first failure and report the line that failed.

- The branch is `main` and `git -C <root> status --porcelain` is empty, or lists only the Bump files already at `<version>` from an earlier run that stopped before publishing; then skip Bump.
- `gh auth status` reports a login.
- `npm run check:versions` prints one version: extension, server, and `pin.json` agree before anything moves.
- `<version>` is that printed version plus the bump level, or the explicit one, which must be higher.
- `npm view @nikiforovall/redline-mcp@<version> version` fails and `git -C <root> ls-remote --tags origin v<version>` prints nothing: neither the registry nor the remote has the version yet.

## Bump

Edit the `"version"` line in each file with the Edit tool. `npm version` rewrites the manifests in expanded JSON and produces a 40-line diff, so it stays out of this step.

1. `packages/extension/package.json` and `packages/mcp/package.json` to `<version>`.
2. `packages/claude-plugin/scripts/pin.json` so `@nikiforovall/redline-mcp` is `<version>`.
3. `npm install --package-lock-only` so the lockfile carries the new versions.
4. With `--plugin`, `version` in `packages/claude-plugin/.claude-plugin/plugin.json` to its next patch.

Done when `git -C <root> diff --stat` lists the two manifests, the lockfile, `pin.json`, and with `--plugin` `plugin.json`, each with one changed line, and `npm run check:versions` prints `<version>`.

## Check

`<log>` is a file in the session scratchpad directory; the test output is long and only its summary lines matter.

```sh
npm run build
npm test > "<log>" 2>&1; echo "npm test exit $?"; rg '^ℹ (pass|fail) ' "<log>"
```

Done when the test exit is `0` with three `fail 0` lines. With `--dry-run`, report and stop here.

## Confirm

Show the bump diff stat and the test summary, then ask one question with `AskUserQuestion`: push `v<version>` now, or stop. Skip the question when the user's request already says to publish. Nothing so far has left the machine. Everything after is irreversible: the tag triggers the workflow, and npm never accepts a version twice.

## Publish

```sh
git -C <root> add -A && git -C <root> commit -m "chore: release v<version>"
git -C <root> push origin main
git -C <root> tag -a v<version> -m v<version> && git -C <root> push origin v<version>
gh run list --workflow Release --limit 1 --json databaseId,headBranch,status
gh run watch <id> --exit-status --interval 15
```

Run them in order and stop at the first non-zero exit. The run list can lag the push by a few seconds; its `headBranch` must be the tag before watching. Every publish step in the workflow skips a version that already exists, so a failed run is fixed by fixing the cause and `gh run rerun <id>`, never by a new tag.

Done when the run is green and these three agree with `<version>`; the registry and the marketplace index a minute or two after the run, so retry them with a pause between attempts:

```sh
npm view @nikiforovall/redline-mcp version
npx vsce show nikiforovall.redline-extension --json | rg '"version": "<version>"'
gh release view v<version> --json assets -q '.assets[].name'
```

## Report

One line per artifact: npm version, marketplace version, release URL, plugin version and whether it moved. Then how users get it: the extension from the marketplace (VS Code updates it on its own); the server on the next plugin bump unless `--plugin` shipped it now.

Attribution

NikiforovAllNikiforovAll
View sourceSee grades on GitHubMore from NikiforovAll →
SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments (0)

No comments yet. Be the first to comment!

SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Related Skills

Clean Code

Pragmatic coding standards - concise, direct, no over-engineering, no unnecessary comments

304955 votes

Browser Extension Developer

Use this skill when developing or maintaining browser extension code in the `browser/` directory, including Chrome/Firefox/Edge compatibility, content scripts, background scripts, or i18n updates.

286712 votes

Seo Optimizer

SEO optimization with keyword analysis, readability assessment, technical validation, content quality. Use for search rankings, blog posts, content audits, or encountering keyword density, readability scores, meta tags, schema markup errors.

2222 votes

Google Official Seo Guide

Official Google SEO guide covering search optimization, best practices, Search Console, crawling, indexing, and improving website search visibility based on official Google documentation

1862 votes

Writing Plans

Use when you have a spec or requirements for a multi-step task, before touching code

2927051 votes
View all in development →