Skip to content
Back to skills

Plugin Publish

ASecurity

Stage, commit, push, and open a PR for plugin changes. Validates the commit message against conventional-commits (required by validate-pr-title CI check), runs Layer 1 structural tests first, and reminds the user to run /plugin marketplace update after merge. Triggers on "publish plugin", "push plugin changes", "ship this plugin", "release this branch".

  • 5 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added September 27, 2026
ai-agentspythongit

Security analysis

A100/100

Scanned October 1, 2026

npx -y skills add racecraft-lab/racecraft-plugins-public --skill plugin-publish --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Plugin Publish?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Plugin Publish
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/racecraft-lab-plugin-publish/badge)](https://www.skillsdirectory.com/skills/racecraft-lab-plugin-publish)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: plugin-publish
description: Stage, commit, push, and open a PR for plugin changes. Validates the commit message against conventional-commits (required by validate-pr-title CI check), runs Layer 1 structural tests first, and reminds the user to run /plugin marketplace update after merge. Triggers on "publish plugin", "push plugin changes", "ship this plugin", "release this branch".
license: MIT
disable-model-invocation: true
---

# plugin-publish

User-invocable. Stops Claude from auto-running this — it has side effects (push, PR).

## What this does

Walks through the publish flow in the root `AGENTS.md` (Commands, Pull Requests, Definition of Done) and enforces the parts that are easy to forget:

1. **Pre-flight check** — `python3 tests/speckit-pro/run-all.py --layer 1` must pass (catches missing frontmatter and invalid JSON).
2. **Detect remote** — run `git remote -v`; do not assume the remote is named `origin`.
3. **Stage selectively** — list candidate files, ask user which to include. NEVER `git add -A` or `git add .`.
4. **Commit with conventional-commits prefix** — required types: `feat`, `fix`, `chore`, `docs`, `refactor`, `test`. Validate before writing.
5. **Push and open the PR** — follow the Pull Requests section of the root `AGENTS.md`, which opens every PR with the `gh-stack` skill. Validate the final title with the release-readiness gate first. For `feat` and `fix` PRs, fill the `release-note` fence or apply the `release-note/skip` label.
6. **Remind user** — after PR is merged (squash-only), tell them to run:
   ```
   /plugin marketplace update racecraft-plugins-public
   ```

## When NOT to use

- For a release (release-please handles version bumps automatically — do not manually edit `plugin.json` versions)
- For docs-only PRs; commit and open the PR directly.
- For version fields in `release-please-config.json`, `.release-please-manifest.json`, or the marketplace registries: release automation owns them (see the Release Automation section of `docs-site/src/content/docs/contribute-and-release.md`).

## Hard rules

- Never merge the PR; a human reviews and merges it.
- Never use `--no-verify` to skip hooks
- Never push to `main` directly (branch protection blocks it; use a feature branch + PR)
- PR title format: `<type>(<lowercase-scope>): <description>`. The scope is required: the `validate-pr-title` CI job rejects a title without one.

## Output

When complete, report:

- Branch name pushed
- PR URL
- The marketplace-update command the user needs to run post-merge

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.