3 Commits

Author SHA1 Message Date
Justin a94de92605 fix(release): harden manual release script (audit findings)
Two-subagent audit of scripts/release.sh found real gaps; fixed:

- HIGH: `--yes` broke a full release — mode was read from positional $2, so
  `release.sh X.Y.Z --yes` set mode="--yes" and hit the unknown-mode guard.
  Now all flags (--dry-run/--publish-only/--yes) are parsed positionally-
  independent and combine in any order; version is the first non-flag arg.
- MEDIUM: not resumable — a partial failure (e.g. tag pushed but release
  create failed) wedged the next run on "tag exists". Now idempotent: every
  step checks state first (skip bump if files already at NEW; verify an
  existing local/remote tag points at the intended commit before continuing;
  create the GitHub Release only if absent). Re-run resumes cleanly.
- MEDIUM: tagging off-main was only a soft warning. Now compares HEAD to
  origin/main and warns loudly (even under --yes) with both short-shas.
- LOW: a missing CHANGELOG.md killed the script under `set -e` before the
  notes fallback; now guarded. Placeholder "_describe changes_" notes are
  flagged.

Confirmation gate still precedes every write; --dry-run remains fully inert.
Verified via dry-run across all flag combos. CONTRIBUTING updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-16 15:34:16 -04:00
Justin 12354778ca chore(release): add break-glass manual release script (scripts/release.sh)
The release-please Action needs org approval to write on runpod/skills;
until that lands, merging the release PR can't tag. Add a human-run fallback
that cuts the tag + GitHub Release with the maintainer's own gh credentials
(not the Action's GITHUB_TOKEN), so a release is possible regardless of org
Actions policy.

- bumps every version file + .release-please-manifest.json (via
  bump-version.sh) so release-please stays in sync for when the Action is
  enabled; then commits, tags vX.Y.Z, pushes, and `gh release create`.
- modes: default (full), --publish-only (tag+release when the bump already
  merged via PR), --dry-run (preview).
- confirmation gate before ANY push (skip with --yes); refuses if the tag
  already exists. Documented in CONTRIBUTING → break-glass manual release.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-16 15:22:39 -04:00
Justin 012cf91ff3 feat: automate releases with release-please and apply PR #31 review fixes
- release-please workflow + config: bumps all version-bearing files in lockstep
  (4 manifests, version.txt, .release-please-manifest.json, 6 SKILL.md) and
  regenerates the CHANGELOG from Conventional Commits
- check_versions.py CI guard (extended to skills) prevents version drift
- apply review fixes (#32 rule splits, #33 versioning, #34 refs, #35 template)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-15 22:50:33 -04:00