release-validation-auto

A release safety check for Git projects that use package.json, the file that describes a JavaScript package. It checks the current branch and package version before release work can continue.

In plain words
What is it for?
Use it before creating a release, changing a version, or publishing a package. It checks allowed branch names, package.json validity and required fields, and semantic versioning, a standard format such as 1.2.3.
Why use it?
It helps prevent publishing from the main branch or from a branch with invalid package information. Failed checks stop the release workflow and explain the problem.

Cursor rule for Cursor

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/usrrname/cursorrules/release-validation-auto
Clone the repo
git clone --depth 1 https://github.com/usrrname/cursorrules

Made for: Cursor.

Per session 0 Nothing until a file matches its globs; then the whole rule loads.
When invoked 1,737 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.01737
Opus 5 $0.00000 $0.00869
Sonnet 5 $0.00000 $0.00347
Haiku 4.5 $0.00000 $0.00174

Measured yesterday against content hash 991704ca972b, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

release-validation-auto scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/rules/utils/release-validation-auto.mdc · 191 lines

How it starts

The opening of the file, as written. The whole thing — 191 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Release Validation

Critical Rules

  • Must validate branch naming conventions before allowing releases
  • Must only allow releases from branches starting with "release/", "hotfix/", or "fix/"
  • Must validate package.json exists, is valid JSON, and contains required fields
  • Must validate semantic versioning format in package.json
  • Must provide clear error messages for validation failures
  • Must terminate workflow on validation failures

filters:

  • type: content pattern: "(release|version|tag|bump|publish|deploy).*(create|make|generate|prepare|ready)"
  • type: git_branch pattern: "^(?!main$|master$).*$"
  • type: event pattern: "chat_start|chat_response"

actions:

  • type: validate conditions:

    • pattern: "^(main|master)$" message: "⚠️ You're currently on the main branch! Please create a release branch before generating release notes. This ensures proper version control and prevents accidental releases."
  • type: generate content: |

    🔍 Release Validation Process

    I'll validate your environment and configuration before proceeding with the release workflow.

    1. Branch Validation
      # Check current branch
      CURRENT_BRANCH=$(git branch --show-current)
      echo "Current branch: $CURRENT_BRANCH"
      
      # Verify we're not on main/master
      if [[ "$CURRENT_BRANCH" == "main" || "$CURRENT_BRANCH" == "master" ]]; then
        echo "❌ Error: Cannot generate release notes on main/master branch"
        echo "Please create a release branch first:"
        echo "git checkout -b release/v[VERSION]"
        exit 1
      fi
      
      # Validate branch naming conventions
      echo "🔍 Validating branch naming conventions..."
      
      # Only allow releases from branches that start with "release/", "hotfix/", or "fix/"
      if [[ ! "$CURRENT_BRANCH" =~ ^(release|hotfix|fix)/ ]]; then
        echo "❌ ERROR: Releases can only be created from branches that start with 'release/', 'hotfix/', or 'fix/'"
        echo ""
        echo "Current branch: $CURRENT_BRANCH"
        echo ""
        echo "Please create an appropriate branch first:"
        echo "git checkout -b release/v[VERSION]"
        echo "git checkout -b hotfix/urgent-fix-v[VERSION]"
        echo "git checkout -b fix/bug-description-v[VERSION]"
        echo ""
        echo "Examples of valid release branches:"
        echo "- release/v1.2.3"
        echo "- release/v2.0.0"
        echo "- hotfix/security-patch-v1.2.4"
        echo "- fix/memory-leak-v1.1.5"
        echo "- release/feature-name-v1.1.0"
        echo ""
        echo "❌ Release workflow terminated due to invalid branch"
        exit 1
      fi
      
      echo "✅ Branch validation passed - using $CURRENT_BRANCH"
      

Read the full file on GitHub · 191 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 191 lines · 0 tokens per session scan A 991704ca972b

Subscribe to this mod's changes

release-validation-auto is a cursor rule published in the GitHub repository usrrname/cursorrules (10 stars, last pushed 4mo ago), licensed ISC. It costs nothing until one of its globs matches a file; then it loads 1,737 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.