A release workflow for building, signing, notarizing, packaging, and publishing a Blurt version through GitHub Actions. Notarization is Apple's approval process for software distributed outside the Mac App Store.

Use it when shipping a new Blurt version, including creating the release build, DMG, GitHub tag, and published release.

It organizes the checks and publishing steps needed for a signed macOS release. It also prevents version conflicts and requires confirmation before publishing an irreversible release.

release — Skill by AssemblyAI

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/assemblyai/blurt/release

Any agent

npx skills add AssemblyAI/blurt --skill release

Clone the repo

git clone --depth 1 https://github.com/AssemblyAI/blurt

Made for: Claude Code, Codex.

Per session 61 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,267 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00061	$0.01267
Opus 5	$0.00030	$0.00633
Sonnet 5	$0.00012	$0.00253
Haiku 4.5	$0.00006	$0.00127

Measured 2d ago against content hash dd389fb7917d, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/release/SKILL.md · 93 lines

How it starts

The opening of the file, as written. The whole thing — 93 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Releasing Blurt

Everything happens in GitHub Actions, not on this machine — so this works from a web or chat session with no terminal, and without permission to dispatch a workflow. Confirm the target version with the user before starting — publishing is hard to undo.

Preconditions (verify first)

main is up to date and green; releases ship from main.
The release-build environment has the signing + notary secrets, and release-publish has required reviewers. See RELEASE.md — that is the source of truth for custody. Without them the release workflow fails on its secrets-presence step.
Check the highest existing vX.Y.Z tag, not just the version on main: an orphan tag from an abandoned release means the next patch number is already taken, and release-bump.sh refuses to reuse one.

Steps

Start release-bump. You almost certainly can't dispatch a workflow (that needs actions: write), so push a marker branch instead — it needs only the push you already do:
```
git push origin main:refs/heads/release/v0.1.37
```
The branch name names the version, and it must carry nothing of its own: the workflow refuses a marker that isn't an ancestor of main. It then runs scripts/release-bump.sh on macos-26 (marketing version + build number in App/Blurt/project.yml, regenerate the project, commit) and force-pushes the bump onto that same branch. Dispatching still works if you do have the permission, and only that path accepts an empty version (next patch).
Open the PR for that branch and hand it to the user to merge. The workflow does not open it, on purpose: a PR created by GITHUB_TOKEN never triggers check and so can never merge. Opening it from here works — an agent's own credentials are not GITHUB_TOKEN.
Merging it starts release — no dispatch. release.yml triggers on a push to main touching project.yml; its resolve job confirms the version changed and isn't already tagged, then the build job does the whole Apple path (xcodebuild Release → sign nested code → notarize → staple → DMG → verify) and uploads the artifacts. Dispatch release by hand only to re-run a failed build, to republish, or for a non-main dry run.
Hand the ship gate to the user — the publish job parks on the release-publish environment. Tell them to download the DMG from the run's artifacts, install it, and approve once it works. Nothing is rebuilt after approval, so what they test is what ships. release-publish.sh then tags, pushes, and publishes.

Read the full file on GitHub · 93 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 93 lines · 61 tokens per session scan A dd389fb7917d

Subscribe to this mod's changes

release is a skill published in the GitHub repository AssemblyAI/blurt (5 stars, last pushed 4d ago), licensed MIT. It adds 61 tokens to every session and 1,267 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Git and workflow Productivity accessibility assemblyai dictation dictation-app macos macos-app

scarf-template-author

Scaffold a new Scarf project OR enrich an existing one after a Scarf "Upgrade Project" — dashboard, optional configuration schema, optional cron job, AGENTS.md, and (via the scarf-miniapp-author skill) a starter mini-app — from a short conversational interview. Output is immediately usable locally and cleanly…

awizemann/scarf · 79 tokens

scarf-miniapp-author

Author a Scarf mini-app — a small sandboxed web surface (HTML/CSS/JS) that renders inside a project's cockpit and talks to the bound Hermes session + project data through the versioned window.scarf bridge. Use to build a bespoke panel (a task board, an approval queue, a chart, a data table) for a project.

awizemann/scarf · 78 tokens

awesome-swift-macos-apps-docs

Use when adding, updating, or validating app entries in the awesome-swift-macos-apps repository, especially when maintaining both README.md and README.zh.md with concise one-sentence descriptions, correct category placement, and consistent bilingual formatting.

jaywcjlove/awesome-swift-macos-apps · 57 tokens

macos-harness

Control a whole Mac from one persistent Python session with screenshots, PID-targeted input, an animated virtual pointer, targeted Apple Accessibility, Apple Events, Browser Harness CDP, and filesystem access. Use for native, Electron, browser, dialog, file, or cross-app tasks without moving the physical cursor or…

browser-use/macos-harness · 71 tokens

repo-build-pr

End-to-end implementation loop for the os-clovy repo: study the prompt, ask the clarifying questions that change what gets built, plan and architect on the session model while delegating bulk implementation and review to cheaper strong models, isolate work in git worktrees, validate with deterministic checks plus…

open-software-network/os-clovy · 177 tokens

os-accounts-integration

Integrate consumer apps, Tauri desktop clients, or backend services with OS Accounts, the Open Software identity and credit-billing platform. Use when adding Login with Open Software, PKCE callback handling, /me, access-token verification with JWKS/ES256, auth middleware for Hono/Fastify/Express/Rust, top-up links…

open-software-network/os-clovy · 156 tokens