What is dbcrust-release?

A release procedure for the DBCrust project. DBCrust is a software package; the procedure prepares a version change, creates a Git tag, and starts publishing workflows for release files, GitHub, and PyPI, a Python package registry.

Use it when preparing or publishing a DBCrust release, including version and changelog updates, release tags, platform binaries, a GitHub Release, and a PyPI upload.

It checks that the repository and required tools are ready before publishing. This reduces the chance of releasing from the wrong branch or with failing checks.

How clement-tourriere/dbcrust configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to clement-tourriere/dbcrust. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/clement-tourriere/dbcrust/main/.claude/skills/dbcrust-release/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/clement-tourriere/dbcrust

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/clement-tourriere/dbcrust/dbcrust-release/github.svg)](https://agentmods.dev/skills/clement-tourriere/dbcrust/dbcrust-release)

Your own site

<a href="https://agentmods.dev/skills/clement-tourriere/dbcrust/dbcrust-release"><img src="https://agentmods.dev/badge/skills/clement-tourriere/dbcrust/dbcrust-release/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/clement-tourriere/dbcrust/dbcrust-release"><img src="https://agentmods.dev/badge/skills/clement-tourriere/dbcrust/dbcrust-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 68 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,011 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 1 finding, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

high Tool Misuse · line 43
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00068	$0.01011
Opus 5	$0.00034	$0.00505
Sonnet 5	$0.00014	$0.00202
Haiku 4.5	$0.00007	$0.00101

Measured 11d ago against content hash e07073428a96, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

dbcrust-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/release.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/dbcrust-release/SKILL.md · 79 lines

How it starts

The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.

DBCrust release skill

This skill publishes a DBCrust release from the repository root.

Publishing a release pushes a v* tag, which triggers .github/workflows/release.yml (build binaries for all platforms, create the GitHub Release with notes generated from CHANGELOG.md, publish dbcrust to PyPI). Only run this skill when the user explicitly asks to make a release or confirms that publishing is OK.

Preferred command

Run the release helper:

bash .claude/skills/dbcrust-release/scripts/release.sh

The helper does the full safe path:

Verifies required tools: git, gh, and mise.
Verifies GitHub CLI authentication.
Requires a clean main branch.
Fetches origin/main and tags, then fast-forwards local main if needed.
Runs release checks:
- mise run check (fmt, clippy, tests)
- mise run release:dry-run (Commitizen bump preview; exits early with "No release needed" if no eligible conventional commits exist)
Runs mise run release to let Commitizen update Cargo.toml, pyproject.toml, CHANGELOG.md, commit the bump, and create the annotated tag. The bump runs the pre-bump hooks from .cz.toml (cargo check to refresh Cargo.lock, hk run fix) and GPG-signs the commit and tag (gpg_sign = true), so it must run where the user's GPG key is available.
Pushes main and the new v* tag.
Waits for the GitHub Actions Release workflow for the new tag (this covers binary builds, GitHub Release creation, and PyPI publishing).
Waits for the GitHub Release to exist and prints its URL.

Release notes are generated by the workflow itself from the matching CHANGELOG.md section — the helper does not edit them.

Options

Use options only when the user asks for them or when recovering from a failed release:

bash .claude/skills/dbcrust-release/scripts/release.sh --increment patch   # force patch/minor/major
bash .claude/skills/dbcrust-release/scripts/release.sh --skip-dry-run
bash .claude/skills/dbcrust-release/scripts/release.sh --skip-checks
bash .claude/skills/dbcrust-release/scripts/release.sh --timeout 5400

Read the full file on GitHub · 79 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

scripts/release.sh 7.9 KB runs code

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

11d ago First seen · 79 lines · 68 tokens per session scan A e07073428a96

Subscribe to this mod's changes

dbcrust-release is a skill published in the GitHub repository clement-tourriere/dbcrust (92 stars, last pushed 2d ago), licensed MIT. It adds 68 tokens to every session and 1,011 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Databases Git and workflow Releases ai cli clickhouse csv datafusion

draft-release-notes

Author the committed release-notes file for a Prisma 8 release (stable or 8.0.0-rc.N) by enumerating the merged PRs since the previous release v tag (stable or -rc.N), resolving opaque TML-NNNN: titles via Linear context (never copied verbatim), triaging public-worthiness, and writing categorized notes — breaking…

prisma/orm · 174 tokens

publish-npm-version

Cuts the next release of Prisma 8: bumps the root package.json version (on the v8 RC line: 8.0.0-rc.N → rc.N+1), propagates it to every workspace package, and opens a PR titled "chore(release): bump to ". When the maintainer merges the PR, the Publish to npm workflow runs automatically and ships the new version to npm…

prisma/orm · 159 tokens

codew-release-qa-sweep

Use before claiming Codewhale release work is done: run the full gate sweep and list the manual QA targets.

Hmbown/CodeWhale · 31 tokens

release

Skill "release" from Hmbown/Codewhale, covering release, invocation, non-goals and workflow.

Hmbown/CodeWhale · 0 tokens

skillshare-changelog

Generate CHANGELOG.md entry from recent commits in conventional format. Also syncs the website changelog page. Use this skill whenever the user asks to: generate a changelog, document what changed between tags, or create a new CHANGELOG entry. If you see requests like "write the changelog for v0.17", "what changed…

runkids/skillshare · 134 tokens

skillshare-release

End-to-end release workflow for skillshare. Runs tests, generates changelog (via /changelog), optionally writes local RELEASENOTES, updates version numbers, commits, and drafts announcements. Use when the user says "release", "prepare release", "cut a release", "release v0.19", or any request to publish a new version.…

runkids/skillshare · 87 tokens

dbcrust: Skill for Claude Code