release

Drive an end-to-end release of Bobbit. The human's job is the release PR: version bump + release notes, reviewed and squash-merged. Merging it is what releases — the release PR's required GitHub checks run the test suites, then .github/workflows/release-publish.yml validates, builds, type-checks, and packs an immutable tarball without publish authority, publishes that exact tarball to npm (trusted publishing / OIDC, with provenance), creates the tag, and creates the GitHub release. Never create the release tag, run a root npm publish, or create the GitHub release by hand. npm login / OTP is needed only when republishing binary sub-packages — pause and ask when the flow needs it.

Single source of truth for release mechanics: docs/releasing.md. This skill orchestrates that doc + version bump + notes + GitHub release.

Where this runs — read this first. Never cut the release from the primary worktree: the dev server runs there, and npm ci / npm run build would wipe its node_modules / overwrite its dist/ and break the running server mid-release. Never cut it from a session worktree either — that's on a session branch, not main, and git won't let you check out main in a second worktree while the primary already has it. Instead, §1.5 creates a dedicated detached-HEAD worktree off origin/main (a sibling of the primary, not under *-wt/), and every mutating step runs there. The release commit is pushed to a release/v<version> branch and squash-merged through the repository's required PR flow (§6–§8); the resulting merge commit is what gets tagged.

0. Sanity check the environment

These are location-independent (the .git is shared across worktrees), so run them from wherever the skill was activated. Report results before doing anything mutating:

git fetch origin --tags
git rev-parse origin/main                # sha we'll release from
git tag --sort=-v:refname | head -5      # find previous tag
git log --oneline <prev-tag>..origin/main | head    # must be non-empty (something to release)
node -v                                  # must satisfy engines.node (>=22.19.0)
npm whoami                               # only needed if republishing binary sub-packages (§3); root ships via CI
gh auth status                           # must be authed for G-Research/bobbit

Note: do not gate on the current worktree's branch or cleanliness — the release is cut from a fresh detached worktree at origin/main's tip (§1.5), so the session/primary worktree state is irrelevant. What matters is that origin/main is the intended release point.

Stop and ask the user if any of:

• origin/main has nothing new since the previous tag (nothing to release), or it isn't the commit they expect to ship.
• npm whoami fails and step 3 will republish binary sub-packages — ask them to run npm login (and enable 2FA if not already; npm requires OTP for those sub-package publishes). The root @gresearch/bobbit publish needs no npm login — it goes through CI/OIDC.
• gh auth status not logged in — ask them to run gh auth login.