What is githits-release?

A release-maintenance guide for the GitHits CLI, its MCP package, plugins, skills, manifests, and changelog.

Use it to prepare or review releases, check package-version consistency, update release notes, validate generated files, and monitor publishing after an approved merge.

It coordinates version changes and release checks across packages and requires human approval before an open release pull request is merged.

githits-release — Skill for Claude Code and Codex by githits-com: A release-maintenance guide for the GitHits CLI, its MCP…

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/githits-com/githits-cli/githits-release

Any agent

npx skills add githits-com/githits-cli --skill githits-release

Clone the repo

git clone --depth 1 https://github.com/githits-com/githits-cli

Made for: Claude Code, Codex.

Or install githits, the plugin that ships this one along with the rest of its 6 skills, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/githits-com/githits-cli/githits-release.svg)](https://agentmods.dev/skills/githits-com/githits-cli/githits-release)

Your own site

<a href="https://agentmods.dev/skills/githits-com/githits-cli/githits-release"><img src="https://agentmods.dev/badge/skills/githits-com/githits-cli/githits-release.svg" alt="Measured on agentmods" height="20"></a>

Per session 57 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,382 The whole file, excluding the scripts and references it only reads on demand.

Security scan C 1 finding. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00057	$0.02382
Opus 5	$0.00028	$0.01191
Sonnet 5	$0.00011	$0.00476
Haiku 4.5	$0.00006	$0.00238

Measured 3d ago against content hash 1fdc2499f276, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade C, and why

githits-release scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Harvests environment variableshighData exfiltration

Enumerating or grepping the environment for keys collects credentials unrelated to what the mod says it does.

- Required GitHub production environment secrets are identifiers used for masking and OIDC wiring: `AZURE_TENANT_ID`, `AZURE_SUBSCRIPTION_ID`, `AZURE_CLIENT_ID`, `MCP_REGISTRY_KEY_VAULT_NAME`, and `MCP_REGISTRY_SIGNING_K

.agents/skills/githits-release/SKILL.md · 91 lines

How it starts

The opening of the file, as written. The whole thing — 91 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Use this skill for GitHits changelog maintenance, release work, version-bump PRs, release-readiness reviews, and release notes.

Human Merge Gate

Release preparation ends with an open release PR. A request to audit, prepare, create, cut, or release a version does not authorize merging, enabling auto-merge, tagging, publishing, or waiting for publication.
Merge a release PR only after receiving separate, explicit human approval given after the release PR exists. The approval must explicitly authorize merging and identify that PR by number, URL, or an otherwise unambiguous reference to the already-open PR.
Earlier requests for an end-to-end release do not satisfy the merge gate. After opening the PR, report its URL and check status, then stop and ask for merge approval. Do not enable auto-merge as a substitute for approval.
After the separate approval, merge only the approved PR. The successful Main workflow will trigger publication, which may then be monitored to completion.

Release Checklist

Root githits and @githits/mcp have separate release flows. Bump both only when both surfaces changed.
For root githits releases, bump package.json and server.json, then run bun run plugins:generate to update .plugin/plugin.json, .claude-plugin/plugin.json, .claude-plugin/marketplace.json, .codex-plugin/plugin.json, .cursor-plugin/plugin.json, gemini-extension.json, and the versionless Antigravity plugin.json/mcp_config.json adapter together.
For @githits/mcp releases, bump packages/mcp/package.json and its workspace version in bun.lock only when MCP package API, tool behavior, instructions, schemas, MCP auth/error behavior, or remote-server-facing public types changed.
For coordinated CLI and MCP releases, keep the MCP minor aligned with the CLI minor for discoverability. Start the first MCP release for a CLI minor at X.Y.0, then bump MCP patch for later MCP-package-visible changes in that CLI minor. Do not bump MCP for CLI-only changes.
After merge, the root release workflow and MCP release workflow both run from the successful Main workflow on main. The MCP workflow publishes only when @githits/mcp@<version> is not already on npm; use its manual workflow_dispatch path only for recovery or explicit dry runs.
The root release workflow also publishes server.json to the official MCP registry as com.githits/githits after npm publishes githits@<version>. Treat the MCP registry entry as part of the root githits release, not the @githits/mcp package release.
Keep server.json.version, the npm package entry version in server.json, and root package.json.version aligned. The release workflow rewrites a temporary registry manifest from package.json, but the committed server.json should still reflect the intended next root release for review and local validation.
Keep root package.json#mcpName equal to com.githits/githits; npm registry ownership validation depends on the published package manifest matching server.json.name.
Run or rely on package-scoped version checks to verify root plugin versions stay aligned and MCP versions are intentionally independent.
Reconcile the complete package-specific tag-to-HEAD delta with the files in changes/. Every fragment must name every public artifact and an explicit pending bump, including none for unaffected packages.
Run bun run plugins:generate, inspect the generated diff, and run bun run plugins:check before release-readiness signoff. Do not release with manually edited or stale generated assets.
Finalize the changelog before release. Group the fragments into a separate ## [<artifact> <version>] - YYYY-MM-DD section for each released artifact, then delete every consumed fragment.
Review public skills before signoff whenever user-facing CLI/MCP behavior changed. After the behavior is released or included in the same release branch, update skills/githits-code/SKILL.md, skills/githits-package/SKILL.md, and their references so skills.sh users get instructions that match the released surface.
Keep PR titles and labels release-note friendly; GitHub release notes are generated from merged PRs and .github/release.yml categories.
Run bun run build before release-readiness signoff. Run targeted smoke/eval commands when MCP tools, CLI commands, shared formatters, auth/error envelopes, Agent Skills, or agent-facing instructions changed.

Read the full file on GitHub · 91 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

3d ago First seen · 91 lines · 57 tokens per session scan C 1fdc2499f276

Subscribe to this mod's changes

githits-release is a skill published in the GitHub repository githits-com/githits-cli (93 stars, last pushed today), licensed Apache-2.0. It adds 57 tokens to every session and 2,382 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 1 finding (harvests environment variables). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Git and workflow ai-coding-tools ai-tools cli code-graph code-search context-api

organize

Open the Cross-Code Organizer (CCO) dashboard — view and manage all memories, skills, MCP servers, hooks, and configs across scopes.

mcpware/cross-code-organizer · 31 tokens

codestory-grounding

Use when an agent should ground a local repository with CodeStory before making source claims, planning edits, choosing tests, reviewing changes, or using broad retrieval evidence through the CodeStory plugin MCP.

TheGreenCedar/CodeStory · 44 tokens

ai-unity-asset-pipeline

Build, install, run, and verify a reusable image-to-game-ready-3D pipeline for Unity with controlled ImageGen references, approved AI mesh providers, Blender MCP/CLI, modular era catalogs, Blender retopology/LOD/pivot processing, and Unity import/render proof. Use for 2D-to-3D assets, vehicles, aircraft, ships…

ezBuilder/code-brain · 95 tokens

githits-release