release-workflow

release-workflow is a skill for Claude Code, Codex from Goldziher/spikard. It costs 77 tokens per session (1,000 once invoked), scanned C, original, MIT.

A step-by-step procedure for publishing a new version of Spikard, including its Rust core library, command-line tool, and language bindings. A changelog records what changed between software versions.

In plain words
What is it for?
Use it when setting or increasing a version number, updating the changelog, checking release prerequisites, creating a GitHub release, or installing the released build locally.
Why use it?
It helps prevent incomplete releases by describing version updates, changelog preparation, clean-source checks, and publishing steps. It also explains which command keeps version numbers consistent across the project.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/goldziher/spikard/release-workflow
Any agent
npx skills add Goldziher/spikard --skill release-workflow
Clone the repo
git clone --depth 1 https://github.com/Goldziher/spikard

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for release-workflow

README.md
[![agentmods](https://agentmods.dev/badge/skills/goldziher/spikard/release-workflow.svg)](https://agentmods.dev/skills/goldziher/spikard/release-workflow)
Your own site
<a href="https://agentmods.dev/skills/goldziher/spikard/release-workflow"><img src="https://agentmods.dev/badge/skills/goldziher/spikard/release-workflow.svg" alt="Measured on agentmods" height="20"></a>
Per session 77 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,000 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00077 $0.01000
Opus 5 $0.00039 $0.00500
Sonnet 5 $0.00015 $0.00200
Haiku 4.5 $0.00008 $0.00100

Measured 5d ago against content hash dd0dc15b047c, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-05, from the pricing page.

Security

Grade C, and why

release-workflow scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

task clean # cargo clean + alef clean + rm -rf dist/ .alef/ caches
.ai-rulez/skills/release-workflow/SKILL.md · 104 lines

How it starts

The opening of the file, as written. The whole thing — 104 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Spikard Release Workflow

Ground truth: spikard is a Rust workspace (core library + spikard-cli + polyglot bindings). It has no set-version task — the equivalent is task version:set (a version-sync include). Cargo.toml is the single source of truth; version:set syncs it to every binding manifest.

1. Set the version

task version:set -- X.Y.Z        # e.g. task version:set -- 0.7.0-rc.1

version:set takes the version as a -- positional argument (CLI_ARGS). It runs alef sync-versions --set <version> then the full sync (regenerate READMEs, docs, bindings, scaffold, stubs, e2e, and precise cargo update for the core crate across dependent manifests). Bump variants also exist: task version:bump:patch, task version:bump:minor, task version:bump:major. task version:show prints the current version.

Verify:

task version:show
grep -m1 '^version' Cargo.toml

2. Update the CHANGELOG

Move every [Unreleased] bullet in CHANGELOG.md into a new ## [X.Y.Z] - YYYY-MM-DD section (grouped Added / Changed / Fixed / Removed). Re-create an empty [Unreleased]. Never tag an empty section.

3. Clean-tree precondition (hard gate)

Never release a dirty or failing tree.

poly fmt --check .    # formatting clean (task format:check)
poly lint .           # lint clean (task lint)
task test             # Rust core tests pass (rust:test)

Use poly fmt --fix . (or task format) to apply formatting, then re-stage. For a full cross-binding gate before a release, run task test:all (task test + alef test). Optionally validate manifests with task publish:validate (alef publish validate). Fix any failure — do not release past it.

4. Commit, tag, and publish the GitHub release

git add -A
git commit -m "chore(release): X.Y.Z"
git tag -a vX.Y.Z -m "vX.Y.Z"
git push origin main
git push origin vX.Y.Z
gh release create vX.Y.Z --title "vX.Y.Z" --generate-notes

Add --prerelease for RC/beta tags. Use --notes-file from the new CHANGELOG section instead of --generate-notes when the changelog entry is richer. A bare git tag is not a release — always run gh release create. Tag-based releases trigger the multi-platform / multi-registry publish workflows.

Read the full file on GitHub · 104 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago First seen · 104 lines · 77 tokens per session scan C dd0dc15b047c

Subscribe to this mod's changes

release-workflow is a skill published in the GitHub repository Goldziher/spikard (119 stars, last pushed 23d ago), licensed MIT. It adds 77 tokens to every session and 1,000 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

backport-pr

Backport a merged Next.js pull request from canary to a previous release branch such as next-16-2. Use when the user asks to backport, cherry-pick, or open a backport PR from a PR number to an older Next.js version. Covers finding the merged PR commit, creating a backport branch from the target release branch…

vercel/next.js · 97 tokens

version-release

Choose and apply the correct semantic version bump for this repository. Use for every user-visible release, before merge when a change set should ship as patch, minor, or major, and whenever package/plugin/desktop version metadata must stay synchronized.

hoangsonww/Claude-Code-Agent-Monitor · 50 tokens

release-guard

Run release-readiness checks for this repository. Use when validating docs, scripts, verification coverage, and operational safety before merge or release.

hoangsonww/Claude-Code-Agent-Monitor · 31 tokens

noodle-release

Prepare a versioned Noodle release by updating package.json, inspecting changes since the latest tag, auditing every repository-maintained skill, synchronizing affected README, AGENTS.md, tests, CHANGELOG.md, noodle-site documentation, and a release blog post, then running the release validation. Use for release…

wilfredinni/noodle · 93 tokens

npm-publish

Use when publishing Node/npm packages from a repository or monorepo, especially scoped public packages, beta/latest dist-tags, workspace publishing, npm 2FA, publish verification, local tarball smoke tests, and debugging npm publish/install errors such as E403, E404, ENOVERSIONS, ELOOP, or pack destination failures.

dirtybits/agent-skills · 73 tokens

pull-request

Use this whenever the user asks to "open a PR", "ship this", "create the pull request", "make a PR", or once a feature/fix is verified and ready to push. Full lifecycle: branch → commit (commitizen) → issue → draft PR → CI → ready → autonomous monitor loop (fix comments, resolve threads, iterate until CI green + zero…

pierreb-devkit/Node · 113 tokens