cyboflow: Skill for Claude Code

Release

Execute a Cyboflow release. The authoritative procedure and its rationale live in docs/RELEASE-RUNBOOK.md — read it first; this skill is the executable checklist. Work through the phases in order and do not skip verification.

A release is a tag push. Phases 0–2 prepare the commit; Phase 3 tags and pushes it; .github/workflows/stable-release.yml does the building, verifying, publishing and the GitHub release. The hand-built path is kept below as a fallback for when CI cannot run.

Guardrails

• Never build a universal macOS binary (electron-builder --universal) — it fails on the bundled claude/codex binaries. The release is per-arch DMGs; build:mac / build:mac:dev just run the arm64 then x64 recipes.
• R2 is the real release channel, not GitHub. The app auto-updates from updates.cyboflow.com/<variant>/latest-mac.yml (R2) and never reads the GitHub release. Publishing GitHub without the R2 step (Phase 5) leaves every user on the old version. Do NOT call the release done until both R2 feeds show the new version.
• Hold all outward actions until the user confirms. Do the gate, bump, builds, and verification, then stop and ask before publishing to R2, pushing main, the tag, or the GitHub release — unless the user has already said to push without asking.
• Every mac build recompiles native modules for the Electron ABI; restore the host-Node ABI afterward — rebuild both or the gate fails with a pty.node / better_sqlite3.node dlopen arch mismatch: pnpm rebuild better-sqlite3 @homebridge/node-pty-prebuilt-multiarch.
• Don't launch the app while a build:mac runs (it can wedge the DMG eject).

Phase 0 — Preconditions

1. Confirm a clean tree on main (git status), and read the recent log to see what's shipping (git log --oneline v<last>..HEAD).
2. Decide the new version. Default is a patch bump of the current package.json version; ask the user if a minor/major bump is intended.
3. The default path needs no local creds — CI holds all ten secrets. Confirm they are on GitHub instead: gh secret list must show CSC_LINK, CSC_KEY_PASSWORD, APPLE_ID, APPLE_TEAM_ID, APPLE_APP_SPECIFIC_PASSWORD, AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, R2_ACCOUNT_ID, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, SENTRY_DSN, APTABASE_APP_KEY. (The GitHub CSC_LINK is the base64 of the .p12; the .envrc.local variable of the same name is a filesystem path.) Steps 4–6 below are only needed for the manual fallback — skip them otherwise.
4. Re-resolve the dependency tree before gating — the gate is otherwise blind to lockfile defects:

   pnpm install --frozen-lockfile
   

   node_modules can be self-consistent while the lockfile is not, so Phase 1 would pass against dependencies that no longer match what CI installs. This is exactly how 0.2.9 shipped a dead E2E suite: a dep bump split playwright (1.62.1) from @playwright/test (1.54.1) in the lock, but the un-reinstalled tree still held a matched 1.54.1 pair, so the local smoke tier passed and every nightly after it failed at spec collection. --frozen-lockfile also hard-fails outright when package.json and the lockfile disagree. Runs BEFORE step 5 on purpose: it prunes to host arch, so the cross-arch binary check must follow it, never precede it.
5. Confirm all four agent binaries are present (a plain install prunes to host arch):

   ls -l node_modules/@anthropic-ai/claude-agent-sdk-darwin-{arm64,x64}/claude \
         node_modules/@openai/codex-darwin-{arm64,x64}/vendor/*-apple-darwin/bin/codex
   

   Test the binaries, never ls -d on the package dirs — those are pnpm symlinks that outlive a prune as dangling links and pass the check while the x64 build dies at preflight (0.4.1). If any are missing, run the cross-arch install with --force (see runbook), then node node_modules/electron/install.js — the forced install strips electron/dist, which gen-mac-latest-yml.mjs needs.
6. Windows leg prerequisites: gh auth status is logged in (dispatching windows.yml + downloading its artifacts), osslsigncode is installed (brew install osslsigncode), and the repo has the AZURE_TENANT_ID / AZURE_CLIENT_ID / AZURE_CLIENT_SECRET secrets (gh secret list | grep AZURE_ shows all three).