Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/lilithgames/a2wave/release-workflownpx skills add LilithGames/a2wave --skill release-workflowgit clone --depth 1 https://github.com/LilithGames/a2waveWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00027 | $0.03037 |
| Opus 5 | $0.00014 | $0.01519 |
| Sonnet 5 | $0.00005 | $0.00607 |
| Haiku 4.5 | $0.00003 | $0.00304 |
Grade A, and why
release-workflow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 179 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Release Workflow
Overview
发版流程：前置检查 → 确定新版本号 → 写入 CHANGELOG → 创建 tag 并推送。只能在 main 分支执行。
仓库只有一套 tag：平台与 CLI 共用同一条版本线，一个 v* tag 触发全部三个 workflow。
| Tag 前缀 | 用途 | CI 自动做的事 |
|---|---|---|
v*（如 v0.7.1） |
整个仓库发版（平台 + CLI） | ① 从 CHANGELOG 抽段落 → 创建 GitHub Release ② 构建并推送多架构 Docker 镜像到 GHCR ③ typecheck / test / 包内容校验 → 把 a2wave 包发到公共 npm（带 provenance，需 NPM_TOKEN 仓库 secret） |
因此 package.json 与 apps/cli/package.json 的 version 必须始终一致，且都要与 tag 一致——两个 workflow 都会校验，不一致直接失败。
When to Use
- 用户要求发版、打 tag、创建 release
- 需要更新 CHANGELOG 并推送新版本
- 关键词：发版、release、tag、changelog
Core Workflow
flowchart LR
P[0. 前置检查] --> S[0.5 敏感 token 扫描]
S --> W[0.7 使用手册同步]
W --> A[1. 确定版本号]
A --> B[2. 写入 CHANGELOG]
B --> C[3. 创建 tag 并推送]
步骤 0：前置检查（必须全部通过）
- main 分支：
git branch --show-current必须为main。若非 main，中止并提示git checkout main后再执行。 - 与远程同步：在 main 分支时，必须先执行
git pull origin main（或git pull）。若 pull 产生冲突或失败，中止并提示用户解决后再发版。pull 成功后再进行后续检查。 - 测试通过：
pnpm test:all必须零失败。失败则中止。 - 工作区干净：
git status无未提交变更。若有其它未提交文件，提示用户先 commit 再发版。
步骤 0.5：敏感 token / 凭据扫描（HARD GATE，禁止跳过）
发版会把整份代码 tag 化并（主版本）触发 GitHub Release，一旦泄露的 secret 进入 tag，撤回成本极高。打 tag 前必须对将要发布的全量代码做一次密钥扫描：
# 全仓扫描（不只是本次 diff）——发版是整棵树的快照，必须全量
node scripts/gates/check-forbidden-tokens.mjs --all
- 该脚本覆盖 PEM 私钥、Anthropic key（
sk-ant-*）、AWS、通用高熵 token 等规则，allowlist 在scripts/gates/forbidden-tokens-allowlist.json。 - exit 0 → 通过，继续。exit 1 → 打印命中的「文件:行 规则」，立即中止发版：
- 若是真实泄露：先清理（移除/改用 env/轮换该凭据），涉及历史提交的需
git filter-repo或联系维护者，处理干净后重新走发版。 - 若是误报（占位值 / 公钥 / fixture）：把精确 literal 或路径前缀加进
forbidden-tokens-allowlist.json，commit 后再继续。禁止用--no-verify或跳过本步绕过。
- 若是真实泄露：先清理（移除/改用 env/轮换该凭据），涉及历史提交的需
- 补充人工核查：
git diff <上一个tag>..HEAD -- '*.env' '*.env.*' '**/config/**'快速扫一眼配置类文件有无硬编码密钥；.env、.kubeconfig、私钥文件等绝不允许进入 tag。
步骤 0.7：使用手册（Wiki）同步
若本次发布区间（<上一个tag>..HEAD）包含用户可感知的功能/流程/触发方式变更，站内使用手册（/wiki）必须已同步，否则用户拿到新版本却查不到用法。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 179 lines · 27 tokens per session scan A ea9003b38347
release-workflow is a skill published in the GitHub repository LilithGames/a2wave (24 stars, last pushed 4d ago), licensed Apache-2.0. It adds 27 tokens to every session and 3,037 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
herdr-pre-release-audit
Audit herdr release readiness by comparing commits since the base release against next-release changelog and docs. Use when asked to run or apply the repo's pre-release audit, validate docs/next before release, inspect issue refs that release CI will close, or finalize release docs for herdr.
release-core-test
Invoke when dev-testing a Cyrus change that spans CYPACK (edgeworker + CLI) and CYHOST (Vercel-hosted GUI) and the hosted GUI needs to point at an unreleased cyrus-core from this repo. Publishes cyrus-core (and claude-runner if needed) as a -test.N prerelease under the npm test dist-tag so CYHOST can install it via…
verify-and-ship
Run all quality checks (tests, lint, typecheck), fix failures, update the changelog, commit, push, and create/update the pull request or merge request.
release-cut
Cut a new pi-agent-dashboard release: promote ## [Unreleased] in CHANGELOG.md, bump every workspace package.json per SemVer, commit, tag v , and push — triggering the Release workflow that publishes every non-private workspace, builds the Electron artifacts, and creates a GitHub Release. Use on "cut a release"…
release-revoke
Revoke or rollback a pi-agent-dashboard release: delete the GitHub Release, remove the git tag locally and on origin, deprecate the npm version (npm unpublish is blocked after 72h), and optionally revert the release commit. Use when the user says "revoke release", "rollback release", "delete release", "unpublish…
release
Prepare, verify, publish, and finish a coordinated Cyrus CLI release. Use when a user asks to release Cyrus, publish cyrus-ai, run a CLI release, or perform the /release workflow.