codexu-release

codexU Release SOP

Scope

Run this skill from the repository root. Treat the release as a real public publish: verify the current remote state first, keep unrelated user changes out of release commits, and report exactly what was built, pushed, and released.

Do not trust a remembered "latest" version. Always confirm the current tag and release state with GitHub before choosing the next version.

Preflight

1. Inspect the worktree and branch:

git status --short
git branch --show-current
git remote -v

If unrelated files are dirty, do not stage or revert them. Either keep the release scoped to known release files or ask before mixing them into the release commit.

1. Confirm GitHub access and current releases:

gh --version
gh auth status
gh repo view --json nameWithOwner,url
gh release list --limit 10
git fetch origin --tags

1. Verify that the target v<version> tag and GitHub Release do not already exist unless the task is explicitly to repair or replace them.

Mandatory Global Memory-Risk Gate

Run this gate before changing release metadata, packaging, committing, tagging, pushing, or creating a GitHub Release:

make memory-risk-check
sed -n '1,240p' build/memory-risk/report.md

The scan covers the entire production source tree, not only the release diff. Treat any non-zero exit as a hard release blocker. There is no override flag: fix or explicitly bound the risky lifecycle before continuing.

Do not accept the PASS line without reviewing the generated global inventory. Inspect every reported risk category and the related release diff, with particular attention to:

• Process and Pipe: bounded stdout reads with partial-response semantics for long-lived pipes, drained or redirected stderr, EOF handling, timeout, termination, and forced cleanup.
• Timer, notification/KVO observers, event monitors, and Combine subscriptions: weak captures and matching invalidation/removal/cancellation.
• buffers, caches, samples, pending request maps, and static mutable collections: byte/count limits, eviction, timeout, and working-set release.
• Data(contentsOf:) and transcript/session readers: trusted input boundaries, file-size checks, streaming behavior, and oversized-record handling.
• recursive and parent-path traversal: explicit root/base termination, visited-node/path cycle guards, and regression coverage for platform-specific Foundation behavior.