A release workflow for preparing, checking, auditing, and publishing a software release.

Use it for release-readiness checks, security audits, health checks, release audits, version bumps, and publishing.

It brings tests, security, documentation, changelog, code health, and dependency checks into one release process.

How Smart-AI-Memory/attune-ai configures Claude Code and Codex

Reuse

Borrowing it

Nothing to install: this file belongs to Smart-AI-Memory/attune-ai. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/Smart-AI-Memory/attune-ai/main/.agents/skills/release/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/Smart-AI-Memory/attune-ai

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/smart-ai-memory/attune-ai/release/github.svg)](https://agentmods.dev/skills/smart-ai-memory/attune-ai/release)

Your own site

<a href="https://agentmods.dev/skills/smart-ai-memory/attune-ai/release"><img src="https://agentmods.dev/badge/skills/smart-ai-memory/attune-ai/release/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/smart-ai-memory/attune-ai/release"><img src="https://agentmods.dev/badge/skills/smart-ai-memory/attune-ai/release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 6 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 813 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector pass 7 Sept 2026

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00006	$0.00813
Opus 5.5	$0.00002	$0.00325
Sonnet 5.5	$0.00001	$0.00163
Haiku 4.5	$0.00001	$0.00081

Measured 1mo ago against content hash 13ac759dd837, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/release/SKILL.md · 126 lines

How it starts

The opening of the file, as written. The whole thing — 126 lines — stays where its author put it; the contents beside it link to each section on GitHub.

release

Release preparation, validation, and publishing.

Routes

Subcommand	Action
`prep`	Release readiness checks
`security`	Pre-release security audit
`health`	Code health check
`audit`	Release-audit stage — what class of defect could this release introduce?
`publish`	Version bump and publish

Usage

/release                # Ask what to do
/release prep           # Release prep checks
/release security       # Security audit
/release health         # Health check
/release audit          # Release-audit stage (packet + sitting)
/release publish        # Publish release

Behavior

prep

Run release preparation workflow:

uv run attune workflow run release-prep

This checks:

Test suite passes
No critical security issues
Documentation is current
Changelog is updated

security

Run security audit focused on release readiness:

uv run attune workflow run security-audit --path src/

health

Run code health checks:

Test coverage
Lint status
Type check status
Dependency audit

audit

The release-audit stage (docs/specs/release-audit-stage/). The other release surfaces check hygiene; this one asks what class of defect THIS diff could have introduced. It sits every release (D2) — an empty residual still sits, which is cheap by design.

python -m attune.classes.stage --repo <owner/name>

Six steps: baseline (merge-base vs the last release tag) -> reconcile (CLOSED gates green in CI, bound to this head SHA) -> sweep (rules over the changed src/ surface, D10) -> residual packet -> sitting (three seats, one round) -> chair rules.

Exit codes are the contract:

Code	Meaning	What to do
0	Ready for the chair	Rule each residual item
1	Aborted	Read `aborted_at` — a red reconcile means fix CI first; seats never sit on a broken baseline
2	Residual exceeds schema v1	Split the release. The chair splits; the tool re-runs each partition. Never truncate.

Read the full file on GitHub · 126 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 126 lines · 6 tokens per session scan A 13ac759dd837

Subscribe to this mod's changes

release is a skill published in the GitHub repository Smart-AI-Memory/attune-ai (10 stars, last pushed today), licensed Apache-2.0. It adds 6 tokens to every session and 813 once invoked, about $0.0000 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Cost Optimization Git and workflow LLM Multi-Agent Releases ai claude developer-tools

launch

Planning releases and reporting delivery work from GitHub PR history. Use when versioning, CHANGELOGs, rollout or rollback plans, engineering metrics, retrospectives, or stakeholder reports are needed.

simota/agent-skills · 40 tokens

changelog-writer

Use when a release needs a changelog entry drafted from merged pull requests, grouped by the kind of change rather than by the order they landed.

3338902669-ops/agent-orchestra · 34 tokens

release-prep

Prepare release documentation including CHANGELOG entry, announcement text, and validation. Run before tagging a new release.

massgen/MassGen · 25 tokens

massgen-release-documenter

Guide for following MassGen's release documentation workflow. This skill should be used when preparing release documentation, updating changelogs, writing case studies, or maintaining project documentation across releases.

massgen/MassGen · 42 tokens

agent-framework-py-release

Use when cutting a Python release for the microsoft/agent-framework monorepo. Triggers on "bump py versions", "cut a python release", "prepare release PR for python", "release py packages", "bump python to X.Y.Z", or similar requests to bump Python package versions and prepare a release PR. Handles all four lifecycle…

microsoft/agent-framework · 103 tokens

github

GitHub via gh CLI: PRs, issues, reviews, repos, auth.

NousResearch/hermes-agent · 19 tokens

attune-ai: Skill for Claude Code