release

A release checklist for publishing packages from a monorepo, a repository that contains multiple related packages. It covers code changes, pull requests, version updates, checks, and npm publishing.

In plain words
What is it for?
Use it when preparing package releases, especially changes involving the Node package or the MCP server package.
Why use it?
It makes the release sequence explicit and catches repository checks or wrapper synchronisation problems before publishing.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/transloadit/node-sdk/release
Any agent
npx skills add transloadit/node-sdk --skill release
Clone the repo
git clone --depth 1 https://github.com/transloadit/node-sdk

Made for: Claude Code, Codex.

Per session 22 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,518 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00022 $0.01518
Opus 5 $0.00011 $0.00759
Sonnet 5 $0.00004 $0.00304
Haiku 4.5 $0.00002 $0.00152

Measured 2d ago against content hash 6e1ecf94ec8d, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.ai/skills/release/SKILL.md · 100 lines

How it starts

The opening of the file, as written. The whole thing — 100 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Release Checklist

  1. Update local state:

    1. git checkout main && git pull
    2. git status --porcelain=v1 (must be clean)
  2. Prepare a code PR (feature/fix changes):

    1. Create branch from main
    2. Make changes
    3. If you touched packages/node (or anything that affects the legacy transloadit clone):
      1. Run corepack yarn check (this may reformat files and/or auto-fix Knip findings)
      2. Run corepack yarn verify:full locally once before pushing.
        • This catches wrapper sync drift early and still runs the deeper repo checks.
      3. If verify / verify:full fails with transloadit wrapper drift, run node scripts/prepare-transloadit.ts, commit the tracked packages/transloadit updates, and re-run corepack yarn verify:full.
    4. If you add a changeset for @transloadit/node, also add a similar changeset for @transloadit/mcp-server if it could affect its workings. The chances are, they are, since the latter is mostly a thin wrapper around the former.
      • This repo enforces a one-way coupling: node releases should also publish a new mcp-server version (but mcp-server releases do not require node releases).
      • yarn check/yarn verify will fail fast if you forget.
    5. Commit + push branch
    6. Open PR, wait for CI green
    7. Squash-merge the PR

    Notes:

    1. When creating PRs with gh pr create from a shell, avoid unescaped backticks in the --body string. Prefer --body-file to prevent accidental command substitution.
    2. If you use gh run watch heavily, GitHub may throttle with HTTP 429. Prefer gh pr checks <PR_NUMBER> with occasional polling (or use the web UI) if you hit throttling.

    Optional parity playbook (release/debug only):

    1. Update the parity baseline:
      1. node scripts/prepare-transloadit.ts
      2. node scripts/fingerprint-pack.ts ./packages/transloadit --ignore-scripts --quiet --out ./docs/fingerprint/transloadit-baseline.json
      3. cp ./packages/transloadit/package.json ./docs/fingerprint/transloadit-baseline.package.json
    2. Immediately reformat the baseline:
      1. corepack yarn fix:js
    3. Run corepack yarn parity:transloadit
    4. Commit + push if you intentionally want to update the recorded baseline
  3. Merge the "Version Packages" PR (changesets action):

    1. Wait for the Version Packages PR to appear (or update)
    2. Checkout that branch locally:
      1. git fetch origin changeset-release/main
      2. git checkout changeset-release/main
    3. Ensure yarn.lock is up to date (CI will fail otherwise):
      1. corepack yarn
      2. If yarn.lock changed: git add yarn.lock && git commit -m "chore: update yarn.lock for release" && git push
    4. Verify the Version Packages PR includes all expected linked/versioned packages:
      1. Read the # Releases section (this is the authoritative "what will publish")
      2. If you expect a linked package to bump (e.g. @transloadit/node and transloadit), ensure the PR updates both. If it doesn't, fix before merging (otherwise tags/releases can drift).
    5. Ensure CI is green for the PR
    6. Squash-merge the PR

    Notes:

    1. The Version Packages PR may show no required checks in the PR UI in some setups; verify by checking recent runs:
      1. gh run list --branch changeset-release/main --limit 3
  4. Immediately after merging the Version Packages PR:

    1. git checkout main && git pull
    2. Update the lockfile (required for the Release workflow):
      1. corepack yarn
      2. If yarn.lock changed: git add yarn.lock && git commit -m "chore: update yarn.lock for release" && git push
      3. Reason: the Release workflow runs corepack yarn with immutable installs and will fail if it would modify yarn.lock.
    3. Run corepack yarn check (catches formatting/knip/ts/unit drift early)
  5. Prevent the packages/transloadit clone from drifting (special case):

    1. If the transloadit package exists in this repo, keep it in sync with @transloadit/node by running:
      1. git checkout main && git pull
      2. node scripts/prepare-transloadit.ts
      3. Refresh parity baselines (if they changed):
        1. node scripts/fingerprint-pack.ts ./packages/transloadit --ignore-scripts --quiet --out ./docs/fingerprint/transloadit-baseline.json
        2. cp ./packages/transloadit/package.json ./docs/fingerprint/transloadit-baseline.package.json
      4. corepack yarn check
      5. If anything changed, commit + push to main

Read the full file on GitHub · 100 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 100 lines · 22 tokens per session scan A 6e1ecf94ec8d

Subscribe to this mod's changes

release is a skill published in the GitHub repository transloadit/node-sdk (73 stars, last pushed 2d ago), licensed MIT. It adds 22 tokens to every session and 1,518 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

netsuite-sdf-safe-guide

Comprehensive NetSuite SDF best practices based on the SAFE Guide (12 principles + appendices). Generates Object XML for all 14 script types, enforces governance limits, security patterns, and defensive coding. Includes N/cache, N/query, concurrency limits, OAuth 2.0 guidance, legacy TBA guardrails, CustomTool runtime…

oracle/netsuite-suitecloud-sdk · 104 tokens

netsuite-suitescript-upgrade

SuiteScript 1.0, 2.0, and 2.x to 2.1 migration assistant. Analyzes, converts, explains, and validates script upgrades. Covers 125+ API mappings, 34 object conversions, 13 unmapped API workarounds, all script type entry point changes, SuiteScript 2.0/2.x to 2.1 upgrade guidance, and 16 categories of breaking behavioral…

oracle/netsuite-suitecloud-sdk · 109 tokens

netsuite-suitescript-learning

Interactive learning system for NetSuite SDF development. Features six modes (learn, review, explain, annotate, quiz, and final) with SAFE Guide integration. Produces compliance-reviewed learning documentation. Learn topics like governance, N/cache, and security directly from SAFE Guide principles. Generate quizzes…

oracle/netsuite-suitecloud-sdk · 71 tokens

netsuite-uif-spa-reference

Use when building, modifying, or debugging NetSuite UIF SPA components. Provides API/type lookup for @uif-js/core and @uif-js/component (constructors, methods, props, enums, hooks, and component options).

oracle/netsuite-suitecloud-sdk · 58 tokens

provable-sdk-tutorial-docs

Use when writing tutorial documentation or create-leo-app examples for the Provable SDK (@provablehq/sdk). Covers how to structure runnable templates, write tutorial-style docs, and handle Node.js vs web runtime differences.

ProvableHQ/sdk · 51 tokens

netsuite-ai-connector-instructions

NetSuite Intelligence skill — teaches AI the correct tool selection order, output formatting, domain knowledge, multi-subsidiary and currency handling, and SuiteQL safety checklist for any AI + NetSuite AI Service Connector session.

oracle/netsuite-suitecloud-sdk · 52 tokens