A release checklist for publishing packages from a monorepo, a repository that contains multiple related packages. It covers code changes, pull requests, version updates, checks, and npm publishing.

Use it when preparing package releases, especially changes involving the Node package or the MCP server package.

It makes the release sequence explicit and catches repository checks or wrapper synchronisation problems before publishing.

How transloadit/node-sdk configures Claude Code and Codex

Reuse

Borrowing it

Nothing to install: this file belongs to transloadit/node-sdk. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/transloadit/node-sdk/main/.ai/skills/release/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/transloadit/node-sdk

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/transloadit/node-sdk/release/github.svg)](https://agentmods.dev/skills/transloadit/node-sdk/release)

Your own site

<a href="https://agentmods.dev/skills/transloadit/node-sdk/release"><img src="https://agentmods.dev/badge/skills/transloadit/node-sdk/release/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/transloadit/node-sdk/release"><img src="https://agentmods.dev/badge/skills/transloadit/node-sdk/release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 22 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,634 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector pass 7 Sept 2026

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00022	$0.01634
Opus 5.5	$0.00009	$0.00654
Sonnet 5.5	$0.00004	$0.00327
Haiku 4.5	$0.00002	$0.00163

Measured 12d ago against content hash b758b4fbfbdc, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.ai/skills/release/SKILL.md · 106 lines

How it starts

The opening of the file, as written. The whole thing — 106 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Release Checklist

Update local state:
1. git checkout main && git pull
2. git status --porcelain=v1 (must be clean)
Prepare a code PR (feature/fix changes):
1. Create branch from main
2. Make changes
3. If you touched packages/node (or anything that affects the legacy transloadit clone):
  1. Run corepack yarn check (this may reformat files and/or auto-fix Knip findings)
  2. Run corepack yarn verify:full locally once before pushing.
    - This catches wrapper sync drift early and still runs the deeper repo checks.
  3. If verify / verify:full fails with transloadit wrapper drift, run node scripts/prepare-transloadit.ts, commit the tracked packages/transloadit updates, and re-run corepack yarn verify:full.
4. Classify changes using the versioning policy.
  - API2 contract type/schema changes ship in minors, with a Contract: summary and a Type-breaking: line per type break. Description-only syncs are patches; pre-1.0 package exceptions follow the policy.
  - Every major changeset must contain a nonempty SDK-breaking: line naming the SDK surface it breaks. yarn lint:changesets enforces this for each file.
5. If you add a changeset for @transloadit/node, also add a similar changeset for @transloadit/mcp-server if it could affect its workings. The chances are, they are, since the latter is mostly a thin wrapper around the former.
  - This repo enforces a one-way coupling: node releases should also publish a new mcp-server version (but mcp-server releases do not require node releases).
  - yarn check/yarn verify will fail fast if you forget.
6. Commit + push branch
7. Open PR, wait for CI green
8. Squash-merge the PR
Notes:
1. When creating PRs with gh pr create from a shell, avoid unescaped backticks in the --body string. Prefer --body-file to prevent accidental command substitution.
2. If you use gh run watch heavily, GitHub may throttle with HTTP 429. Prefer gh pr checks <PR_NUMBER> with occasional polling (or use the web UI) if you hit throttling.
Optional parity playbook (release/debug only):
1. Update the parity baseline:
  1. node scripts/prepare-transloadit.ts
  2. node scripts/fingerprint-pack.ts ./packages/transloadit --ignore-scripts --quiet --out ./docs/fingerprint/transloadit-baseline.json
  3. cp ./packages/transloadit/package.json ./docs/fingerprint/transloadit-baseline.package.json
2. Immediately reformat the baseline:
  1. corepack yarn fix:js
3. Run corepack yarn parity:transloadit
4. Commit + push if you intentionally want to update the recorded baseline
Merge the "Version Packages" PR (changesets action):
1. Wait for the Version Packages PR to appear (or update)
2. Checkout that branch locally:
  1. git fetch origin changeset-release/main
  2. git checkout changeset-release/main
3. Ensure yarn.lock is up to date (CI will fail otherwise):
  1. corepack yarn
  2. If yarn.lock changed: git add yarn.lock && git commit -m "chore: update yarn.lock for release" && git push
4. Verify the Version Packages PR includes all expected linked/versioned packages:
  1. Read the # Releases section (this is the authoritative "what will publish")
  2. If you expect a linked package to bump (e.g. @transloadit/node and transloadit), ensure the PR updates both. If it doesn't, fix before merging (otherwise tags/releases can drift).
5. Ensure CI is green for the PR
6. Squash-merge the PR
Notes:
1. The Version Packages PR may show no required checks in the PR UI in some setups; verify by checking recent runs:
  1. gh run list --branch changeset-release/main --limit 3
Immediately after merging the Version Packages PR:
1. git checkout main && git pull
2. Update the lockfile (required for the Release workflow):
  1. corepack yarn
  2. If yarn.lock changed: git add yarn.lock && git commit -m "chore: update yarn.lock for release" && git push
  3. Reason: the Release workflow runs corepack yarn with immutable installs and will fail if it would modify yarn.lock.
3. Run corepack yarn check (catches formatting/knip/ts/unit drift early)

Read the full file on GitHub · 106 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

12d ago Changed · +6 lines b758b4fbfbdc
2mo ago First seen · 100 lines · 22 tokens per session scan A 6e1ecf94ec8d

Subscribe to this mod's changes

release is a skill published in the GitHub repository transloadit/node-sdk (73 stars, last pushed 2d ago), licensed MIT. It adds 22 tokens to every session and 1,634 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

DevOps and cloud Git and workflow Releases encoding file-api javascript sdk transloadit uploading

draft-release-notes

Author the committed release-notes file for a Prisma 8 release (stable or 8.0.0-rc.N) by enumerating the merged PRs since the previous release v tag (stable or -rc.N), resolving opaque TML-NNNN: titles via Linear context (never copied verbatim), triaging public-worthiness, and writing categorized notes — breaking…

prisma/orm · 174 tokens

publish-npm-version

Cuts the next release of Prisma 8: bumps the root package.json version (on the v8 RC line: 8.0.0-rc.N → rc.N+1), propagates it to every workspace package, and opens a PR titled "chore(release): bump to ". When the maintainer merges the PR, the Publish to npm workflow runs automatically and ships the new version to npm…

prisma/orm · 182 tokens

playground-snapshot-release

Publish a Playground UI snapshot (@mastra/playground-ui, @mastra/observability, and their workspace dependencies) from main or the current branch via the playground-snapshot mode of the Publish to npm workflow, wait for it to finish, then open a PR on mastra-ai/platform bumping the frontend to the published snapshot…

mastra-ai/mastra · 104 tokens

pr-snapshot-release

Guide a Mastra maintainer through publishing an npm snapshot from a pull request or a specified repository branch. Use when asked to release, publish, or create a PR snapshot, branch snapshot, canary package build, or branch-specific npm tag. Performs source and branch preflight checks, requires confirmation before…

mastra-ai/mastra · 88 tokens

publish-release

Cut and publish a versioned release of @loopdive/js2 + the js2wasm proxy — bump both manifests in lockstep, land a reviewed release PR, then push the vX.Y.Z tag that triggers npm/JSR publish. Use this whenever the user wants to release, publish, ship, cut, or tag a version, bump the version number, push a release tag…

loopdive/js2 · 183 tokens

bump-sdk-version

Bump the FutureSearch SDK version across all files. Use when releasing a new SDK version, updating version numbers, or the user says bump version, release, version bump.

futuresearch/futuresearch-python · 40 tokens

node-sdk: Skill for Claude Code