release-builder

---

name: release-builder description: Used when the user wants to package, deploy, publish, or go live, or when project development is complete and ready for delivery. Covers Web deployment, Desktop packaging, and CLI publishing, with built-in privacy audit and smoke testing. version: 1.1.0 updated: 2026-05-30 requires: []

[Task] Execute the full build-package-test-publish lifecycle according to project type. Ensure the release artifact: can be installed, can run, has no privacy leaks, has no security vulnerabilities.

[Not For] - Writing code or features -> use /dev-builder instead - Fixing bugs found during testing -> use /bug-fixer instead - Reviewing code quality -> use /code-review instead - Projects with no code yet -> use /dev-builder first

[Dependency Check] Executed on demand after requirements gathering, based on the user's chosen release channel.

Basic checks:
- Project code exists -> if no code, prompt to call /dev-builder first
- git available
- Build tools available
- package.json exists

Channel checks:
- Based on the user's chosen release channel, check the required CLI tools and authentication status for that channel
- User only wants to package (not publish) -> skip deployment tool checks

Installation strategy:
- Missing tools: the Agent autonomously determines the installation method and installs directly
- Operations requiring user login/authentication: prompt the user to complete authentication
- When user-specific assets like signing certificates are missing, explain what is needed and guide the user to prepare

Optional:
- Product-Spec.md -> if available, cross-reference features for smoke testing
- `.forge/security-guidance.md` -> if present, **read before release**
- `.forge/preflight.json` -> if present, **run `pnpm preflight`** before publish; exit code 1 = blocked (see `core/docs/external-publish-preflight.md`)

[First Principles] Release 前必读 references/first-principles.md

[Output Style] → references/output-style.md（发布工程师风格）

[File Structure] release-builder/ ├── SKILL.md ├── commands/release-builder.md └── references/ ├── first-principles.md ├── output-style.md ├── workflow.md # Step 1–8（必读） ├── release-checklist.md # 版本/构建/隐私/依赖/Git ├── release-strategy.md # Web / Desktop / CLI ├── rollback-strategy.md ├── finishing-branch-checklist.md ├── anti-rationalization.md ├── anti-ai-slop-checklist.md └── yolo-mode.md

[Gotchas] Privacy leaks in build artifacts: Always grep for /Users/, C:\Users\, API_KEY, sk-ant- before packaging. Skipping smoke test: Run the binary / hit homepage / verify core flow — compilation ≠ shippable. Version tag mismatch: package.json, git tag, and artifact name must match. Build cache pollution: rm -rf dist && before final build when in doubt.

[Anti-Rationalization Checklist] → references/anti-rationalization.md 遇 skipping smoke test / skipping privacy audit / skipping rollback plan 时读取。

[Output Artifacts] - Build artifacts — .next/, dist/, release/ and other build output directories - Deployment URL (Web) — production environment access address - npm package publish (CLI) — version on npm registry - Git tag — v[version] tag + GitHub Release (optional)