From nexus-agents
Executes releases following project standards with checklists for code quality, security, docs, pipeline health, and publish race avoidance. Use for versioning, tagging, deploying via pnpm changesets.
npx claudepluginhub williamzujkowski/nexus-agentsThis skill is limited to using the following tools:
<!--
Executes release workflow: determines semantic version bump from PRs/commits, generates changelog, updates package.json, verifies lint/test/build, creates git tags, deploys, and monitors. For production releases.
Validates release readiness via sequential gated checklist: build, tests, security, typecheck, counts, diff review, changelog, version bump, commit, tag, push. Use before release commits.
Share bugs, ideas, or general feedback.
The pnpm changeset workflow handles versioning, but the human-judgment gates below decide whether the release is ready. Run all of these:
pnpm lint && pnpm typecheck && pnpm test — greenpnpm coverage — coverage hasn't regressed below the gate (89.66% statements, 93.26% functions per CLAUDE.md)TODO / FIXME / XXX comments in production source added in this release that should have been resolvedconsole.log debugging statements in production code@deprecated markers added in this release have a clear replacement and migration path (see deprecation-and-migration skill)pnpm audit shows no critical/high vulnerabilities (or each is documented + mitigated).env.example placeholder + docssecurity-scanning skill)gh api repos/{owner}/{repo}/dependabot/alerts?state=open returns cleanpnpm changeset was run)inject-governance.ts regen ran cleanly (CLAUDE.md skill table, AGENTS.md, marketplace.json all in sync)@deprecated references in docs/main succeeded (gh run list --workflow=Release --limit 5)gh pr list --search "version packages") — if one IS open, see "Avoid the publish race" belowIf you're merging a release PR while other PRs add changesets, you'll trigger the version-skip race documented in release-changeset-race.md. To avoid:
npm view nexus-agents version should match packages/nexus-agents/package.json# Verify all gates pass
pnpm lint && pnpm typecheck && pnpm test
# Check fitness score (must be >= 90)
nexus-agents fitness-audit --format=json
Releases are automated via changesets + GitHub Actions:
Add a changeset during development:
pnpm changeset
Merge PR to main — the Release workflow will:
No tokens required — npm authentication uses OIDC (see id-token: write
permission in .github/workflows/release.yml). The trusted publisher is
configured on npmjs.com to accept publishes from this repo's release.yml.
IMPORTANT: npm trusted publisher config must match workflow filename.
The npmjs.com package settings specify the exact workflow file (release.yml),
repository (williamzujkowski/nexus-agents), and environment. If you rename
the workflow file, update the npm trusted publisher config to match or
publishing will fail with OIDC token rejection.
# Manual publish via the same release workflow (uses OIDC, no tokens needed)
gh workflow run release.yml
# Or with dry run:
gh workflow run release.yml -f dry_run=true
npm unpublish nexus-agents@<version> # Within 72 hours
git tag -d v<version> && git push --delete origin v<version>
The project also has built-in release automation:
nexus-agents release-notes # Generate release notes
nexus-agents release-validate # Validate release readiness
nexus-agents release-announce # Announce release
| Excuse | Counter |
|---|---|
| "Skip the audit, dependencies are fine" | pnpm audit shows critical/high before they ship. Five seconds of audit prevents a coordinated-disclosure scramble. |
| "I'll fix the doc drift in the next release" | Documentation drift compounds. Block release on inject-governance and check-docs-indexed clean. |
| "We can roll back if it's bad" | npm unpublish only works <72h, and even then leaves the version "published" in semver caches. Pre-release gates prevent the need. |
| "The release PR is open, just merge it" | If other PRs are queued with new changesets, you'll trigger the publish race (#2382). Hold queue until release PR merges. |
pnpm audit shows critical/high vulnerabilitiesnpm view nexus-agents version doesn't match package.json after release-PR merge (publish race — see release-changeset-race.md)