Skills github-release-management
📦
github-release-management
Content revision r2 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables
Automate GitHub Releases with Coordinated Workflows
Manual releases can miss version, validation, artifact, and communication steps. This skill guides release planning, testing, publishing, deployment, monitoring, and rollback with reusable workflows.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "github-release-management" from https://skillstore.io/skills/ruvnet-github-release-management.md and its manifest at https://skillstore.io/api/skills/ruvnet-github-release-management/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "github-release-management". Plan a patch release from version 2.4.0 for three approved fixes.
Expected outcome:
- Recommended version: 2.4.1, pending review of the approved fixes.
- Pre-release: verify main, run tests, scan dependencies, and draft notes.
- Release: create a protected tag, publish signed artifacts, and retain manual deployment approval.
- Post-release: validate health metrics, announce availability, and retain rollback target 2.4.0.
Using "github-release-management". Create release notes for version 3.0.0 with one breaking API change.
Expected outcome:
- Release 3.0.0 introduces the new account API and removes the deprecated profile endpoint.
- Migration required: update profile requests before deployment and verify client compatibility.
- Known limitation: legacy clients require the compatibility adapter during transition.
Using "github-release-management". Review a proposed GitHub Actions release workflow for operational risk.
Expected outcome:
- Blocker: the npm token remains in a repository file during the Docker build.
- High priority: replace mutable package versions and reduce job permissions.
- Required gate: keep human approval before production publishing and verify rollback readiness.
Security Audit
High Riskv8 • 7/23/2026 Open versioned report
Most alerts are false positives from Markdown fences, quoted substitutions, documentation URLs, and relative links. Six static findings remain for shared temporary files and persisted release credentials. Additional risks include mutable package execution, untrusted metadata entering AI generation, and emergency gate bypasses.
1
Files scanned
1,065
Lines analyzed
5
Review items
0
False positives ignored
Confirmed security concerns (4)
High
NPM config file (may contain tokens)
echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > .npmrc
The workflow writes NPM_TOKEN in plaintext to repository-root .npmrc, then builds Docker context from that directory. Without exclusion and cleanup, later steps can expose the token.
High
Mutable Package Execution in a Privileged Release Job
The workflow repeatedly executes claude-flow@alpha after storing GitHub credentials and, later, while a token-bearing .npmrc exists.
The commands run a mutable npm prerelease in a privileged job. Package compromise could expose repository or registry credentials.
Medium
Untrusted Repository Metadata Enters AI Changelog Generation
PR titles and commit messages enter AI-driven changelog generation without trust boundaries, validation, or instructions to ignore embedded directives.
The data flow is explicit, and the skill describes intelligent changelog generation. The downstream tool behavior is unavailable, which limits certainty.
Medium
Emergency Release Flow Bypasses Normal Gates
Emergency commands recommend bypassing checks and fast-tracking publication, which can deploy insufficiently tested changes when labels or issue context are misused.
The bypass and fast-track flags are explicit in release examples. Their exact enforcement depends on the external Claude Flow implementation.
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Git platform tokens
run: echo "${{ secrets.GITHUB_TOKEN }}" | gh auth login --with-token
The workflow expands GITHUB_TOKEN into a shell pipeline and persists gh authentication before executing mutable npm tooling. Step-scoped GH_TOKEN access would reduce credential exposure.
Medium
Temp directory access
echo "$PRS" > /tmp/release-prs.json
The workflow writes release metadata to a predictable shared /tmp path without exclusive creation or permissions. Shared runners permit collisions, disclosure, or symlink redirection.
Medium
Temp directory access
echo "$COMMITS" > /tmp/release-commits.txt
The workflow writes release metadata to a predictable shared /tmp path without exclusive creation or permissions. Shared runners permit collisions, disclosure, or symlink redirection.
Medium
Temp directory access
--prs "$(cat /tmp/release-prs.json)" \
The workflow reads a predictable shared /tmp file without ownership or integrity checks. A concurrent process can replace the content and influence generated release output.
Medium
Temp directory access
--commits "$(cat /tmp/release-commits.txt)" \
The workflow reads a predictable shared /tmp file without ownership or integrity checks. A concurrent process can replace the content and influence generated release output.
Risk Factors
⚙️ External commands (50)
SKILL.md:14-26 SKILL.md:26-29 SKILL.md:29-35 SKILL.md:35-72 SKILL.md:72-86 SKILL.md:86-89 SKILL.md:89-95 SKILL.md:95-98 SKILL.md:98-106 SKILL.md:106-109 SKILL.md:109-124 SKILL.md:124-133 SKILL.md:133-149 SKILL.md:149-152 SKILL.md:152-174 SKILL.md:178-200 SKILL.md:200-205 SKILL.md:205-222 SKILL.md:222-232 SKILL.md:232-239 SKILL.md:239-249 SKILL.md:249-256 SKILL.md:256-266 SKILL.md:266-273 SKILL.md:273-276 SKILL.md:276-283 SKILL.md:283-292 SKILL.md:292-314 SKILL.md:316-317 SKILL.md:317-322 SKILL.md:322-350 SKILL.md:350-353 SKILL.md:353-361 SKILL.md:361-366 SKILL.md:366-374 SKILL.md:374-377 SKILL.md:377-395 SKILL.md:395-400 SKILL.md:400-410 SKILL.md:410-413 SKILL.md:413-425 SKILL.md:428-434 SKILL.md:437-438 SKILL.md:438-447 SKILL.md:447-557 SKILL.md:557-562 SKILL.md:562-578 SKILL.md:578-581 SKILL.md:581-589 SKILL.md:589-592
🌐 Network access (6)
📁 Filesystem access (6)
🔑 Env variables (1)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/ruvnet-github-release-management/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/ruvnet-github-release-management?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/ruvnet-github-release-management?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/ruvnet-github-release-management/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/ruvnet-github-release-management.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
ruvnet. (2026). github-release-management security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/ruvnet-github-release-management/audits/8BibTeX citation
@techreport{ruvnet-ruvnet-github-release-management-2026,
author = {ruvnet},
title = {github-release-management security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/ruvnet-github-release-management/audits/8},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "github-release-management security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "ruvnet"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/ruvnet-github-release-management/audits/8"
identifiers:
- type: other
value: "skillstore:ruvnet-github-release-management:audit:8"
description: "Skillstore immutable audit report identifier"
Compare variants
2 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Higher Skillstore usage
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
ruvnet-github-release-management
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 10
Updated
2026-08-21
dnyoussef-github-release-management
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 6
Updated
2026-08-21
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
70
Community
70
Spec Compliance
What You Can Build
Prepare a routine package release
A maintainer plans a semantic version, validates changes, drafts notes, publishes artifacts, and completes post-release checks.
Standardize an organization release
A release manager converts existing controls into a staged GitHub workflow with approvals, monitoring, announcements, and rollback criteria.
Coordinate dependent repositories
A DevOps engineer sequences compatible versions across services, validates integrations, and defines an atomic rollback plan.
Try These Prompts
Plan a patch release
Plan a patch release for [repository] from [current version]. List prerequisites, validation steps, GitHub release actions, and a rollback checkpoint.
Draft reviewed release notes
Create release notes for [version] from these approved changes: [changes]. Group features, fixes, breaking changes, upgrade steps, contributors, and known issues.
Design a protected release workflow
Design a GitHub Actions workflow for [project]. Include least-privilege permissions, pinned dependencies, tests, artifact signing, approvals, publishing, monitoring, and credential cleanup.
Coordinate a multi-repository release
Coordinate releases for [repositories and versions] with [dependencies]. Define sequencing, compatibility gates, staged deployment, observability, failure handling, atomic rollback, and communications.
Best Practices
- Verify installed commands, supported flags, and exact dependency versions before running a release.
- Create draft releases first, preserve protected approvals, and review generated notes before publication.
- Use least-privilege permissions, step-scoped secrets, private temporary files, and explicit credential cleanup.
Avoid
- Do not execute mutable prerelease packages inside jobs holding repository or registry credentials.
- Do not publish from unreviewed branches or bypass required validation because a release is urgent.
- Do not write credentials into repository files or release data into predictable shared temporary paths.
Frequently Asked Questions
Does this skill execute releases automatically?
It provides commands, workflow examples, and coordination guidance. Execution depends on the connected tools, credentials, and user approvals.
Which access is required?
Required access depends on the workflow. GitHub releases need repository permissions, while package and container publishing need separate scoped credentials.
Which project types are supported?
The examples emphasize Node.js packages, Docker images, binaries, monorepos, and multiple repositories. Other projects require adapted build and publishing steps.
How should credentials be protected?
Use step-scoped environment variables, least-privilege tokens, protected environments, secret masking, private temporary files, and immediate cleanup.
Can the guidance work without Claude Flow?
Core GitHub CLI and checklist guidance can be adapted independently. Swarm coordination and Claude Flow subcommands require the external package.
Does this replace release review?
No. Review version decisions, generated notes, security results, artifacts, approvals, deployment health, and rollback readiness before publication.