# Release Finalize

> Finalize a product release and prepare the repo for a public push or deploy — updates the changelog and root README, scans for secrets and version consistency, creates an annotated git tag. Does NOT merge, push, or deploy. Universal — auto-detects release artifacts, optional .release-finalize.yml overrides. Manual-invocation only via /release-finalize — the skill does not self-activate.

- **Type:** Skill
- **Install:** `agentstack add skill-kirkruglov-officina-release-finalize`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [KirKruglov](https://agentstack.voostack.com/s/kirkruglov)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [KirKruglov](https://github.com/KirKruglov)
- **Source:** https://github.com/KirKruglov/OFFICINA/tree/main/skills/release-finalize

## Install

```sh
agentstack add skill-kirkruglov-officina-release-finalize
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Release Finalize

Gathers the release artifacts of any product and prepares the repository for a push to a public
repository or a deploy. Runs autonomously: a single checkpoint before applying edits, then a
straight run to the tag with no intermediate confirmations.

Invocation is manual only, via `/release-finalize` — the skill never self-activates.

## Scope of responsibility

- ✅ Changelog — prepend a new section (Keep a Changelog / SemVer).
- ✅ Root `README.md` — sync to the release context.
- ✅ Pre-publish scan — secrets, version consistency, clean tree.
- ✅ Annotated git tag on HEAD.
- ❌ merge — forbidden.
- ❌ `git push`, deploy — only suggest the command, never run it.

Artifacts are auto-detected; overrides come from a `.release-finalize.yml` file at the root of the
target repo (format — this skill's `templates/release-config.yml`, e.g.
`${CLAUDE_SKILL_DIR}/templates/release-config.yml` in Claude Code).

## Process indication

At the start of each phase, print a status line:

`[release-finalize]  :  []`

Reserved emoji: `🛑` stop/block · `❓` clarification · `⏸️` awaiting approval · `✅` finish.
Working actions use a per-phase topical emoji (`🧭 🔎 ✍️ 📝 🏷️` and the like).

## Checklist (run plan)

Before Phase 0, print the plan and create one TodoWrite task per phase; track status via TodoWrite.
The list is fixed and executed in order:

1. Detect — version, branch, artifacts, commits
2. Scan — secrets, version consistency, cleanliness
3. Draft — changelog draft + README edits
4. Apply — apply changelog and README (after approval)
5. Commit — delegate to `committing-changes`
6. Tag — annotated tag
7. Hand-off — summary and commands

## Workflow

Phases 0–2 run autonomously. Between Phase 2 and Phase 3 there is a single `⏸️` checkpoint.
Phases 3–6 run autonomously, with no further confirmations.

### Phase 0 — Detect

Status: `[release-finalize] 🧭 Gathering release context: `

1. Release version `X.Y.Z` — **source of truth: the command argument (`$1`) or the user's message**.
   If not given — try to extract it from version files; still missing → `❓` "Specify the release
   version (e.g. 0.2.0)". Version files serve only for the consistency check (Phase 1); they do not
   determine the release version.
2. Read `.release-finalize.yml` at the repo root, if present, and take its overrides (changelog,
   readme, version_files, branch_pattern, public_prep). No file — work off auto-detection.
3. Determine the artifacts (honoring overrides):
   - changelog: `CHANGELOG.md`, otherwise `HISTORY.md`; if neither exists → mark a new
     `CHANGELOG.md` (heading `# Changelog`) for creation in Phase 3;
   - readme: the root `README.md`;
   - version files: `pyproject.toml`, `package.json`, `VERSION`, `Cargo.toml` (whichever are present).
4. Branch: `git rev-parse --abbrev-ref HEAD`. If `branch_pattern` is set and the branch does not
   match — warn, but do not stop.
5. Latest tag: `git describe --tags --abbrev=0`. If a tag exists →
   `git log ..HEAD --oneline`; no tags → `git log --oneline`. Keep the list as reference for
   Phase 2.

### Phase 1 — Scan

Status: `[release-finalize] 🔎 Checking readiness to publish`

1. Clean tree: `git status --porcelain`. Non-empty → `🛑`, list the files, offer stash /
   `committing-changes` / cancel.
2. Secrets: `git grep -nIE` on assignment patterns, not bare words —
   `(AKIA[0-9A-Z]{16}|BEGIN [A-Z ]*PRIVATE KEY|(api[_-]?key|secret|token|password)[[:space:]]*[=:][[:space:]]*['"])`
   and on the paths from `public_prep.exclude` (e.g. `.env`). On a hit → `🛑`, show file:line (do
   not print the full value), stop.
3. Version consistency: read the version in each version file, compare with `X.Y.Z`. On a
   mismatch → `🛑`, show a file→version table.
4. `.gitignore` / stray files: from `git status` and any un-ignored private paths — `⚠️`, list them
   for review (not a stop).

### Phase 2 — Draft

Status: `[release-finalize] ✍️ Preparing changelog and README edits`

1. Group the commits from Phase 0 by conventional-commit type (`feat` → Added, `fix` → Fixed,
   `docs`/`refactor`/`chore` → Changed, `BREAKING` → its own block). Read the template
   `templates/changelog-entry.md` (e.g. `${CLAUDE_SKILL_DIR}/templates/changelog-entry.md`).
2. Assemble the section: `{VERSION}`→X.Y.Z, `{DATE}`→today (the system `Today's date`),
   `{NARRATIVE}`→2–3 points on the essence of the release, `{CHANGES_LIST}`→a minimal list of
   `- module: what changed`.
3. README: prepare a generic sync to the release context (version / component status, if such
   sections exist; no hardcoding of specific sections). If there are no obvious edits — leave the
   README unchanged.

### Checkpoint `⏸️`

Status: `[release-finalize] ⏸️ Awaiting approval: vX.Y.Z`

Show in one block: the version, branch, detected artifacts, the Phase 1 scan report, the prepared
changelog section, and the proposed README edits (before/after). Ask (via `AskUserQuestion`):
"Apply? (ok / edits)". Do not touch files until `ok`.

### Phase 3 — Apply

Status: `[release-finalize] 📝 Applying edits`

Changelog exists → prepend the section (insert before the first `##`). Does not exist → create
`CHANGELOG.md` with heading `# Changelog` and the first release section. Apply the README edits, if
any.

### Phase 4 — Commit

Status: `[release-finalize] 📦 Committing the finalization`

Delegate to the `committing-changes` skill with the context "release vX.Y.Z: changelog + README".
Do not proceed to Phase 5 until it completes.

### Phase 5 — Tag

Status: `[release-finalize] 🏷️ Creating the tag`

```
git tag -a vX.Y.Z -m "Release vX.Y.Z"
git rev-parse vX.Y.Z
```

### Phase 6 — Hand-off

Status: `[release-finalize] ✅ Release vX.Y.Z finalized`

Print the summary and next steps (do not run the commands):

```
Release vX.Y.Z finalized:
  ✅ changelog — section vX.Y.Z added
  ✅ README — synced
  ✅ git tag vX.Y.Z on 

Next:
  • merging-branches — merge the release branch → main
  • git push origin vX.Y.Z — publish the tag
  • deploy — per the product's procedure
```

## Boundaries (what the skill does not do)

- Does not run `git merge`, `git push`, `git branch -D`, or a deploy — only suggests the commands.
- Does not touch files outside the declared artifact set (changelog, root README).
- On a secret hit or a version mismatch — `🛑`, does not silently continue.
- Does not apply edits before approval at the `⏸️` checkpoint.
- Version bump in version files (`pyproject.toml` / `package.json` / …) is out of scope and must be
  done before the skill runs; Phase 1 only checks consistency.
- Bash: do not use `git -C `; the working directory is already set; avoid compound `&&`
  commands for read-only calls.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [KirKruglov](https://github.com/KirKruglov)
- **Source:** [KirKruglov/OFFICINA](https://github.com/KirKruglov/OFFICINA)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-kirkruglov-officina-release-finalize
- Seller: https://agentstack.voostack.com/s/kirkruglov
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.