Npm Release

npm-release

Publish @yya007/skill-finder to npmjs.com with a guided release workflow.

Agent Instructions

When this skill triggers, follow these steps in order. Stop and report any failure immediately.

---

Step 1 — Verify npm login

npm whoami

If the command fails or returns a user other than yya007, stop and tell the user: > "Not logged in to npm. Run npm login first."

---

Step 2 — Show current version

node -p "require('./package.json').version"

Report the current version to the user and ask what type of bump they want: patch, minor, or major — unless they already specified it.

---

Step 3 — OSS precheck

Run this before touching the package to catch anything that shouldn't ship.

3a — Secrets scan: search all tracked files for credentials.

git ls-files | xargs grep -l "ghp_[a-zA-Z0-9]\{36\}\|npm_[a-zA-Z0-9]\{36\}\|sk-[a-zA-Z0-9]\{32\}" 2>/dev/null

git ls-files | xargs grep -rn "password\s*=\s*['\"][^'\"]\|api_key\s*=\s*['\"][^'\"]\|secret\s*=\s*['\"][^'\"]" 2>/dev/null

If any real secrets are found (not placeholders like ghp_your_token_here or fake-token), stop immediately and tell the user.

3b — Sensitive files check: confirm no .env, credential, or key files are tracked.

git ls-files | grep -E "\.(env|key|pem|p12|pfx|crt|secret)$|credentials|\.npmrc$"

Any output here is a blocker — remove those files and purge from git history before proceeding.

3c — README accuracy check:

Check that the skill count in the README matches data/version.txt:

python3 -c "
import re, sys
readme = open('README.md').read()
version = open('data/version.txt').read()

# Extract actual count from version.txt
actual = int(re.search(r'skill_count:\s*(\d+)', version).group(1))

# Extract the rounded/displayed count from stats marker
m = re.search(r'stats:skill-count:start -->(.*?)&1

Show the user the list of files that would be included. Confirm:

• scripts/search.py, scripts/requirements.txt, scripts/__init__.py are present.
• scripts/fetch_skill.py and scripts/update_index.py are not present (developer-only tools, excluded from the npm package — available in the git repo).
• data/index.faiss, data/metadata.jsonl, data/version.txt are present.
• SKILL.md and plugin.json are present.
• No crawlers/, pipeline/, tests/, docs/, __pycache__/, or .sh files appear.

If unexpected files appear, stop and ask the user to review .npmignore and the files list in package.json.

---

Step 5 — Local smoke test

Pack the tarball and install it into a temporary directory to verify the package works end-to-end before publishing.

npm pack

mkdir -p /tmp/sf-release-test && \
  cd /tmp/sf-release-test && \
  npm install /yya007-skill-finder-*.tgz 2>&1

(Replace `` with the absolute path to the SkillFinder repo root.)

Verify the installed file tree is correct:

find /tmp/sf-release-test/node_modules/@yya007/skill-finder -type f | sort

Confirm:

• data/index.faiss, data/metadata.jsonl, data/version.txt exist.
• All five scripts/*.py files exist.
• SKILL.md and plugin.json exist.
• No __pycache__ or .sh files appear.

Install Python dependencies from the installed package:

pip install -r /tmp/sf-release-test/node_modules/@yya007/skill-finder/scripts/requirements.txt -q

Run a live search from the installed package location to confirm index loads and results are returned:

python /tmp/sf-release-test/node_modules/@yya007/skill-finder/scripts/search.py "deploy kubernetes" --no-json 2>&1 | head -20

The search must return at least one result with a name, star count, and install command. If it fails or returns no results, stop and investigate before publishing.

Clean up:

rm -rf /tmp/sf-release-test && rm -f yya007-skill-finder-*.tgz

---

Step 6 — Bump version

npm version  --no-git-tag-version

Use the bump type from Step 2. Report the new version (e.g. 0.1.0 → 0.1.1).

---

Step 7 — Publish

npm publish --access public

npm will prompt for a one-time password if 2FA is enabled. Tell the user to enter their authenticator code when prompted — or pass --otp if they provide it in advance.

On success, report: > "Published @yya007/skill-finder@ to npmjs.com" > "View: https://www.npmjs.com/package/@yya007/skill-finder"

---

Step 8 — Stamp the npm version on the release log, then commit and tag

Record the published npm version against the current index release in the release-history log (idempotent; keyed by data/version.txt date):

python pipeline/update_release_log.py --npm-version 

Then commit the bump + the log update and tag:

git add package.json data/release_log.jsonl docs/release-log.md
git commit -m "chore: bump npm version to "
git tag v

Ask the user: > "Push the version commit and tag to GitHub? [y/N]"

If yes:

git push && git push --tags

---

Step 9 — Report

Summarise:

• Package name and new version
• Files published
• npm URL
• Git tag (if pushed)

If the user found it helpful, remind them: > "If SkillFinder was useful, consider starring the repo: https://github.com/yya007/SkillFinder"

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: yya007
• Source: yya007/SkillFinder
• License: MIT
• Homepage: https://www.npmjs.com/package/@yya007/skill-finder

Install and usage instructions live in the source repository linked above.