Goal
Prepare and operate a release through repository-owned hosted workflows without creating local tags or releases.
When to use
- The user asks to prepare, review, or draft a release.
- Release setup, component impact, generated version PRs, protected publication, evidence, or OpenAI handoff needs review or execution.
When not to use
- The user wants a PR review before merge; use
pr-review. - The user wants a repository-wide maintenance audit; use
repo-health-audit. - The repository has no explicit hosted release contract; first inspect its native instructions and ADRs.
Inputs
- Requested command and its exact arguments.
- Repository release configuration, manifest, component versions, hosted runs, release environment policy, and publication evidence.
Inputs to inspect
- Inspect the repository-native
release:managesurface before selecting a route. - Check accepted ADRs, current branch/SHA, release history, component versions, hosted validation, environment policy, and evidence by layer.
Process
- Select exactly one supported workflow from the finite set below.
- Verify repository identity, protected state, and the requested command's authority.
- Run the repository-owned command. Read-only commands need no mutation approval;
every hosted dispatch or approval must include
--confirm. - Report local, hosted, publication, evidence, and portal state separately.
- Stop at the next approval or manual portal boundary.
Workflow
The complete workflow set is:
status— read-only release and workflow state.setup-check— read-only App, secret, lifecycle-label, environment, branch, and workflow preflight.impact --kind patch|minor|breaking [--skill <name>]— read-only component-impact guidance.release-pr --confirm— dispatch Release Please to create or update its draft PR.publish-plan --confirm— dispatch the read-only hosted publication plan.publish --confirm— dispatch protected publication and wait for environment approval.approve --run-id <id> --confirm— approve the waitingreleaseenvironment deployment.post-release --tag vX.Y.Z --confirm— dispatch tag-bound evidence on protectedmain.openai-handoff --tag vX.Y.Z— read-only handoff checklist after verifying the latest three-asset release and a newer successful exact-tag Evidence run.
On a bare or materially ambiguous invocation, show this set and ask which outcome the user wants. When intent and authority are clear, announce the selected route and proceed.
Decision points
- Feature PRs raise affected component versions; Release Please alone changes the root manifest, package version, and release changelog section.
publish-planproves readiness only;publishadditionally crosses the protected environment boundary.- Post-release evidence and OpenAI portal publication are distinct completion layers.
Safety rules
- Never create a tag or GitHub Release locally.
- Never bypass
--confirm, the hosted workflow, or the protected environment. - Do not include secrets or private incident details in release notes.
- Do not claim hosted validation, publication, evidence, or portal completion unless verified at that exact layer and revision.
- OpenAI upload and portal asset edits remain manual external actions unless the user separately authorizes them.
References
Read only when needed:
references/release-checklist.mdfor preflight.references/changelog-template.mdfor changelog entries.
Scripts
No bundled scripts.
Output format
Return:
- Selected workflow and exact command
- Current state by evidence layer
- Result or blocker
- Next approval/manual action
Failure modes
- Missing App, secret, Release Please lifecycle labels, or environment configuration blocks hosted mutations.
- A missing successful Validate run blocks publication.
- Mismatched or immutable release assets block without clobber.
- If portal state cannot be inspected, mark OpenAI completion as manual and unverified.
Completion criteria
- The requested finite workflow completed at its own evidence layer.
- Every later hosted, publication, evidence, and portal boundary remains explicit.
- No local tag or release was created.