leo4135 Release Management
Semantic Versioning
This project follows SemVer:
| Change Type | Version Bump | Examples |
|---|---|---|
| Breaking skill API / removed skills | MAJOR (X.0.0) | Renamed skill, changed report format |
| New skills or significant additions | MINOR (0.X.0) | Added Svelte checks, new OWASP section |
| Fixes, typos, minor updates | PATCH (0.0.X) | Corrected regex, fixed broken link |
Release Checklist
Release vX.Y.Z:
- [ ] All skills reviewed for accuracy
- [ ] CHANGELOG.md updated
- [ ] Version references updated in README (if applicable)
- [ ] No secrets or environment-specific paths in skills
- [ ] Git tag created: vX.Y.Z
- [ ] GitHub Release published with notes
- [ ] Release assets verified (if any)
CHANGELOG Format
Follow Keep a Changelog:
## [X.Y.Z] - YYYY-MM-DD
### Added
- New skill: `framework-security-checks` for Hono
### Changed
- Updated OWASP checks for 2025 draft categories
### Fixed
- Corrected Express path traversal regex in audit-checklists
### Security
- Updated dependency-audit rules for npm audit v4 output
Categories: Added, Changed, Deprecated, Removed, Fixed, Security
Creating a GitHub Release
# Ensure clean state
git status
git pull
# Update CHANGELOG, commit
git add CHANGELOG.md
git commit -m "chore: prepare release v1.0.0"
# Tag
git tag -a v1.0.0 -m "Release v1.0.0 — Initial public release"
# Push tag
git push origin v1.0.0
GitHub CLI
gh release create v1.0.0 \
--title "v1.0.0 — Initial Public Release" \
--notes-file RELEASE_NOTES.md
Release Notes Template
## cursor-javascript-security-skills v1.0.0
First public release of security audit skills for Cursor IDE.
### Included Skills
- `javascript-security-audit` — Full audit orchestrator
- `audit-checklists` — Security checklists
- `threat-modeling` — STRIDE threat models
- `framework-security-checks` — React, Next.js, Express, Vue, Svelte, Hono
- `dependency-audit` — npm/yarn/pnpm vulnerability scanning
- `owasp-javascript` — OWASP Top 10 mapping
- `supply-chain-security` — Supply chain integrity
- `security-bug-reporting` — Vulnerability report format
- `release-management` — This release workflow
### Installation
\`\`\`bash
git clone https://github.com/OWNER/cursor-javascript-security-skills.git
cp -r cursor-javascript-security-skills/skills/* ~/.cursor/skills/
\`\`\`
### Full Changelog
https://github.com/OWNER/cursor-javascript-security-skills/blob/main/CHANGELOG.md
Branch Strategy
| Branch | Purpose |
|---|---|
main |
Stable, release-ready |
develop |
Integration (optional) |
feature/* |
New skills or improvements |
Releases are tagged from main.
Post-Release
- Verify skills load in Cursor (copy to
~/.cursor/skills/, test with audit prompt) - Monitor issues for installation problems
- Plan next version in CHANGELOG
[Unreleased]section
Version in Skill Metadata
Skills do not embed version numbers in SKILL.md frontmatter — versioning is at repo level via git tags. Users pin by cloning a specific tag:
git clone --branch v1.0.0 https://github.com/OWNER/cursor-javascript-security-skills.git