# Release Guard

> STRICT GitHub release gatekeeper. Blocks premature releases (from develop, incomplete CI). Verifies PR merged to main + ALL CI passed before allowing tag/release. Triggers on "release", "tag", "publish", "deploy", "version". Use when this capability is needed.

- Skill: `tomevault-io/release-guard` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/release-guard`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/release-guard/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/release-guard

---


# Release Guard Skill

## Core Rules (NEVER VIOLATE)
- Releases **ONLY** from **main** after PR merge.
- **ALL** CI jobs must COMPLETE + SUCCESS. NO queued jobs.
- Verify branch protection requires status checks.
- **Version MUST match tag** before creating release (cargo-dist requirement).

## Activation Steps
1. **PR Check**: Ask for PR# if needed. Run `gh pr view $PR_NUM --json state,baseRefName`. Must: state=CLOSED, baseRefName=main.
2. **Branch**: `git branch --show-current` + `gh repo view --json default_branch`. Fail if not main.
3. **CI**: `gh run list --branch main --limit 5 --json status,conclusion`. ALL: completed + success. Log/screenshot.
4. **Clean**: `git status` (clean working dir).
5. **Version Check** (CRITICAL): `grep '^version =' Cargo.toml` must match tag (without 'v' prefix).

## Fail Response
```
🚫 BLOCKED: [Exact violation]
Fix:
- Merge PR to main
- Wait CI: gh run list --branch main
- git checkout main && git pull
- BUMP VERSION in Cargo.toml FIRST (must match tag)
Re-run task.
```

## Version Mismatch Example (v0.1.22 Incident)
```
Tag: v0.1.22 pushed at commit 05c0481
Cargo.toml version: 0.1.21 (MISMATCH!)
Result: cargo-dist failed: "This workspace doesn't have anything for dist to Release!"

Fix: ALWAYS bump version BEFORE pushing tag.
Use: cargo release patch|minor|major (handles atomically)
```

## Pass: Safe Release
- Semver check: `cargo semver-checks check-release --workspace` (ADR-034)
- Tag: vMAJOR.MINOR.PATCH (semantic).
- Prefer: `cargo release patch|minor|major` (ADR-034)
- Fallback: `gh release create v1.2.3 --generate-notes --target main`
- Confirm before execute.

## Examples
- User: "Create release from develop PR #199" → BLOCK: Wrong branch.
- User: "Tag v1.0.0 after PR #199" → Check PR/CI/branch → Proceed if pass.

Progressive disclosure: For CI details, see [ci-reference.md](ci-reference.md) if needed.
```

## Best Practices Applied
- **Description**: Keyword-rich for matching ("release", "tag").
- **allowed-tools**: Read + Bash wildcards (gh/git CLI). Install `gh`.[2]
- **Structure**: Essential in SKILL.md; link supports (add `ci-reference.md` for details).
- **Load/Test**: Restart Claude Code. Ask "What Skills available?". Test: "Create release PR #199".

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/d-o-hub) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-13 -->