github-release
This skill sanitizes code for public release by scanning for secrets with gitleaks, validating LICENSE and README files, removing personal artifacts, and checking build integrity before creating and publishing version tags to GitHub via the gh CLI. Use it before making any project publicly available or deploying to GitHub to ensure sensitive credentials are removed, required documentation exists, and the codebase is in releasable condition.
git clone --depth 1 https://github.com/jezweb/claude-skills /tmp/github-release && cp -r /tmp/github-release/plugins/dev-tools/skills/github-release ~/.claude/skills/github-releaseSKILL.md
# GitHub Release
Sanitize and release projects to GitHub. Two-phase workflow: safety checks first, then tag and publish.
## Prerequisites
- `gh` CLI installed and authenticated (`gh auth status`)
- `gitleaks` installed for secrets scanning (`brew install gitleaks` or download from GitHub)
- Git repository with a remote configured
## Workflow
### Phase 1: Sanitize
Run these checks before any public release. Stop on blockers.
#### 1. Scan for Secrets (BLOCKER)
```bash
gitleaks detect --no-git --source=. --verbose
```
If secrets found: **STOP**. Remove secrets, move to environment variables. Check git history with `git log -S "secret_value"` — if in history, use BFG Repo-Cleaner.
If gitleaks not installed, do manual checks:
```bash
# Check for .env files
find . -name ".env*" -not -path "*/node_modules/*"
# Check config files for hardcoded secrets
grep -ri "api_key\|token\|secret\|password" wrangler.toml wrangler.jsonc .dev.vars 2>/dev/null
```
#### 2. Remove Personal Artifacts
Check for and remove session/planning files that shouldn't be published:
- `SESSION.md` — session state
- `planning/`, `screenshots/` — working directories
- `test-*.ts`, `test-*.js` — local test files
Either delete them or add to `.gitignore`.
#### 3. Validate LICENSE
```bash
ls LICENSE LICENSE.md LICENSE.txt 2>/dev/null
```
If missing: create one. Check the repo visibility (`gh repo view --json visibility -q '.visibility'`). Use MIT for public repos. For private repos, consider a proprietary license instead.
#### 4. Validate README
Check README exists and has basic sections:
```bash
grep -i "## Install\|## Usage\|## License" README.md
```
If missing sections, add them before release.
#### 5. Check .gitignore
Verify essential patterns are present:
```bash
grep -E "node_modules|\.env|dist/|\.dev\.vars" .gitignore
```
#### 6. Build Test (non-blocking)
```bash
npm run build 2>&1
```
#### 7. Dependency Audit (non-blocking)
```bash
npm audit --audit-level=high
```
#### 8. Create Sanitization Commit
If any changes were made during sanitization:
```bash
git add -A
git commit -m "chore: prepare for release"
```
### Phase 2: Release
#### 1. Determine Version
Check `package.json` for current version, or ask the user. Ensure version starts with `v` prefix.
#### 2. Check Tag Doesn't Exist
```bash
git tag -l "v[version]"
```
If it exists, ask user whether to delete and recreate or use a different version.
#### 3. Show What's Being Released
```bash
LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
if [ -z "$LAST_TAG" ]; then
git log --oneline --no-merges HEAD | head -20
else
git log --oneline --no-merges ${LAST_TAG}..HEAD
fi
```
#### 4. Create Tag and Push
```bash
git tag -a v[version] -m "Release v[version]"
git push origin $(git branch --show-current)
git push origin --tags
```
#### 5. Create GitHub Release
```bash
gh release create v[version] \
--title "Release v[version]" \
--notes "[auto-generated from commits]"
```
For pre-releases add `--prerelease`. For drafts add `--draft`.
#### 6. Report
Show the user:
- Release URL
- Next steps (npm publish if applicable, announcements)
## Reference Files
| When | Read |
|------|------|
| Detailed safety checks | [references/safety-checklist.md](references/safety-checklist.md) |
| Release mechanics | [references/release-workflow.md](references/release-workflow.md) |Generate AI images using Gemini or GPT APIs directly. Covers model selection (Gemini for scenes; GPT Image 2 for text rendering, batch variations, multi-reference compositing; GPT Image 1.5 for transparent icons), the 5-part prompting framework, API calling patterns, multi-turn editing, and quality assurance. Produces photorealistic scenes, icons, illustrations, OG images, posters, infographics, and product shots. Use when building websites that need images, creating marketing assets, or generating visual content. Triggers: 'generate image', 'ai image', 'create hero image', 'make an icon', 'generate illustration', 'create og image', 'poster', 'infographic', 'image variations', 'gpt-image-2', 'ai art', 'image generation'.
Generate complete user documentation for a web app with screenshots. Browses the app via browser automation, screenshots every screen, and produces a structured user guide with step-by-step instructions, annotated screenshots, workflow diagrams, and reference tables. Supports quick (key screens), standard (all pages), thorough (every state and flow), and exhaustive (publishable documentation suite). Triggers: 'document the app', 'user guide', 'app documentation', 'screenshot docs', 'generate user docs', 'help docs', 'how-to guide', 'write the docs'.
Australian business English for professional writing — warm, direct, EN-AU spelling (colour, organise, centre), no filler words. Use whenever the user is writing for an Australian audience: emails, chat messages, proposals, client communications, blog posts, web copy, or any business writing. Apply to drafting, editing, and tone-checking professional text.
Write compelling award submissions, grant applications, and competition entries. Maps achievements to selection criteria using evidence-based narratives. Use whenever the user is applying for a business award (Telstra, chamber of commerce, industry awards), a grant, a competition, or any submission demonstrating merit against defined criteria.
Get a second opinion from leading AI models on code, architecture, strategy, prompting, or anything. Queries models via OpenRouter, Gemini, or OpenAI APIs. Supports single opinion, multi-model consensus, and devil's advocate patterns. Use whenever the user says 'brains trust', 'second opinion', 'ask gemini', 'ask gpt', 'peer review', 'consult another model', 'challenge this', or 'devil's advocate'.
Hit the Cloudflare REST API directly for operations that wrangler and MCP can't handle well. Bulk DNS, custom hostnames, email routing, cache purge, WAF rules, redirect rules, zone settings, Worker routes, D1 cross-database queries, R2 bulk operations, KV bulk read/write, Vectorize queries, Queues, and fleet-wide resource audits. Produces curl commands or scripts. Triggers: 'cloudflare api', 'bulk dns', 'custom hostname', 'email routing', 'cache purge', 'waf rule', 'd1 query', 'r2 bucket', 'kv bulk', 'vectorize query', 'audit resources', 'fleet operation'.
Scaffold and deploy Cloudflare Workers with Hono routing, Vite plugin, and Static Assets. Describe project, scaffold structure, configure bindings, deploy. Use whenever the user wants to create a Worker project, set up Hono on Cloudflare, configure D1 / R2 / KV / Queues bindings, or troubleshoot Worker export syntax, API route conflicts, HMR issues, or deployment failures.
Run an independent code review using the OpenAI Codex CLI in headless mode. Gets a second opinion from a different model family (the current Codex models) on recent changes, a PR, a commit, or the whole app — covering bugs, regressions, security, data consistency, UX/state bugs, performance risks, and testing gaps. Saves a severity-prioritised report to .jez/reviews/. Triggers: 'codex review', 'review with codex', 'independent code review', 'what does codex think', 'get codex to review'.