cull-release-publish
Use when the user explicitly asks to publish or complete a prepared Cull release, or when the authorized cull-release orchestrator reaches publicati…
它会碰到什么
这一栏是扫描器报的事实，不是结论。命中多不等于有毒（安全工具、规则库、示例脚本本来就会包含危险写法），命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系，需要你自己看。
技能内容
Cull Release Publish
Authority
An explicit “Release Cull patch|minor|major” or direct “Publish prepared Cull
release X.Y.Z” request authorizes publication. Do not ask for another confirmation
after gates pass. That authority does not waive or bypass any gate.
Implicit invocation is disabled. Without that explicit authority, stop before any
tag, push, workflow dispatch, release, or tap mutation.
Publish
- Resolve the Cull checkout and parse one JSON envelope from
npm run release:cull -- state show --version "$VERSION" --json.
- Require state
prepared, exact metadata, a clean release commit already pushed
on main, green required checks, active branch/tag protection, publication
enablement, and no conflicting tag.
- Create one annotated tag for the prepared commit and push that tag normally.
Never move, replace, or force-push a tag.
- Watch the tag-bound GitHub release workflow. Never substitute a local build.
- Require the secret-free verifier's exact artifact inventory, signatures,
notarization, checksums, and provenance before automatic publication.
- Wait for checksum-pinned Homebrew promotion and its audit/install/launch proof.
- Record evidence transitions through
publishedandhomebrew-promotedusing
the repository CLI's state commands.
On failure, use cull-release-recover. Never delete or rewrite a tag, delete a
release, replace published assets, bypass verification, or force workflow state.
想直接用这个技能？
本站把开放许可（MIT / Apache 等）的技能按仓库打包整理到网盘，点一下转存到你自己的网盘，不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接，不打包。