GitHub Release Sanitize and release projects to GitHub. Two-phase workflow: safety checks first, then tag and publish. Prerequisites gh CLI installed and authenticated ( gh auth status ) gitleaks installed for secrets scanning ( brew install gitleaks or download from GitHub) Git repository with a remote configured Workflow Phase 1: Sanitize Run these checks before any public release. Stop on blockers. 1. Scan for Secrets (BLOCKER) gitleaks detect --no-git --source = . --verbose If secrets found: STOP . Remove secrets, move to environment variables. Check git history with git log -S "secret_value" — if in history, use BFG Repo-Cleaner. If gitleaks not installed, do manual checks:

Check for .env files

find . -name ".env" -not -path "/node_modules/*"

Check config files for hardcoded secrets

grep -ri "api_key|token|secret|password" wrangler.toml wrangler.jsonc .dev.vars 2

/dev/null 2. Remove Personal Artifacts Check for and remove session/planning files that shouldn't be published: SESSION.md — session state planning/ , screenshots/ — working directories test-.ts , test-.js — local test files Either delete them or add to .gitignore . 3. Validate LICENSE ls LICENSE LICENSE.md LICENSE.txt 2

/dev/null If missing: create one. Check the repo visibility ( gh repo view --json visibility -q '.visibility' ). Use MIT for public repos. For private repos, consider a proprietary license instead. 4. Validate README Check README exists and has basic sections: grep -i "## Install|## Usage|## License" README.md If missing sections, add them before release. 5. Check .gitignore Verify essential patterns are present: grep -E "node_modules|.env|dist/|.dev.vars" .gitignore 6. Build Test (non-blocking) npm run build 2

&1 7. Dependency Audit (non-blocking) npm audit --audit-level = high 8. Create Sanitization Commit If any changes were made during sanitization: git add -A git commit -m "chore: prepare for release" Phase 2: Release 1. Determine Version Check package.json for current version, or ask the user. Ensure version starts with v prefix. 2. Check Tag Doesn't Exist git tag -l "v[version]" If it exists, ask user whether to delete and recreate or use a different version. 3. Show What's Being Released LAST_TAG = $( git describe --tags --abbrev = 0 2

/dev/null || echo "" ) if [ -z " $LAST_TAG " ] ; then git log --oneline --no-merges HEAD | head -20 else git log --oneline --no-merges ${LAST_TAG} .. HEAD fi 4. Create Tag and Push git tag -a v [ version ] -m "Release v[version]" git push origin $( git branch --show-current ) git push origin --tags 5. Create GitHub Release gh release create v [ version ] \ --title "Release v[version]" \ --notes "[auto-generated from commits]" For pre-releases add --prerelease . For drafts add --draft . 6. Report Show the user: Release URL Next steps (npm publish if applicable, announcements) Reference Files When Read Detailed safety checks references/safety-checklist.md Release mechanics references/release-workflow.md