release-builder

Builds, audits, and publishes Web, Desktop, and CLI releases with privacy checks and smoke tests.

Updated Jul 3, 2026
One-click install
npx skills add https://github.com/LYGOLANG/fufan-cc-flow --skill release-builder-lygolang
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: release-builder
Source: https://github.com/LYGOLANG/fufan-cc-flow/tree/main/.agents/skills/release-builder
Command: npx skills add https://github.com/LYGOLANG/fufan-cc-flow --skill release-builder-lygolang

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Shipping a release involves many failure-prone steps: builds that pass in dev but break after packaging, leaked API keys or personal paths in build artifacts, and untested installers. This Skill runs the full release pipeline—build, privacy audit, install-based testing, publish, and rollback—so nothing ships broken or leaks private data. ## Core Features & Use Cases - Multi-channel release: Handles Web deployment (Vercel/Netlify), Desktop packaging with signing checks, and CLI publishing via npm or binaries. - Mandatory privacy audit: Greps build artifacts for developer paths, .env files, credentials, and API keys (sk-ant-, sk-proj-, etc.) and halts the release on any hit. - Install-based smoke testing: Tests from the actual installed artifact (system directory, global npm install, live URL) rather than the dev environment, with per-channel rollback strategies. - Use Case: You finished a Tauri desktop app and say "package and release it"—the Skill bumps the version, builds, audits the output directory for leaked secrets, reminds you to install from the package, runs smoke tests, and publishes after your confirmation. ## Quick Start Tell the agent to package and release this project to your chosen channel, for example by saying "build and publish the CLI to npm after running the privacy audit."

Frequently Asked Questions about release-builder

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I package and release a desktop app safely?▼

Build the app, package it for the target platform, then audit the output directory for leaked paths, .env files, and API keys before distributing. Install from the actual package into the system directory and run smoke tests rather than trusting the dev build.

How to check build artifacts for leaked API keys before publishing?▼

Run grep over the build output for patterns like sk-ant-, sk-proj-, ANTHROPIC_API_KEY, and OPENAI_API_KEY, plus find commands for .db, .env, .pem, and .key files. Any match should stop the release until fixed and rebuilt.

Why does my app work in dev but fail after packaging?▼

Packaged apps run in a different environment with different paths, dependencies, and permissions than dev. Tools like electron-builder are also sensitive to dependency layout, so verify the actual node_modules layout and always test from the installed package.

Can I roll back a bad release on Vercel or npm?▼

On Vercel, use rollback or revert to a previous deployment from the console. On npm, deprecate the broken version, unpublish within 72 hours for severe issues, then bump the version and republish a fix.

What should I do when a packaging tool hangs during build?▼

Check whether the process CPU is at 0% while runtime keeps increasing, which indicates a deadlock rather than slow progress. Search the web for the specific error, since signing, notarization, and CLI version incompatibilities are common documented causes.