release-auditlisted

Release & supply-chain readiness audit: gathers evidence from real workflows, manifests, and repo settings, compares against a gold-standard reference stack, has an adversarial subagent try to refute the draft, and returns a prioritized action plan (P1–P3) whose fixes are delegated to the sibling setup skills. Use when asked to audit release automation, publishing security, CI or supply-chain maturity, or whether a repo is ready to release. For a whole-repo health check (docs, tests, code quality) use maturity-analysis instead.
emaarco/hogwarts · ★ 0 · AI & Automation · score 75

Install: claude install-skill emaarco/hogwarts

# Skill: release-audit Audits how a repository releases software — versioning, secure publishing, CI, PR validation, supply-chain hardening — and returns a reviewed, prioritized action plan. It orchestrates: findings are graded against a gold standard, an adversarial subagent tries to tear the draft apart, and every accepted fix points at the sibling skill that implements it. ## Inputs Ask (AskUserQuestion) only for what wasn't given: - **DEPTH** — `quick` (top ~8 highest-impact findings, light research) | `standard` (default: full checklist + stack research) | `deep` (also verify live repo settings via `gh api`) - **FOCUS** (optional) — e.g. "publishing security only" - **CONSTRAINTS** (optional) — e.g. "no paid GitHub plan", "must stay on PATs for now", "private repo" ## Operating rules - **Evidence first.** Read the real files and command output you reason from. Never claim anything about a file or setting you have not inspected. What you can't verify (e.g. repo settings without API access) is marked "unverified" — never guessed. - **Cite everything**: `path:line`, a config key, or the exact command and its output (e.g. `gh api repos/{owner}/{repo}/rulesets`). - **Right-size to THIS repo.** A solo public library, a private app, and a multi-package monorepo need different answers. Recommend the simplest thing that meets the goal. - **Prefer primary sources** (official tool/registry/platform docs) over blog posts; date version- or GA-sensitive claims. ## Phase 0 — Det