---
name: ankyr-ci-release
description: Release / promote workflow — run the release gate, then promote a staging tag to main or prepare a marketplace submission. Never publish without explicit consent.
disable-model-invocation: true
---

# CI — Release

The milestone workflow for promoting a version toward production and preparing marketplace publish.

## Foundation

Resolve standards in this order: the `AGENT.md` chain (leaf → root), then project rules, then project skills, then this plugin's matching skill if installed. The first source that speaks wins. Consent, review-gate, and security floors always apply.

## Consent

Never promote to `main`, create a production tag, or submit to the public marketplace without **explicit** user consent for that action. Staging publishes (`*-rc`) still need an explicit release/promote request.

## Workflow

1. **Confirm the target channel** — `staging` (team marketplace / `-rc`) or `main` (public marketplace / final tag).
2. **Run the release gate** from `AGENT.md`:

```bash
uv run python scripts/release_gate.py
```

Record pass/fail from the exit code. Do not continue on failure.

3. **For staging → production**, prefer the Actions workflow (requires GitHub App secrets):

```bash
gh workflow run promote.yml -f from_tag=<X.Y.Z-rc> -f to_branch=main -f dry_run=true
# after dry-run looks good, and with explicit consent:
gh workflow run promote.yml -f from_tag=<X.Y.Z-rc> -f to_branch=main -f dry_run=false
```

4. **After a production tag**, remind the user:
   - GitHub Release is created by `publish-production.yml` (environment `production` may require a reviewer).
   - Public marketplace updates are **manually reviewed** by Cursor — submit/notify at https://cursor.com/marketplace/publish
   - Team marketplace: Cursor loads `main`. Enable Auto Refresh (Cursor GitHub App on the repo).

5. **Do not** push tags or merge release PRs unless the user explicitly asked.