Menu

Individual skill

release-tag

0upvotes

Cut a release tag behind a real tier gate and cloud approval readback. The approval, task, approved commit, and resulting tag are bound; self-approval and HEAD drift fail closed. Prod prefixes remain refused.

sdk/apc/skills/release-tag/SKILL.md

Read pinned source

Source commit f83b859a173802a73d978197e92328ab2bf57a6e

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Network or broad shell
Last checked
Nov 9, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
1,364
Repository last updated
Oct 22, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# release-tag

发版打 tag（`apc/01` §2 release-tag，收口步 6）。它把**测试→上线的焊点**焊死：**没有 tier 全绿 / baseline 无新红的结构化证据，审批请求根本不创建、tag 绝不 push**。tier 门跑真 `run.ts` 读真退出码；tag 名按 `<channel>-<target>-YYYYMMDD-vX.Y.Z` 算；审批通过后 `git tag && push` 到**本地 bare mirror 替身**（真 GitLab push + pipeline 轮询 = M5）。

**什么时候用**：`release-preflight` 绿 + `release-db-config-sync` 无阻塞之后，要把一个 test 版本推上 CI。

## 承重纪律（发版 skill 的命根子，先记死）

- **prod 前缀 tag 必拒**（不变量 2 · 两人闸）。四个映射 `APP_ENV=prod` 的前缀——`k8s-prod-*` / `desktop-prod-*` / `prod-*` / `ali-k8s-prod-*`——**先于一切 git / tier 动作硬拒**，本 verb 不做任何 git 动作。**别试 prod**：真 prod 红线由 GitLab protected tags（P-1，运维配置）落地，本 skill 只护到"不替你打 prod tag"。要发 prod = 人走 M5 路径。
- **`--tier` 必须显式传，没有默认值**。`TD`（桌面冒烟）在 `apps/desktop/e2e/smoke/` 无 spec 时会自动 `skipped-with-note`（`passed:0/failed:0`），单独拿它当发版门是一道**不可能红**的空门——之前 SKILL 范例全不带 `--tier` 让 agent 照抄默认值正是这么踩的坑（`apc/12` §0.12）。**选一个会真执行断言的层**，例如 `--tier=T0,T1`；prod 前缀路径（下方触发）例外——它先于 tier 门拒绝，不需要 `--tier`。
- **tier 绿是 push 的硬前置，"绿"必须是真跑过用例**。tier 红 / `env_blocked` / **空跑**（该轮所有 tier 的 `passed+failed` 合计为 0，即一个用例都没真执行）⇒ `blocked`，审批请求不创建、tag 不 push。**不许**放松 tier、挑能绿的层、或拿一个恰好全 skip 的层骗过门。
- **审批门不可跳**。tier 绿但未审批 = `staged`（dry-run：出 tag + tier 证据，不 push）。批准路径必须同时传 `--task <taskId> --approved <approvalId>`；CLI 从 cloud 读回批件和 task，校验 `approved` / `release_tag` / task 绑定 / 非自批，且两者 metadata 的 commit SHA 必须一致。随机 token 不再能放行。
- **tag 打获批 commit，不打 HEAD**。并行工作使 HEAD 漂移也不得把未审内容带入 tag；获批 SHA 不在 repo 则 fail-closed。
Back to top