version-bump
Automated semantic versioning and release workflow for Claude Code plugins. Handles version increments across package.json, marketplace.json, plugin.json manifests, build verification, git tagging, GitHub releases, and changelog generation. NPM publishing is the final human-required handoff because the maintainer raised npm security.
How do I install this agent skill?
npx skills add https://github.com/thedotmack/claude-mem --skill version-bumpIs this agent skill safe to install?
- Gen Agent Trust Hubpass
This skill automates software releases by updating version manifests and generating changelogs. It includes an inherent risk of indirect prompt injection by processing external data from GitHub releases, and it executes scripts located in the user's home directory to send notifications to Discord.
- Socketpass
No alerts
- Snykwarn
Risk: MEDIUM · 1 issue
What does this agent skill do?
Version Bump & Release Workflow
IMPORTANT: Plan and write detailed release notes before starting.
CRITICAL: Commit EVERYTHING (including build artifacts). At the end of this workflow, NOTHING should be left uncommitted or unpushed. Run git status at the end to verify.
Preparation
-
Analyze: Determine if the change is PATCH (bug fixes), MINOR (features), or MAJOR (breaking).
-
Environment: Identify repository owner/name from
git remote -v. -
Paths — every file that carries the version string:
package.json— the npm/npx-published version (npx claude-mem@X.Y.Zresolves from this)plugin/package.json— bundled plugin runtime deps.claude-plugin/marketplace.json— version insideplugins[0].version.claude-plugin/plugin.json— top-level Claude-plugin manifestplugin/.claude-plugin/plugin.json— bundled Claude-plugin manifest.codex-plugin/plugin.json— Codex-plugin manifestplugin/.codex-plugin/plugin.json— bundled Codex-plugin manifestopenclaw/openclaw.plugin.json— OpenClaw plugin manifest
Verify coverage before editing:
git grep -l "\"version\": \"<OLD>\""should list all eight. If a new manifest has been added since this doc was last updated, update this list.
Workflow
-
Update: Increment the version string in every path above. Do NOT touch
CHANGELOG.md— it's regenerated. -
Verify:
git grep -n "\"version\": \"<NEW>\""— confirm all eight files match.git grep -n "\"version\": \"<OLD>\""— should return zero hits. -
Build and sync:
npm run build-and-syncto regenerate artifacts, sync the local marketplace copy, restart the worker, and clear the queue. Do not use plainnpm run buildfor release validation because it can leave the local marketplace/worker out of sync. -
Commit:
git add -A && git commit -m "chore: bump version to X.Y.Z". -
Tag:
git tag -a vX.Y.Z -m "Version X.Y.Z". -
Push:
git push origin main && git push origin vX.Y.Z. -
GitHub release:
gh release create vX.Y.Z --title "vX.Y.Z" --notes "RELEASE_NOTES". -
Changelog: Regenerate via the project's changelog script:
npm run changelog:generate(Runs
node scripts/generate-changelog.js, which pulls releases from the GitHub API and rewritesCHANGELOG.md.) -
Sync changelog: Commit and push the updated
CHANGELOG.md. -
Pre-handoff audit: Verify the release commit, tag, GitHub release, and changelog are pushed; confirm the release worktree has no pending tracked changes; and ensure its build dependencies are present because
prepublishOnlyrebuilds the package. Ifnpm view claude-mem@X.Y.Z versionalready resolves, skip the handoff and continue with post-publish checks. -
Final human handoff — publish to npm. Do not stop in the middle of the workflow for npm. Finish every agent-owned preparation above first, then make this the final human-required action.
The human maintainer's credentials/2FA are required. The agent MUST NOT run
npm publish(ornp/npm run release:*, which also publish). Give the exact release-worktree path and this command as the only requested action:npm publish # run by the HUMAN — prepublishOnly rebuilds the packageWait for confirmation. Do not ask the human to perform any other release step afterward.
-
Post-publish verification and notification: After confirmation, verify both the exact version and the latest dist-tag:
npm view claude-mem@X.Y.Z version npm view claude-mem versionIf the publish build touched tracked artifacts, run
npm run build-and-sync, review the result, and commit/push any legitimate changes. Then run the Discord notification from~/Scripts/claude-mem/, where the.envwith webhook details lives:cd ~/Scripts/claude-mem/ && npm run discord:notify vX.Y.ZDo this only after npm verification, and even when the release worktree does not have a local
.env. -
Finalize:
git status— working tree must be clean and everything must be pushed. Only automated verification, notification, and cleanup may occur after the final human handoff.
Checklist
- All eight config files have matching versions
-
git grepfor old version returns zero hits -
npm run build-and-syncsucceeded - Git tag created and pushed
- GitHub release created with notes
-
CHANGELOG.mdupdated and pushed - Pre-handoff audit passed; no agent-owned release preparation remains
- NPM publishing handed off as the final human-required action (agent does NOT run it)
- Exact npm version and
latestboth verified after the human publishes - Discord notification run from
~/Scripts/claude-mem/only after npm verification -
git statusshows clean tree
How can the creator link this skill?
Add the canonical catalog link to the repository README so users can inspect current installs and available audits. The publishing guide covers the complete discovery path.
<a href="https://skillzs.dev/skills/thedotmack/claude-mem/version-bump">View version-bump on skillZs</a>