Release

What it does

When your agent uses it

• The user asks to release
• Bump and publish the extension

Example prompts

• “release”
• “publish”
• “bump and publish”
• “/release”

Requirements

• Node.js
• A credential in GITHUB_TOKEN
• A credential in OVSX_TOKEN

Workflow steps

8 steps, taken from the step headings in SKILL.md.

1. 1Determine Next Version
2. 2Update CHANGELOG.md
3. 3Bump Version in package.json and package-lock.json
4. 4Build — vscode:prepublish
5. 5Publish to VS Code Marketplace — vsce publish
6. 6Publish to Open VSX Registry — ovsx:publish
7. 7Commit, Tag, and Push
8. 8Create GitHub Release

What it can do on your machine

Read from SKILL.md and the folder at commit 36dda63. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Shell commands in SKILL.md call:

  • git
  • npm
  • npx
  • gh
  • make
  • curl
  • nvm

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Hosts in commands or code, which the agent is likely to contact:

  • registry.npmjs.org
  • dev.azure.com
  • open-vsx.org
  • github.com

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names these keys or tokens, usually read from environment variables:

  • OVSX_TOKEN
  • GH_TOKEN
  • GITHUB_TOKEN

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Release loads about 2.2k tokens when it runs. Until then it costs about 145 tokens; SKILL.md has 713 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~145

When it runs · the whole SKILL.md, loaded when a task matches

~2.2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NoteMentions a .env fileSKILL.md:25

  ps` CLI is available (needed to decrypt `.env` for OVSX token)

• NoteMentions a .env fileSKILL.md:30

  GH_TOKEN` from `~/dev/signageos/projects/.env.secrets`)

• NoteMentions a .env fileSKILL.md:31

  n available in `~/dev/signageos/projects/.env.secrets` as `GITHUB_TOKEN`

• NoteMentions a .env fileSKILL.md:151

  pt (`tools/ovsx-publish.bash`) decrypts `.env` with `sops`, sources it, and runs `npx ovsx publish -p $OVSX_TOKEN`.

• NoteMentions a .env fileSKILL.md:156

  sops -d .env > .decrypted~.env

• NoteMentions a .env fileSKILL.md:174

  e the OVSX_TOKEN value in the encrypted `.env` file:

• NoteMentions a .env fileSKILL.md:175

  - Decrypt: sops -d .env > .decrypted~.env

• NoteMentions a .env fileSKILL.md:177

  - Re-encrypt: sops -e .decrypted~.env > .env

• NoteMentions a .env fileSKILL.md:179

  - Commit the updated .env: git add .env && git commit -m "chore: rotate OVSX token"

• NoteMentions a .env fileSKILL.md:208

  ep GITHUB_TOKEN ~/dev/signageos/projects/.env.secrets | cut -d= -f2)

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from signageos/vscode-sops at commit 36dda63, republished under its MIT licence (© signageos). 713 words, ~2,159 tokens.

name

release

description

Releases the vscode-sops extension end-to-end: determines the next version from the bump history, updates CHANGELOG.md and package.json/package-lock.json, builds via `vscode:prepublish`, publishes to VS Code Marketplace (vsce) and Open VSX Registry (ovsx), tags and pushes the release commit, and creates a GitHub Release with a changelog. Handles token expiration with re-generation guidance and stops on any build or type error, showing issues and suggestions before asking to continue. Use when the user asks to "release", "publish", or "bump and publish" the extension.

## [Unreleased]
### Fixed
- Support for files parsed as `null`

## [0.9.3]

## [Unreleased]

## [0.9.4]
### Fixed
- Support for files parsed as `null`

## [0.9.3]

npm version X.Y.Z --no-git-tag-version

npm run vscode:prepublish

npx vsce publish

⚠️  VS Code Marketplace token has expired or is invalid.

To regenerate:
1. Go to: https://dev.azure.com/signageos/_usersSettings/tokens
   (Make sure you are signed in under a user that has access to the signageos organization)
2. Create a new token with:
   - Organization: All accessible organizations (or "signageos")
   - Scopes: Click "Show all scopes", then enable Marketplace → Manage (not just Read)
   - Expiration: up to 1 year
3. Copy the token.
4. Run: npx vsce login signageos
   (Enter the new token when prompted — it is stored in ~/.vsce)

After completing the above, respond with "continue" or "done" to resume.

sops -d .env > .decrypted~.env
source .decrypted~.env
npx --registry https://registry.npmjs.org ovsx publish -p $OVSX_TOKEN
rm -f .decrypted~.env

⚠️  Open VSX token has expired or is invalid.

To regenerate:
1. Go to: https://open-vsx.org → Log in → User Settings → Access Tokens
2. Generate a new token and copy it.
3. Update the OVSX_TOKEN value in the encrypted `.env` file:
   - Decrypt: sops -d .env > .decrypted~.env
   - Edit .decrypted~.env and set OVSX_TOKEN=<new-token>
   - Re-encrypt: sops -e .decrypted~.env > .env
   - Remove plaintext: rm .decrypted~.env
   - Commit the updated .env: git add .env && git commit -m "chore: rotate OVSX token"

After completing the above, respond with "continue" or "done" to resume.

git add package.json package-lock.json CHANGELOG.md
git commit -m "Bump X.Y.Z"
git tag -a "vX.Y.Z" -m "Release vX.Y.Z"
git push github master
git push github "vX.Y.Z"

gh release create "vX.Y.Z" \
  --repo signageos/vscode-sops \
  --title "vX.Y.Z" \
  --notes "<changelog content>"

curl -sL https://github.com/cli/cli/releases/latest/download/gh_*_linux_amd64.tar.gz -o /tmp/gh.tar.gz
tar xzf /tmp/gh.tar.gz -C /tmp
export PATH="/tmp/gh_*_linux_amd64/bin:$PATH"

### Fixed
- Support for files parsed as `null`

✅ Released vscode-sops vX.Y.Z

- CHANGELOG.md updated
- package.json / package-lock.json bumped
- Built with vscode:prepublish
- Published to VS Code Marketplace (signageos.signageos-vscode-sops)
- Published to Open VSX Registry
- Git tag: vX.Y.Z pushed
- GitHub Release: https://github.com/signageos/vscode-sops/releases/tag/vX.Y.Z

© signageos, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .github/skills/release of signageos/vscode-sops.

Open the folder on GitHubat commit 36dda63