What problem does it solve? Release pipelines fail in costly ways when workflows publish invalid semver versions, use the wrong npm token type, skip retry logic for registry propagation, or miss draft release events. This Skill codifies defensive CI/CD patterns learned from a real multi-hour release outage so those failures never repeat. ## Core Features & Use Cases - Semver Validation Gate: Blocks npm publish when the release tag is not valid 3-part semver (e.g., rejects 4-part versions like 0.8.21.4) using npx semver. - Token & Retry Safeguards: Enforces npm Automation tokens instead of 2FA user tokens, and verifies published packages with 5 attempts at 15-second intervals to handle registry propagation delays. - Draft Release & Build Protection: Detects draft releases that never emit release: published events and requires SKIP_BUILD_BUMP=1 so dev-only version bump scripts never mutate release builds. - Use Case: A release manager wiring up a GitHub Actions publish workflow applies these gates so a malformed tag or premature verification check fails fast with actionable output instead of corrupting the release. ## Quick Start Add the semver validation gate and retry-based package verification steps from this skill to my npm publish GitHub Actions workflow.
