What problem does it solve? Release pipelines fail in subtle ways: invalid semver versions get mangled by npm, 2FA-protected tokens cause EOTP errors, missing retry logic produces false verification failures, and draft releases never trigger workflows. This Skill encodes defensive CI/CD patterns learned from a real release incident to prevent these failures. ## Core Features & Use Cases - Semver Validation Gate: Blocks 4-part versions before npm publish using npx semver checks in GitHub Actions. - Token and Retry Safeguards: Enforces npm Automation tokens over 2FA user tokens and adds 5-attempt, 15-second-interval retry loops for registry propagation delays. - Draft Release and Build Protection: Detects draft releases that never emit release: published events and sets SKIP_BUILD_BUMP=1 to stop version mutation during release builds. - Use Case: A team publishing an npm package via GitHub Actions adds these gates to their workflow so a malformed tag like v0.8.21.4 fails fast with a clear error instead of corrupting the published package. ## Quick Start Review my GitHub Actions npm publish workflow and add the semver validation, token verification, and retry logic gates from this skill.
