What problem does it solve? Publishing a lockstep set of npm packages is irreversible: a failed publish mid-sequence burns versions, npm has no transactions, and a repository cannot see its own published surface (e.g. exports.types pointing at source files absent from the tarball). This Skill gives an agent the reasoning to run the Nodefony release chain correctly: which command to launch, in what order, what each guard refuses, and how to read a failure. ## Core Features & Use Cases - Release orchestration guidance: Explains the authoritative npm commands (npm run release, release:pack, release:smoke, release:image-gate) and what each guard prevents, from semver validation to per-layer Docker image secret scanning. - Smoke test interpretation: Details the three clean-install scenarios (base, front, studio) run in containers, what each one alone can prove, and how named steps attribute a failure to the right stage. - Pitfall knowledge base: Documents hard-won lessons such as npm setting latest on first publish regardless of --tag, npm view --json wrapping results in arrays, and OIDC trusted publishing not covering deprecate or dist-tag. - Export surface comparison: Ships scripts/compare-exports.mjs, which diffs the exported surface of two builds via real imports in isolated Node processes. - Use Case: Before tagging v10.0.0, ask the agent to walk through the release: it will tell you to stamp the version with --write, review the Common Changelog draft, run --promouvoir, and wait for CI on the tagged commit before pushing the tag. ## Quick Start Ask the agent to prepare a Nodefony release for version 10.0.0-alpha.7 on the alpha npm tag and explain any guard that refuses.
