deploylisted

# Deploy Skill Orchestrate production release. Be deliberate. Never skip hooks. Never push a tag without explicit user confirm. **The tag is the version.** Nothing in the tree records it: the binary takes it from `ldflags -X main.version={{.Version}}`, and `npm/scripts/prepare-packages.mjs` stamps it into every `package.json` at build time (they sit at `0.0.0` in git on purpose). So a release is *one* annotated tag — no bump commit, nothing to push to `main`. **Nothing publishes without a human approval.** `publish.yml` runs in the `release` GitHub environment. A tag push starts the run, then it waits for a required reviewer. No npm credential exists in the repository or its secrets: the workflow authenticates over OIDC against a trusted publisher configured per package on npmjs.com. ## Step 1 — Pre-flight checks (abort on any failure) ```bash git status --porcelain # MUST be empty git rev-parse --abbrev-ref HEAD # MUST be 'main' git fetch origin main --tags # --tags so Step 2 check see remote tags git rev-list --count HEAD..origin/main # MUST be 0 git rev-list --count origin/main..HEAD # MUST be 0 git config core.hooksPath # SHOULD be '.githooks' # --workflow not optional: CodeQL default setup also record runs against main, so # unfiltered --limit 1 hand back its green run while ci itself red. gh run list --branch main --workflow ci.yml --limit 1 \ --json status,conclusion,headSha # status 'completed', conclusion