Releases

Recently shipped releases publish for non-GitHub CI, source-scoped publish tokens, and a cleanup pass on releases login.

Changelogs publish from any CI, with scoped tokens.

• releases publish pushes changelog updates with RELEASES_API_TOKEN from GitLab CI, Buildkite, and local docs builds, using the same plan as the publish-changelog GitHub Action.
• releases publish-token create/list/revoke mints a relk_ token scoped to one source.
• releases json validate accepts publish: "push" changelog locators.

Login stopped leaving credentials behind. releases login stores only the read-only API key, not a browser session. releases keys and releases publish-token open a one-time approval per run and sign out when it finishes, and each login revokes the relu_ key it replaces. releases auth logout revokes server-side and always clears the local credential.

Agent skills ship with the Claude plugin. The plugin points at agents.releases.sh/mcp, documents which Releases.sh services it reaches and what they keep, and keeps its skills in a self-contained folder that passes Claude plugin validation — npx skills add buildinternet/releases-cli finds them there.

The CLI moved to the buildinternet/releases monorepo. Install commands, GitHub release binaries, and the Homebrew formula are unchanged; releases feedback files issues there. releases list --org <unknown> prints "No sources configured." instead of crashing.

OAuth clients keep their verification controls. create takes --official/--no-official for the "Verified by Releases Index" badge, and update toggles official, trusted, and disabled.

Deprecated: releases admin discovery onboard no longer starts a remote session — the discovery worker and its workflow endpoint were retired. The command exits 1 and points to admin org create, admin source create, and the local-ingest skill.