release

Release Cyrus

Run Cyrus releases through the trusted-publishing workflow. Do not publish workspace packages manually.

Required reference

Read apps/cli/RELEASING.md completely before taking release actions. Treat it as the canonical operator guide and scripts/release-packages.mjs as the canonical package list and dependency order.

Workflow

1. Fetch origin/main, start from current main, and preserve unrelated local

changes.

1. Prepare the release on a branch:

• Move both changelogs' Unreleased entries into the new version.
• Set the same version in every manifest printed by

node scripts/release-packages.mjs list.

• Run pnpm install and commit any lockfile change.
• Run the F1 release test-drive protocol and save its report with the

required -release-v<version>.md suffix.

• List every released package@version in CHANGELOG.md.

1. Run node scripts/release-packages.mjs validate <version>, then all checks

required by apps/cli/RELEASING.md. Fix failures before continuing.

1. Commit, push, open the release PR, and merge it to main before dispatching

the workflow. Never publish unmerged source or a non-main ref.

1. Dispatch .github/workflows/release-cli.yml from main in dry-run mode and

monitor it through completion.

1. Only when the user has explicitly requested the live release, dispatch the

same exact version with dry_run=false. Monitor it through npm publication, git tagging, and GitHub Release creation.

1. Independently verify the version on npm and run the published CLI's

--version command.

1. Use the Linear integration to move every issue referenced by the version's

changelog section from MergedUnreleased to ReleasedMonitoring.

Safety

• Never add an npm token. Publishing must use GitHub Actions OIDC.
• Confirm every npm package trusts cyrusagents/cyrus and

release-cli.yml before the first live workflow run.

• A dry run does not authenticate to npm and does not prove registry writes.
• Never rerun a partially published version blindly. npm versions are

immutable; inspect which packages landed and recover deliberately.

• Do not create or move a release tag until every package is published. The

workflow owns tag and GitHub Release creation.