[cliffhall]

Closes #2755

The release skill's "The v1 line" section was four sentences with no steps, so cutting 1.0.3 (#2753) meant reconstructing the procedure, and the first attempt got the tag and the Latest flag wrong. This turns it into a procedure and records what that release taught about merging from advisory forks.

release skill: "The v1 line"

• v1-1 Bump: a PR on v1/main (v1 + chore, board get tools working #11, no milestone). Edit the four package.json versions, the three inspector-* ranges and the 8 lockfile fields by hand, not with update-version, whose trailing npm install re-resolves the tree (v1: release 1.0.2 with the pending security and audit fixes #2080). Then npm run check-version, and npm ci must leave the lockfile clean.
• v1-2 Merge order: the bump merges last.
• v1-3 Release: gh release create X.Y.Z --target v1/main --title X.Y.Z --latest=false. The tag is bare (the v1 release tags ruleset covers refs/tags/1.*), and the release must not take the Latest badge from v2.
• v1-4 CI: build, then publish (OIDC trusted publishing, publish-all → --tag v1-latest) and publish-github-container-registry.
• v1-5 Verify: v1-latest is on the new version, latest is still v2, and isLatest is false.
• v1-6 Notes: stay neutral while the advisories are unpublished, then edit the Release to link them.

security-advisory skill, step 5: "Merging from the private fork"

• Private forks don't run Actions, so required DCO / build checks stay "Expected". The fix is to remove only the required_status_checks rule for the merge and then restore it from a snapshot. That is an admin act, so the skill says to get the maintainer's go-ahead first.
• Merging an advisory merges all of its fork's PRs at once.
• Chained fix branches need "Create a merge commit".

I checked every fact against origin/v1/main and the live repo: the package and lockfile fields, the update-version script, v1/main's workflow jobs, the 1.* tag ruleset, the required build check, and isLatest: false on 1.0.0–1.0.3. release stays disable-model-invocation: true. No description changed, so the listing budget stays at 3907/4000. verify:skills and local:gate pass.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Two verification instructions need correction: an unsupported GitHub CLI JSON field and a clean-worktree expectation immediately after uncommitted edits.

2 open issues

• Compare lockfile contents instead of requiring a clean worktree · New
• Use gh release list to verify the latest release · New

What changed in this PR

Documents the v1 release procedure and private advisory-fork merge constraints, addressing the gaps encountered while releasing 1.0.3.

Changes:

• Adds v1 version-bump, merge-order, publishing, verification, and release-note steps.
• Records required-check limitations, temporary ruleset changes, and stacked-branch merge requirements for advisory forks.

File	Description
.claude/​skills/​security-advisory/​SKILL.md	Documents private-fork merge constraints and protection-restoration safeguards.
.claude/​skills/​release/​SKILL.md	Expands the v1 release outline into a six-step procedure.

_{Review effort: Balanced}

[cliffhall]

Copilot round 1: both findings fixed in 17d82da.

• v1-1 lockfile check: now compares the lockfile before and after npm ci (cmp) instead of expecting a clean worktree, which the uncommitted bump makes dirty.
• v1-5 isLatest check: gh release view has no such field. It now uses gh release list --json tagName,isLatest.

[Copilot]

🟢 Approval recommended

The documentation matches the linked requirements, both prior findings are resolved, and no blocking issues remain.

No open issues 🎉

2 resolved since last review

• Use gh release list to verify the latest release
• Compare lockfile contents instead of requiring a clean worktree

_{Review effort: Balanced}

[cliffhall]

Copilot review closed: round 2 came back clean (no inline comments, nothing suppressed), with both round-1 findings marked resolved.