Design, implement, and review secure Go CLI release automation with versioned tags, GoReleaser, GitHub Actions, checksums, signing, provenance, changelogs, Homebrew distribution, least-privilege credentials, verification, and recovery.
SkillScore91Maintained
Automatic
◆DevOps & SRE pack
Last verified 8/16/2026
What it changes
Passed 20 of 22 test cases with the skill, and 17 of 22 without it.
Without skill77%
With skill91%
Checks it passed that the model alone missed
Requires recording existing partial state prior to recovery operations
Requires building release artifacts exactly once from a clean tagged commit
Forbids locally compiling replacement binaries to append to existing release checksums
and 1 more in the full report
3 fixed17 passed either way2 still failing0 broke
Pass-rate lift
+14 pp
Tokens
-8%
Agent turns
0%
Response time
-32%
Model gemini-3.6-flashMeasured 8/16/2026v120 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 3
Prompt
If a release workflow halts midway through execution after publishing 2 out of 5 platform binaries, what must be done with the partially published state before attempting remediation?
What was checked, without and with the skill
Checked
Without skill
With skill
Requires recording the partial release state explicitly prior to taking recovery actions
Missed
Passed
case-14 · gemini-3.6-flash · 8/16/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md44 linessingle file
Go CLI Release Automation
Treat release automation as a state transition with verifiable inputs, immutable
artifacts, least privilege, and an explicit recovery path.
Core Workflow
Define version, supported targets, artifact names, and release authority.
Validate release configuration without publishing.
Build final artifacts exactly once from a clean tagged commit and generate checksums.
Publish through pinned, least-privilege CI with protected environments.
Update package-manager metadata from the published artifacts.
Install and smoke-test representative artifacts.
Record partial state and recover without silently replacing released bytes.
Never release from an unreviewed or dirty source state.
Do not grant write tokens to pull-request jobs or untrusted code.
Pin CI actions and use current, supported GoReleaser configuration.
Do not treat build tags as authorization controls.
Do not overwrite published artifacts under the same version.
Do not accept locally rebuilt bytes as recovery evidence.
Source Notes
Guidance is transformed and paraphrased from Marian Montagnino,
Building Modern CLI Applications in Go (Packt, 2023), Chapters 7 and 12-14,
and Ricardo Gerardi, Powerful Command-Line Applications in Go (2021).