$npx -y skills add CommonstackAI/ClawBox --skill clawbox-release-packagingUse when changing ClawBox Tauri packaging, sidecar bootstrapping, version synchronization, Bun backend compilation, or release-related scripts and configuration. This includes the UTC date-based version generator, Tauri and Cargo version sync, Windows installer signing helpers, a
| 1 | # ClawBox Release Packaging |
| 2 | |
| 3 | Use this skill when the task involves ClawBox versioning, Tauri configuration, backend binary packaging, sidecar lifecycle, or release build scripts. |
| 4 | |
| 5 | ## Read first |
| 6 | |
| 7 | - `package.json` |
| 8 | - `docs/releasing.md` |
| 9 | - `.github/release-notes-template.md` |
| 10 | - `docs/releases/` |
| 11 | - `scripts/collect-release-assets.mjs` |
| 12 | - `scripts/release-version.mjs` |
| 13 | - `scripts/sync-version.mjs` |
| 14 | - `scripts/sign-win-installer.mjs` |
| 15 | - `scripts/build-backend.mjs` |
| 16 | - `.github/workflows/release.yml` |
| 17 | - `src-tauri/tauri.conf.json` |
| 18 | - `src-tauri/Cargo.toml` |
| 19 | - `src-tauri/src/lib.rs` |
| 20 | - `internal/onboard/` if the task also affects runtime bootstrap or environment setup |
| 21 | |
| 22 | ## Workflow |
| 23 | |
| 24 | 1. Identify which layer is changing: UTC version generation, version synchronization, Bun backend compile output, Tauri shell, release workflow guard, release-notes lookup, release-asset filtering, or installer/signing script. |
| 25 | 2. Preserve `package.json` as the single source of truth for the app version. Any version automation must keep `package-lock.json`, `src-tauri/tauri.conf.json`, and `src-tauri/Cargo.toml` aligned. |
| 26 | 3. Keep the UTC date-based version format semver-safe. The current release flow uses `YYYY.M.D-N`, with `git fetch --tags` plus local `vYYYY.M.D-N` tags determining the next sequence. |
| 27 | 4. Keep sidecar naming and resource lookup behavior aligned with `scripts/build-backend.mjs` and `src-tauri/src/lib.rs`. |
| 28 | 5. Keep Windows installer signing dynamic. `tauri:build-win:sign-installer` should resolve `ClawBox_<version>_x64-setup.exe` from `package.json`, not from a hard-coded filename. |
| 29 | 6. Keep release publication scoped to user-facing assets only. The workflow should publish final `.dmg`, `.exe`, and the combined `CHECKSUMS.txt`, not the entire Tauri bundle tree. |
| 30 | 7. Keep release notes lookup aligned with the documented flow. Hand-written notes live at `docs/releases/<tag>.md`, with GitHub-generated notes as the fallback when the file is absent. |
| 31 | 8. If the change touches release publication behavior rather than packaging/configuration, hand off to `clawbox-release-publish` instead of extending this skill. |
| 32 | 9. If the change touches Windows signing or platform-specific installers, note any credentials or OS environments you could not validate. |
| 33 | |
| 34 | ## Verification |
| 35 | |
| 36 | - Run `node scripts/release-version.mjs --dry-run` or `npm run release:version -- --dry-run` when changing release-version logic. |
| 37 | - Run `npm run sync-version`. |
| 38 | - Run `npm run build:backend`. |
| 39 | - If Rust is available, run `cargo check --manifest-path src-tauri/Cargo.toml`. |
| 40 | - If the change touches the release workflow, confirm that the workflow still rejects a tag/version mismatch, still publishes only final user assets, and still prefers `docs/releases/<tag>.md` over auto-generated notes when that file exists. |
| 41 | |
| 42 | ## Guardrails |
| 43 | |
| 44 | - Do not guess bundle resource paths or binary names. |
| 45 | - Do not hand-edit version values when changing the automated version flow; keep `npm version ... --no-git-tag-version` as the writer for `package.json` and `package-lock.json`. |
| 46 | - Do not reintroduce a hard-coded Windows installer filename into `package.json` scripts. |
| 47 | - Do not blur the boundary between "release packaging/config" and "actual release execution"; use `clawbox-release-publish` when the task is to cut, commit, tag, or push a release. |
| 48 | - Keep cross-platform branches explicit instead of merging them into a single simplified path. |
| 49 | - Mention any skipped platform validation in the final response. |