riela-package-release

name	riela-package-release
description	Use when maintaining the riela-packages registry for package updates, release preparation, publishing registry changes, refreshing riela-package.json checksum and integrity digests, validating packaged workflows, updating README package listings, or doing pre-push release checks for packages under packages/*.

Riela Package Release

Use this skill in the riela-packages registry repository when preparing package updates for commit, push, or release. This is maintainer-facing; for installing or updating a package as an end user, use riela-package.

Repository Assumptions

• Run commands from the repository root.
• Package roots live at packages/<package-id>.
• Each package has riela-package.json.
• Directory names under packages/ should be filesystem-safe. The package id in riela-package.json.name may be unscoped or npm-style scoped, for example @tacogips/youtube-mp4-download-addon; prefer scoped ids for third-party or personal registries.
• Node add-on package entries use a separate add-on namespace in addons[].name, for example tacogips/youtube-mp4-download. The riela/ add-on namespace is reserved for built-ins.
• The local riela source checkout is expected at ../riela unless RIELA_ROOT is set.
• bun, task, and the local Swift Riela checkout should be available.

Standard Workflow

1. Inspect the intended release scope:

git status --short
git diff --stat
git diff -- packages/<package-id>

2. If a workflow, packaged skill, prompt, script, or package payload changed, refresh package digests:

bun .agents/skills/riela-package-release/scripts/update-package-digests.ts <package-id>

If add-on source files under addons[].sourcePath changed, also refresh add-on content digests and dependency locks:

bun .agents/skills/riela-package-release/scripts/update-addon-content-digests.ts <package-id>

For broad changes or after moving shared packaged skills, refresh every manifest:

bun .agents/skills/riela-package-release/scripts/update-package-digests.ts --all

Use --dry-run first when you only need to see stale manifests.

3. Validate package metadata and workflows:

task check

This runs digest checks for every package, validates every package manifest with the Swift Riela decoder, and validates concrete packaged workflows with cross-workflow callees visible. Workflows that only extend another workflow are covered by package validation and skipped during direct workflow validation.

4. If package names, descriptions, tags, backends, or package inventory changed, update README.md package listings and verify the table still matches packages/*/riela-package.json.

5. Review install-facing behavior for changed packages:

swift run --package-path "${RIELA_ROOT:-../riela}" riela package search "<package-id>" --registry default --refresh --output json

For workflow packages, also verify the workflow can be inspected or validated from the package payload when relevant.

For container node add-on packages, after GHCR images have been pushed, update execution.imageDigest pins and regenerate the registry index:

task package:update-container-image-digests
task package:generate-index

The Container Images workflow uploads per-package digest artifacts named container-image-digest-<package-id>. After downloading those artifacts, merge them and pin manifests without another GHCR lookup:

jq -s 'add' container-image-digest-*/*.json > image-digests.json
bun .agents/skills/riela-package-release/scripts/update-container-image-digests.ts --all --digest-file image-digests.json
task package:generate-index

For release archive publication, generate .rielapkg assets and the release-scoped registry index:

task package:generate-release-index

The GitHub Package Archives workflow publishes those assets to the fixed registry-packages release. The release-scoped index includes archiveURL and archiveSHA256 pins for clone-free installs.

After publication, verify that the fixed release contains every generated archive plus package-archives.json and registry-index.json:

task package:check-release-publication

6. Before commit or push, run a commit-target safety review. Check only staged or intended content for real credentials, private URLs, and machine-local absolute paths.

Digest Script

scripts/update-package-digests.ts recomputes workflow package digests:

• checksum using computeWorkflowPackageChecksum
• integrity.digest using computeWorkflowPackageIntegrityDigest
• checksumAlgorithm: "md5"
• integrity.digestAlgorithm: "sha256"

kind: "node-addon" packages are included by this script. Their package-level checksum and integrity digest cover the package payload, while add-on contentDigest values remain explicit add-on artifact locks.

scripts/update-addon-content-digests.ts recomputes those add-on locks:

• addons[].contentDigest as sha256 over the add-on sourcePath file tree, using the same file-walk recipe and cache-file exclusions as the package digest script
• matching dependencies[].addons[].contentDigest locks in every package manifest are synced to the recomputed values

Run it whenever add-on source files change, then refresh package digests and regenerate the registry index. Use --check (or --dry-run) to fail on stale digests without writing; task package:check-addon-digests wires this into task check.

Examples:

bun .agents/skills/riela-package-release/scripts/update-package-digests.ts codex-design-and-implement-review-loop
bun .agents/skills/riela-package-release/scripts/update-package-digests.ts --all --dry-run
RIELA_ROOT=/path/to/riela bun .agents/skills/riela-package-release/scripts/update-package-digests.ts --all

If --dry-run finds stale manifests, it exits non-zero and reports the fields that would change.

Release Readiness

Treat a package update as release-ready only when:

• package manifests are refreshed and task package:check-digests passes
• packaged workflows validate through task workflow:validate
• .rielapkg release archives are regenerated when package payloads change
• generated or packaged skills still have valid SKILL.md frontmatter and matching agents/openai.yaml
• README.md reflects any package inventory or metadata changes
• container node add-ons either have no published image yet or have refreshed execution.imageDigest pins from GHCR after image publication
• git diff --cached has been safety-reviewed before commit
• the final branch is pushed to the registry branch that consumers use, normally main

Reporting

Report the changed package ids, refreshed digest fields, validation commands and results, commit id, and pushed branch. If validation cannot run, state the missing dependency or failing command exactly.