release-kit 0.2.6

A canonical release workflow: a technology-agnostic method, per-technology bindings, and the rk CLI that lands and serves them.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181

# The pinned-tool registry: every tool a snippet pins, declared once. Each
# entry names the pinned version, the workflow reference where one exists,
# which bindings use it, and the URL a freshness check queries. The rk-setup
# skill reads this registry and checks each relevant entry upstream before
# landing files; checked is the date of the last such comparison.
#
# An entry with an action carries two refs with two jobs: commit is the
# immutable execution reference the workflows run, and the tag or branch in
# action is the discovery ref a freshness check reads for reviewed updates,
# classified by ref_class as a moving-major-tag, moving-minor-tag, or
# maintained-branch. Those refs exist to move — movement is an update
# signal, never evidence of an attack — and the pinned commit is what keeps
# that movement from changing what executes before someone reviews it.

[[tool]]
name = "release-plz"
version = "0.3.160"
action = "release-plz/action@v0.5"
commit = "2eb1d8bcb770b4c48ccfaad919734b38b51958c9"
ref_class = "moving-minor-tag"
used_by = ["rust"]
purpose = "maintains the release request and tags and publishes on master"
check = "https://crates.io/api/v1/crates/release-plz"
checked = 2026-09-02

[[tool]]
name = "cargo-dist"
version = "0.32.0"
used_by = ["rust"]
purpose = "generates release.yml and builds and attaches the installers"
check = "https://api.github.com/repos/axodotdev/cargo-dist/releases/latest"
checked = 2026-09-02

[[tool]]
name = "rust-toolchain"
version = "stable"
action = "dtolnay/rust-toolchain@stable"
commit = "4360b52568e2003a75bf9bc1d59f33a8e3fc893c"
ref_class = "maintained-branch"
used_by = ["rust"]
purpose = "installs the toolchain release-plz builds and publishes with"
checked = 2026-09-02

[[tool]]
name = "release-please"
version = "17.11.2"
action = "googleapis/release-please-action@v5"
commit = "45996ed1f6d02564a971a2fa1b5860e934307cf7"
ref_class = "moving-major-tag"
used_by = ["python"]
purpose = "maintains the release request and bumps pyproject.toml"
check = "https://api.github.com/repos/googleapis/release-please/releases/latest"
checked = 2026-09-02

[[tool]]
name = "gh-action-pypi-publish"
version = "1.14.2"
action = "pypa/gh-action-pypi-publish@release/v1"
commit = "dc37677b2e1c63e2034f94d8a5b11f265b73ba33"
ref_class = "maintained-branch"
used_by = ["python"]
purpose = "publishes the built distributions to PyPI over OIDC"
check = "https://api.github.com/repos/pypa/gh-action-pypi-publish/releases/latest"
checked = 2026-09-02

[[tool]]
name = "pypi-attestations"
version = "0.0.30"
used_by = ["python"]
purpose = "verifies a published distribution's PEP 740 attestations in the release verify step"
check = "https://api.github.com/repos/pypi/pypi-attestations/releases/latest"
checked = 2026-09-02

[[tool]]
name = "git-cliff"
version = "2.13.1"
used_by = ["bash"]
purpose = "computes the bump from Conventional Commits and rewrites the changelog"
check = "https://api.github.com/repos/orhun/git-cliff/releases/latest"
checked = 2026-09-02

[[tool]]
name = "cosign"
version = "3.1.3"
used_by = ["bash"]
purpose = "signs the GitLab runner's SLSA provenance statement keylessly in the release pipeline"
check = "https://api.github.com/repos/sigstore/cosign/releases/latest"
checked = 2026-09-02

[[tool]]
name = "create-github-app-token"
version = "3"
action = "actions/create-github-app-token@v3"
commit = "bcd2ba49218906704ab6c1aa796996da409d3eb1"
ref_class = "moving-major-tag"
used_by = ["rust", "python", "bash"]
purpose = "mints the bot token that lets a tag push retrigger workflows"
check = "https://api.github.com/repos/actions/create-github-app-token/releases/latest"
checked = 2026-09-02

[[tool]]
name = "attest"
version = "4"
action = "actions/attest@v4"
commit = "1e69f48acb82d1966a394da916b4c1698aa569d6"
ref_class = "moving-major-tag"
used_by = ["rust", "bash"]
purpose = "signs the built artifacts with a build-provenance attestation, in the bash release workflow and inside the cargo-dist generated one"
check = "https://api.github.com/repos/actions/attest/releases/latest"
checked = 2026-09-02

[[tool]]
name = "checkout"
version = "4"
action = "actions/checkout@v4"
commit = "11d5960a326750d5838078e36cf38b85af677262"
ref_class = "moving-major-tag"
used_by = ["rust", "python", "bash"]
purpose = "checks out the repository in every workflow job"
check = "https://api.github.com/repos/actions/checkout/releases/latest"
checked = 2026-09-02

[[tool]]
name = "setup-python"
version = "7"
action = "actions/setup-python@v7"
commit = "5fda3b95a4ea91299a34e894583c3862153e4b97"
ref_class = "moving-major-tag"
used_by = ["python"]
purpose = "provides the interpreter that builds the distributions"
check = "https://api.github.com/repos/actions/setup-python/releases/latest"
checked = 2026-09-02

[[tool]]
name = "dist-checkout"
version = "6"
action = "actions/checkout@v6"
commit = "d23441a48e516b6c34aea4fa41551a30e30af803"
ref_class = "moving-major-tag"
used_by = ["rust"]
purpose = "checks out the repository inside the cargo-dist generated workflow"
check = "https://api.github.com/repos/actions/checkout/releases/latest"
checked = 2026-09-02

[[tool]]
name = "dist-download-artifact"
version = "8"
action = "actions/download-artifact@v8"
commit = "3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c"
ref_class = "moving-major-tag"
used_by = ["rust"]
purpose = "gathers the built assets inside the cargo-dist generated workflow"
check = "https://api.github.com/repos/actions/download-artifact/releases/latest"
checked = 2026-09-02

[[tool]]
name = "dist-upload-artifact"
version = "7"
action = "actions/upload-artifact@v7"
commit = "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
ref_class = "moving-major-tag"
used_by = ["rust"]
purpose = "exports the built assets inside the cargo-dist generated workflow"
check = "https://api.github.com/repos/actions/upload-artifact/releases/latest"
checked = 2026-09-02

[[tool]]
name = "conventional-pre-commit"
version = "4.4.0"
used_by = ["rust", "python", "bash"]
purpose = "holds every commit message to the scoped convention through the landed commit-msg hook"
check = "https://api.github.com/repos/compilerla/conventional-pre-commit/releases/latest"
checked = 2026-09-02

[[tool]]
name = "pre-commit-hooks"
version = "6.0.0"
used_by = ["rust", "python", "bash"]
purpose = "refuses a commit made on the trunk through the landed no-commit-to-branch hook"
check = "https://api.github.com/repos/pre-commit/pre-commit-hooks/releases/latest"
checked = 2026-09-02