chore(skills): add release-widget skill

[yordan-st]

Summary

• Adds `.agents/skills/release-widget/SKILL.md` — automates widget/module release pipeline (version bump → GitHub draft release → OSS clearance → Marketplace publish)
• Previously ran as private trial (untracked); opening as draft for team feedback before promoting to shared skill set

Test plan

• Used successfully for image-web v1.6.0 and charts-web v6.3.2 releases

[github-actions]

AI Code Review

🔶 Changes requested — one or more medium-severity items must be addressed

---

What was reviewed

File	Change
.agents/skills/release-widget/SKILL.md	New release skill — phases 0–8, autonomy carve-outs, common mistakes
automation/utils/bin/rui-bump-version.ts	New CLI: version bump with validation
automation/utils/bin/rui-changelog.ts	New CLI: unreleased changelog reader
automation/utils/bin/rui-create-jira-version.ts	New CLI: Jira version creation (soft-fail)
automation/utils/bin/rui-generate-oss-sbom.ts	New CLI: SBOM artifact generation
automation/utils/bin/rui-package-info.ts	New CLI: package info reader from cwd
automation/utils/bin/rui-upload-readme-oss.ts	New CLI: READMEOSS asset upload
automation/utils/package.json	Registered new bin entries
automation/utils/src/bump-version.ts	Refactor: Version class, write validation, hasPackageXml helper
automation/utils/src/changelog-parser/index.ts	Added getPackageChangelog unified parser
automation/utils/src/github.ts	Renamed GitHubDraftRelease → GitHubRelease, new getReleaseByTag/listReleases
automation/utils/src/monorepo.ts	Added resolvePackagePath helper
automation/utils/src/oss-clearance.ts	Extracted computeSha256, new verifyAssetDigest
automation/utils/src/package-info.ts	Added isReleasable()
automation/utils/src/prepare-release-helpers.ts	Simplified to use getPackageChangelog
automation/utils/src/version.ts	Fixed bumpMajor bug, added isGreaterThan

Skipped (out of scope): dist/, pnpm-lock.yaml

---

Findings

🔶 Medium — Snyk security CI check failing

File: CI checks
Problem: security/snyk (AppDev AppStore content) is reporting FAILURE. Per the review guidelines, CI must be green before merge. The code/snyk and license/snyk checks passed, so this is specifically the security scan.
Fix: Check the Snyk PR check URL and resolve the flagged vulnerability or add a suppression with justification if it is a false positive.

---

🔶 Medium — verifyAssetDigest silently skips integrity check when digest is absent

File: automation/utils/src/oss-clearance.ts line 933–941
Problem: The asset.digest field is typed as string (non-optional in GitHubReleaseAsset), but verifyAssetDigest uses optional chaining (?.) and then guards with if (expectedDigest && ...). If digest is ever falsy — empty string, undefined at runtime despite the type — the integrity check is silently skipped and the function returns the local hash without verifying it matches what GitHub reported. The old rui-oss-clearance.ts code called .replace(...) directly (no optional chain), which would throw a TypeError on a null digest rather than silently proceeding. Silent skip is a worse failure mode here because the SBOM zip is named after the hash and submitted to the OSS clearance portal.
Fix:

export async function verifyAssetDigest(asset: GitHubReleaseAsset, downloadedPath: string): Promise<string> {
    const fileHash = await computeSha256(downloadedPath);
    const expectedDigest = asset.digest.replace("sha256:", "");

    if (fileHash !== expectedDigest) {
        throw new Error(
            `Asset integrity check failed for '${asset.name}': expected ${expectedDigest}, got ${fileHash}`
        );
    }

    return fileHash;
}

If some GitHub releases legitimately lack a digest, add an explicit branch that logs a warning and returns, rather than the current invisible skip.

---

⚠️ Low — listReleases fetches only the first 100 releases

File: automation/utils/src/github.ts line 862–867
Note: The new listReleases method appends ?per_page=100 but has no pagination loop. For getReleaseByTag, this means a draft whose tag isn't found in the most recent 100 releases would be silently missed and the method returns undefined. Repos with long release histories (this one has many) could hit this limit. Since drafts are recent, this is unlikely to be a problem in practice, but it is worth noting for future callers of the public listReleases API.

---

Positives

• Bug fix in bumpMajor() — the original incremented minor instead of major (this.major, this.minor + 1); this PR silently fixed a year-old bug without fanfare.
• bumpPackageJson now verifies the write — reading back package.json after pnpm version and throwing if the version wasn't updated catches silent pnpm version failures that were previously swallowed.
• getReleaseByTag draft fallback is well-motivated — the comment correctly explains that GitHub's releases/tags/{tag} endpoint returns 404 for drafts (no git tag yet), making the list-and-filter fallback necessary rather than defensive.
• isReleasable() cleanly encodes the two failure modes — both null (module-wrapped widget) and -1 (never published) return false, matching the documented semantics in the JSDoc.
• Phase 8 (rollback) is correctly gated — the skill explicitly carves rollback out of the autonomy exception and lists teardown commands for human confirmation before executing any of them. Good safety design.
• computeSha256 extracted as a shared utility — removes the duplicated createHash/pipeline block that existed in rui-oss-clearance.ts and would have needed to exist again in rui-generate-oss-sbom.ts.
• getPackageChangelog unified parser — replaces a scattered if changelogType === "widget" branch in two separate callers with a single delegating function; the JSDoc explains why the fallback chain is needed.