🔨 (chore) [NO-ISSUE]: Add agent-driven release scripts and skill by aussedatlo · Pull Request #1424 · LedgerHQ/device-sdk-ts

aussedatlo · 2026-04-13T17:28:23Z

📝 Description

Replace the obsolete ldmk-tool release commands with a new set of agent-driven release scripts under .cursor/scripts/release/ and a Cursor skill (.cursor/skills/release/SKILL.md) that orchestrates the full release flow.

Changes:

Add 10 release scripts: preflight, discover, bump, changelog, pin-deps, set-private, create-pr, revert-private, unpin-deps, cleanup
Add a release skill (SKILL.md) documenting the step-by-step release process
Update AGENTS.md with skill/command/rule/hook documentation
Update PR templates (release & backmerge)
Remove obsolete ldmk-tool release scripts (release.cjs, bump.cjs, create-release-pr.cjs, cli.cjs)
Move hook scripts to .cursor/scripts/hooks/

❓ Context

JIRA or GitHub link: [NO-ISSUE]
Feature: Agent-driven release automation for the DMK monorepo

✅ Checklist

Covered by automatic tests — Internal tooling, no runtime code changes
Changeset is provided — No changeset needed: changes only affect internal tooling (.cursor/, .github/, packages/tools/ldmk-tool/)
Documentation is up-to-date — AGENTS.md and README.md updated
Impact of the changes:
- New agent-driven release workflow via Cursor skill
- Old ldmk-tool release commands removed
- No impact on published packages or runtime behavior

Made with Cursor

vercel · 2026-04-13T17:28:34Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
device-sdk-ts-sample	Ready	Preview, Comment	Apr 17, 2026 9:26am

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
doc-device-management-kit	Ignored		Apr 17, 2026 9:26am

ledger-wiz-cspm-secret-detection · 2026-04-13T17:28:58Z

Wiz Scan Summary

Scanner	Findings
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	2
Software Management Findings	-

Total	2

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

github-actions · 2026-04-13T17:43:29Z

Danger Check Results

Messages

⚠️	No changeset file found. Please make sure this is intended or add a changeset file.
✅	Danger: All checks passed successfully! 🎉

Generated by 🚫 dangerJS against 103e487

Copilot

Pull request overview

This PR replaces the deprecated ldmk-tool release workflow with an agent-driven release flow implemented as Cursor scripts under .cursor/scripts/release/ and documented as a Cursor skill.

Changes:

Added a new scripted release pipeline (preflight → discover → set-private → pin-deps → bump → changelog → cleanup → create-pr + revert/unpin helpers).
Removed legacy ldmk-tool release commands/scripts and updated docs/templates to reference the new flow.
Moved Cursor hook scripts to .cursor/scripts/hooks/ and updated .cursor/hooks.json accordingly.

Reviewed changes

Copilot reviewed 23 out of 26 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
pnpm-lock.yaml	Lockfile updates reflecting dependency graph changes (notably `ldmk-tool` deps).
packages/tools/ldmk-tool/release.cjs	Removed legacy enter/exit release workflow script.
packages/tools/ldmk-tool/package.json	Dropped `semver` dependency from `ldmk-tool`.
packages/tools/ldmk-tool/create-release-pr.cjs	Removed legacy release PR creation script.
packages/tools/ldmk-tool/cli.cjs	Removed legacy release-related CLI commands (`enter-release`, `exit-release`, `bump`, `create-release-pr`).
packages/tools/ldmk-tool/bump.cjs	Removed legacy changeset bump script.
package.json	Removed obsolete `commitcl` helper script.
README.md	Added a “Release” section pointing to the Cursor skill/scripts and release PR template.
AGENTS.md	Documented Cursor skills/commands/rules/hooks and sandbox permission notes.
.github/pull_request_release_template.md	Updated release PR template (package sections + checklist references new Cursor scripts).
.github/pull_request_backmerge_template.md	Updated backmerge template to use new revert/unpin scripts.
.cursor/skills/release/SKILL.md	Added the release skill documentation describing the step-by-step release process.
.cursor/scripts/release/unpin-deps.cjs	New script to restore internal deps back to `workspace:^`.
.cursor/scripts/release/set-private.cjs	New script to toggle `private` flags and auto-include major-bump dependents (with a generated changeset).
.cursor/scripts/release/revert-private.cjs	New script to revert `private:true` back to `private:false` for workspace packages.
.cursor/scripts/release/preflight.cjs	New preflight checks for tooling/auth availability before running the release flow.
.cursor/scripts/release/pin-deps.cjs	New script to pin internal workspace deps to concrete versions for non-released internal packages.
.cursor/scripts/release/discover.cjs	New script to output workspace package + changeset metadata as JSON for confirmation.
.cursor/scripts/release/create-pr.cjs	New script to generate a release PR with version summary and open it via `gh`.
.cursor/scripts/release/config.cjs	New shared release configuration (aliases, display names, workspace package discovery, changeset parsing/enrichment).
.cursor/scripts/release/cleanup.cjs	New script to delete consumed changeset files for packages in the release set.
.cursor/scripts/release/changelog.cjs	New script to generate/update package changelogs using changeset metadata enriched via GitHub API.
.cursor/scripts/release/bump.cjs	New script to compute/apply semver bumps and propagate patch bumps to dependents.
.cursor/scripts/hooks/post-task-checks.cjs	Moved/added hook to run package-local tests/lint/typecheck after agent tasks.
.cursor/scripts/hooks/format.cjs	Moved/added hook to auto-format edited files with Prettier.
.cursor/hooks.json	Updated hook command paths to the new `.cursor/scripts/hooks/` location.

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Introduce agent skills orchestrating the release and backmerge flows, backed by dedicated scripts under .cursor/scripts/release/. Move editor hooks under .cursor/scripts/hooks/ and document the new skills, hooks, and sandbox requirements in AGENTS.md. Made-with: Cursor

…e skill Delete enter-release, exit-release, bump, and create-release-pr commands along with their implementation files. The release flow is now driven by the agent release skill and its dedicated scripts. Made-with: Cursor

Update the signer generator to add the new package to the release configuration so it is picked up by the release skill automatically. Made-with: Cursor

Align the release and backmerge PR templates with the new skill-driven flow, document the skills in the README, add the semver dependency, and normalize pnpm-workspace catalog formatting. Made-with: Cursor

Copilot

Pull request overview

Copilot reviewed 26 out of 29 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-17T09:26:21Z

+    } catch (err) {
+      throw new Error(`Failed to fetch PR metadata for commit ${sha}. Is gh authenticated?\n${err.message}`);
+    }
+    const data = JSON.parse(result.stdout.trim());


gh api ... --jq '.[0] | ...' can legitimately output null (e.g., if a commit isn’t associated with a PR), and JSON.parse('null') returns null, so data.number will throw a TypeError. Handle empty/null output explicitly and raise a clear error (or allow changelog entries without PR metadata).

Suggested change

const data = JSON.parse(result.stdout.trim());

const output = result.stdout.trim();

if (!output || output === "null") {

throw new Error(`No PR metadata found for commit ${sha}. The commit may not be associated with a pull request.`);

}

let data;

try {

data = JSON.parse(output);

} catch (err) {

throw new Error(`Failed to parse PR metadata for commit ${sha}: ${err.message}`);

}

if (!data || typeof data !== "object") {

throw new Error(`Invalid PR metadata for commit ${sha}: ${output}`);

}

Copilot · 2026-04-17T09:26:21Z

+        // Insert into ALIASES: find the last "signer-*" line that sorts before ours or before "signer-utils"
+        const aliasLines = releaseConfigContent.match(/^ {2}"signer-[^"]*":.*$/gm) || [];
+        let aliasInsertAfter = null;
+        for (const line of aliasLines) {
+          const key = line.match(/"(signer-[^"]+)"/)?.[1];
+          if (key && key < aliasKey) {
+            aliasInsertAfter = line;
+          }
+        }
+        if (aliasInsertAfter) {
+          const newAliasLine = `  "${aliasKey}": "${fullPkgName}",`;
+          releaseConfigContent = releaseConfigContent.replace(
+            aliasInsertAfter,
+            `${aliasInsertAfter}\n${newAliasLine}`
+          );
+        }


If aliasInsertAfter is not found (e.g., the new alias sorts before all existing signer-* keys), nothing is inserted into config.cjs, but the script still writes the file and prints a success message. Add a fallback insertion strategy (e.g., insert after the opening { of ALIASES / DISPLAY_NAMES, or append before the closing }) and only print success when an insertion actually occurred.

sonarqubecloud · 2026-04-17T09:27:04Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions bot assigned aussedatlo Apr 13, 2026

aussedatlo force-pushed the feat/no-issue-release-skill branch from ec96ee8 to 5edd02b Compare April 13, 2026 17:31

vercel bot had a problem deploying to Preview – device-sdk-ts-sample April 13, 2026 17:31 Failure

aussedatlo force-pushed the feat/no-issue-release-skill branch from 5edd02b to 7cacc1a Compare April 13, 2026 17:38

vercel bot deployed to Preview – device-sdk-ts-sample April 13, 2026 17:43 View deployment

mbertin-ledger reviewed Apr 14, 2026

View reviewed changes

Comment thread .cursor/skills/release/SKILL.md Outdated

aussedatlo marked this pull request as ready for review April 14, 2026 07:59

aussedatlo requested a review from a team as a code owner April 14, 2026 07:59

Copilot AI review requested due to automatic review settings April 14, 2026 07:59

Copilot started reviewing on behalf of aussedatlo April 14, 2026 08:00 View session

Copilot AI reviewed Apr 14, 2026

View reviewed changes

vercel bot deployed to Preview – device-sdk-ts-sample April 14, 2026 08:52 View deployment

aussedatlo force-pushed the feat/no-issue-release-skill branch from dee302e to 3aee4cf Compare April 14, 2026 09:47

vercel bot deployed to Preview – device-sdk-ts-sample April 14, 2026 09:51 View deployment

aussedatlo force-pushed the feat/no-issue-release-skill branch from 3aee4cf to 2151fd7 Compare April 14, 2026 09:56

vercel bot deployed to Preview – device-sdk-ts-sample April 14, 2026 09:57 View deployment

aussedatlo force-pushed the feat/no-issue-release-skill branch from 2151fd7 to 287bf9f Compare April 14, 2026 10:14

vercel bot deployed to Preview – device-sdk-ts-sample April 14, 2026 10:15 View deployment

vercel bot deployed to Preview – device-sdk-ts-sample April 14, 2026 13:06 View deployment

vercel bot deployed to Preview – device-sdk-ts-sample April 17, 2026 08:47 View deployment

aussedatlo requested a review from Copilot April 17, 2026 09:20

Copilot started reviewing on behalf of aussedatlo April 17, 2026 09:21 View session

aussedatlo added 4 commits April 17, 2026 11:24

✨ (ldmk-tool): Register new signer in release tooling during generation

13136ca

Update the signer generator to add the new package to the release configuration so it is picked up by the release skill automatically. Made-with: Cursor

🔧 (chore): Update PR templates, docs, and deps for agent release flow

103e487

Align the release and backmerge PR templates with the new skill-driven flow, document the skills in the README, add the semver dependency, and normalize pnpm-workspace catalog formatting. Made-with: Cursor

aussedatlo force-pushed the feat/no-issue-release-skill branch from 75807ba to 103e487 Compare April 17, 2026 09:26

Copilot AI reviewed Apr 17, 2026

View reviewed changes

vercel bot deployed to Preview – device-sdk-ts-sample April 17, 2026 09:26 View deployment

-    const data = JSON.parse(result.stdout.trim());
+    const output = result.stdout.trim();
+    if (!output || output === "null") {
+      throw new Error(`No PR metadata found for commit ${sha}. The commit may not be associated with a pull request.`);
+    }
+    let data;
+    try {
+      data = JSON.parse(output);
+    } catch (err) {
+      throw new Error(`Failed to parse PR metadata for commit ${sha}: ${err.message}`);
+    }
+    if (!data || typeof data !== "object") {
+      throw new Error(`Invalid PR metadata for commit ${sha}: ${output}`);
+    }

Conversation

aussedatlo commented Apr 13, 2026

📝 Description

❓ Context

✅ Checklist

Uh oh!

vercel bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ledger-wiz-cspm-secret-detection bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Wiz Scan Summary

Uh oh!

github-actions bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Danger Check Results

Messages

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Apr 17, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

vercel bot commented Apr 13, 2026 •

edited

Loading

ledger-wiz-cspm-secret-detection bot commented Apr 13, 2026 •

edited

Loading

github-actions bot commented Apr 13, 2026 •

edited

Loading