releasepro
One gated GitHub Actions release run for any repo:
- a person says yes at each channel's gate;
- no token is stored anywhere;
- every channel is checked until it lists the version;
- the release notes and an announcement draft come from your changelog.
The promise: a version is announced only once it can be installed from every channel, and nothing is published without a person's yes.
releasepro started as the release tool of gitpro, which releases to GitHub, PyPI, the VS Code Marketplace, Open VSX, the MCP Registry and its site from one run. The spec is docs/spec/00-product.md.
Install
pipx install releasepro
It needs Python 3.9 or newer, git, and the GitHub CLI gh 2.40 or newer, signed in
to the account that approves releases.
Use
Put a releasepro.toml at the root of your repo:
[release]
repo = "Owner/name"
version_file = "src/name/VERSION" # the first word of line 1 is X.Y.Z
branch = "main"
workflow = "release.yml" # started with workflow_dispatch
preflight = ["gitpro why"] # commands that must exit 0 first
[channel.github]
assets = ["name-{v}-py3-none-any.whl", "name-{v}.tar.gz", "SHA256SUMS"]
[channel.pypi]
project = "name"
[notes]
changelog = "CHANGELOG.md"
summary = "One line about the project, used in the announcement."
Other channels: [channel.vscode-marketplace] extension = "publisher.name",
[channel.openvsx] extension = "namespace/name",
[channel.mcp-registry] name = "io.github.Owner/name" and
[channel.site] url = "https://…", with names_version for the text the page holds
once it is on the new version ({v} is the version).
Then, on the release branch, with the version file and the changelog updated:
releasepro notes --check # the changelog has a section for the version
releasepro run --as LOGIN # start the run, approve each gate, check every channel
releasepro verify # check again later; changes nothing
releasepro notes --announcement # the draft post
run asks before it starts the run and at every gate; --yes answers yes for you.
Run it again after it stops (Ctrl-C, a failed job, a gate answered no): it follows the
run still going on that commit, or offers to re-run the failed jobs. --run ID picks
up a given run. It never switches your global gh account; it runs gh as LOGIN
through gitpro.
Exit codes: 0 done, 1 a check or a job failed, 2 usage or setup error, 130 stopped.
verify and notes take --json.
Release notes and the announcement
From the changelog section for the version (## 1.2.3 or ## [1.2.3], as
Keep a Changelog writes it),
releasepro notes --write DIR writes:
RELEASE_NOTES.md: the section as you wrote it, then one line per channel. Use it as the GitHub release's body.ANNOUNCEMENT.md: a short post of at most 280 characters ([notes] short_limit) and a long one, built from yoursummary, the first sentence of each bullet and the links. Attach it to the release.
releasepro adds no claim of its own, and it posts nothing: once every channel lists
the version, run prints the short post for you to post.
Your release workflow
Your release.yml runs on workflow_dispatch on the release branch and has one
GitHub environment with a required reviewer per channel: release for the tag and
the GitHub release, pypi, marketplace, openvsx and mcp-registry. This repo's
own release.yml is a working example with release
and pypi. Shared workflows and releasepro init come in 0.2.0.
In a workflow: the verify action
- uses: Yantrakar/releasepro@<full commit sha>
with:
version: 1.2.3 # default: the version file
wait-minutes: 20
On a Linux or macOS runner, after actions/checkout, it runs releasepro verify
against the releasepro.toml in the checkout. It passes once every channel lists the
version, and fails if one does not by the end of the wait.
For coding agents
AGENTS.md and the skill in .agents/skills/releasepro say how to set up and run a release, and what to leave to a person: approving a gate, creating an environment, a trusted publisher or a cloud credential, and posting the announcement.
License
MIT
Metadata
Release files for releasepro 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| releasepro-0.1.0.tar.gz | 18.9 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| releasepro-0.1.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 40.5 kB
Release files / releasepro-0.1.0.tar.gz
| Download URL | releasepro-0.1.0.tar.gz |
|---|---|
| Size | 18.9 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
6ac48b2ef9b66f349ec4f26c11e83ea1750741f25dc4cdd6266277c2c78b6d15
|
|
BLAKE2b-256 checksum How to use checksums |
b2ce6aa9fee51a404cca0fa652bcac5359439df18abfdd17430329d3da380a93
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 21, 2026.
Transparency logRelease files / releasepro-0.1.0-py3-none-any.whl
| Download URL | releasepro-0.1.0-py3-none-any.whl |
|---|---|
| Size | 21.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
b8b34ac588dc6cf6d19afe5a26aef3657aad6be26407991ac29fa70ee2b1dc7a
|
|
BLAKE2b-256 checksum How to use checksums |
4b5f17f2be3f0c71084161ab25b7a6488b7daf6d617335338954e9e71eb9d3c1
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 21, 2026.
Transparency logSecurity for releasepro 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for releasepro-0.1.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 21, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.