Release radar

One HTTP GET pulls the newest published GitHub release — tag and id shape-asserted, version left free to move, read-only.

A real, replayable Reelier skill against a live public API. Every replay proves the same thing: GitHub's releases API answers with a real published release tag and a numeric id — and writes a receipt saying exactly which assertions held.

01What this checks

One step: an HTTP GET to GitHub's /releases/latest API for seldonframe/reelier. Three assertions: the API answered 200, tag_name is a non-empty string (a release exists), and id is a non-negative number — presence and shape pinned, the version left free to move.

The tag moves; the shape doesn't. tag_name and published_at are bound onto the receipt rather than pinned, so the replay never rots the day the maintainer cuts the next release. The /releases/latest endpoint excludes drafts and prereleases by definition, so a green run always reflects a real published release.

Distinct from registry-latest: that skill asks the npm registry for the current dist-tag; this asks GitHub what release the maintainer actually cut. A tag can exist before it hits npm, and many dependencies you watch never publish to npm at all — this is the upstream signal.

Honesty note: this hits the unauthenticated GitHub REST API (60 requests/hour per IP). A rate-limited run returns 403, the status == 200 assert fails, and the receipt records a real failure — it never silently passes.

Endpoint it hits:

• https://api.github.com/repos/seldonframe/reelier/releases/latest

02The skill file

This is the whole artifact — a markdown file with an assertion on every step. Copy it, check it into your repo, replay it anywhere.

---
name: release-radar
description: Newest published GitHub release for seldonframe/reelier — dependency-release watching, read-only
---

<!-- synced from seldonframe/reelier examples/portfolio — edit there -->

# Release radar

Inputs: (none — this file replays green as-is; see the personalization note)

<!--
  Personalization: swap the literal `seldonframe/reelier` in the URL for the
  `owner/repo` of a dependency YOU rely on (the portfolio README's "Point
  these at YOUR project" section has the one-command version). The skill
  grammar has no default-value syntax for {{var}} holes — an unbound {{var}}
  is an explicit error, never a guessed fallback — so this file ships with
  literals that work with zero flags.

  Why this is not registry-latest: that skill asks the npm registry "what is
  the current dist-tag?"; this one asks GitHub "what release did the
  maintainer actually cut?". A tag can exist before it's published to npm,
  and many dependencies you watch never ship to npm at all — this is the
  upstream signal.

  Honesty note: this hits the UNAUTHENTICATED GitHub REST API (60 req/hr per
  IP). A rate-limited run returns 403, the `status == 200` assert fails, and
  the receipt records a real failure — it never silently passes. The
  /releases/latest endpoint excludes drafts and prereleases by definition, so
  a green run always reflects a real published release.

  Endpoint verified live on 2026-07-21: 200, `tag_name` = "v1".
-->

The tag moves; the shape doesn't. The assertions pin that a release exists
(`tag_name` is a non-empty string) and carries a real numeric id, never a
specific version that would rot the day the maintainer cuts the next release.

## Steps

### Step 1 — Latest published release from GitHub
- intent: Fetch the latest published GitHub release for seldonframe/reelier and check it has a tag and a numeric id
- action: http.get {"url": "https://api.github.com/repos/seldonframe/reelier/releases/latest"}
- assert: status == 200
- assert: json.tag_name matches /.+/
- assert: json.id >= 0
- bind: release = json.tag_name
- bind: published = json.published_at
- effect: read

03Run it yourself

reelier run takes a local file, so fetch the canonical copy first (or clone the repo). The replay is read-only, needs no account and no keys, and writes its receipt to .reelier/runs/.

# straight from the repo's main branch (the canonical copy):
curl -fsSL https://raw.githubusercontent.com/seldonframe/reelier/main/examples/portfolio/release-radar.skill.md -o release-radar.skill.md
npx -y reelier@latest run release-radar.skill.md

# or from a clone:
git clone https://github.com/seldonframe/reelier
cd reelier && npx -y reelier@latest run examples/portfolio/release-radar.skill.md

04The receipt

The portfolio README records a real seed run of this skill, replayed with the published CLI on 2026-07-21. Verbatim output:

✓ Step 1 — Latest published release from GitHub [passed] 268ms

PASSED: 1/1 steps ok, 0 failed, 268ms total
[measured] 0 LLM tokens

And the proof keeps accumulating without anyone touching it: a GitHub Action replays all five portfolio skills every 6 hours (plus on demand) — the public Actions tab is the standing audit log. A failing endpoint produces an honestly failing receipt there, never a retried-until-green one.

05Point it at your project

Swap the literal `seldonframe/reelier` in the URL for the owner/repo of a dependency YOU rely on. The skill grammar has no default-value syntax for {{var}} holes — an unbound {{var}} is an explicit error, never a guessed fallback — so this file ships with literals that replay green with zero flags.

sed 's#seldonframe/reelier#YOUR-ORG/YOUR-REPO#g' release-radar.skill.md > my-release-radar.skill.md \
  && npx -y reelier@latest run my-release-radar.skill.md