# Release radar — a replayable Reelier skill

Newest published GitHub release for seldonframe/reelier — dependency-release watching, read-only

A real, read-only Reelier skill against a live public API — no account, no keys, no writes. Every replay proves: GitHub's releases API answers with a real published release tag and a numeric id.

- Steps: 1 · Assertions: 3 · Effect: read (counts parsed from the file, never hand-typed)
- Endpoints: https://api.github.com/repos/seldonframe/reelier/releases/latest
- Canonical file: https://raw.githubusercontent.com/seldonframe/reelier/main/examples/portfolio/release-radar.skill.md
- HTML page: https://www.reelier.com/skills/release-radar

## What this checks

One step: an HTTP GET to GitHub's /releases/latest API for seldonframe/reelier. Three assertions: the API answered 200, tag_name is a non-empty string (a release exists), and id is a non-negative number — presence and shape pinned, the version left free to move.

The tag moves; the shape doesn't. tag_name and published_at are bound onto the receipt rather than pinned, so the replay never rots the day the maintainer cuts the next release. The /releases/latest endpoint excludes drafts and prereleases by definition, so a green run always reflects a real published release.

Distinct from registry-latest: that skill asks the npm registry for the current dist-tag; this asks GitHub what release the maintainer actually cut. A tag can exist before it hits npm, and many dependencies you watch never publish to npm at all — this is the upstream signal.

Honesty note: this hits the unauthenticated GitHub REST API (60 requests/hour per IP). A rate-limited run returns 403, the status == 200 assert fails, and the receipt records a real failure — it never silently passes.

## The skill file (verbatim)

```markdown
---
name: release-radar
description: Newest published GitHub release for seldonframe/reelier — dependency-release watching, read-only
---

<!-- synced from seldonframe/reelier examples/portfolio — edit there -->

# Release radar

Inputs: (none — this file replays green as-is; see the personalization note)

<!--
  Personalization: swap the literal `seldonframe/reelier` in the URL for the
  `owner/repo` of a dependency YOU rely on (the portfolio README's "Point
  these at YOUR project" section has the one-command version). The skill
  grammar has no default-value syntax for {{var}} holes — an unbound {{var}}
  is an explicit error, never a guessed fallback — so this file ships with
  literals that work with zero flags.

  Why this is not registry-latest: that skill asks the npm registry "what is
  the current dist-tag?"; this one asks GitHub "what release did the
  maintainer actually cut?". A tag can exist before it's published to npm,
  and many dependencies you watch never ship to npm at all — this is the
  upstream signal.

  Honesty note: this hits the UNAUTHENTICATED GitHub REST API (60 req/hr per
  IP). A rate-limited run returns 403, the `status == 200` assert fails, and
  the receipt records a real failure — it never silently passes. The
  /releases/latest endpoint excludes drafts and prereleases by definition, so
  a green run always reflects a real published release.

  Endpoint verified live on 2026-07-21: 200, `tag_name` = "v1".
-->

The tag moves; the shape doesn't. The assertions pin that a release exists
(`tag_name` is a non-empty string) and carries a real numeric id, never a
specific version that would rot the day the maintainer cuts the next release.

## Steps

### Step 1 — Latest published release from GitHub
- intent: Fetch the latest published GitHub release for seldonframe/reelier and check it has a tag and a numeric id
- action: http.get {"url": "https://api.github.com/repos/seldonframe/reelier/releases/latest"}
- assert: status == 200
- assert: json.tag_name matches /.+/
- assert: json.id >= 0
- bind: release = json.tag_name
- bind: published = json.published_at
- effect: read
```

## Run it yourself

`reelier run` takes a local file, so fetch the canonical copy first (or clone the repo). The replay writes its receipt to `.reelier/runs/`.

```sh
curl -fsSL https://raw.githubusercontent.com/seldonframe/reelier/main/examples/portfolio/release-radar.skill.md -o release-radar.skill.md
npx -y reelier@latest run release-radar.skill.md

# or from a clone:
git clone https://github.com/seldonframe/reelier
cd reelier && npx -y reelier@latest run examples/portfolio/release-radar.skill.md
```

## Seed receipt — 2026-07-21

Replayed for real with the published CLI (resolved to reelier@0.14.0) on 2026-07-21; the run record confirms passed: true and 0 LLM tokens (input + output). Verbatim output:

```
✓ Step 1 — Latest published release from GitHub [passed] 268ms

PASSED: 1/1 steps ok, 0 failed, 268ms total
```

Standing audit log: a GitHub Action replays all five portfolio skills every 6 hours (plus on demand) — https://github.com/seldonframe/reelier/actions/workflows/portfolio-replay.yml. A failing endpoint produces an honestly failing receipt, never a retried-until-green one.

## Point it at your project

Swap the literal `seldonframe/reelier` in the URL for the owner/repo of a dependency YOU rely on. The skill grammar has no default-value syntax for {{var}} holes — an unbound {{var}} is an explicit error, never a guessed fallback — so this file ships with literals that replay green with zero flags.

```sh
sed 's#seldonframe/reelier#YOUR-ORG/YOUR-REPO#g' release-radar.skill.md > my-release-radar.skill.md \
  && npx -y reelier@latest run my-release-radar.skill.md
```

---

Reelier — agents make claims, Reelier writes receipts. AGPL-3.0.
Portfolio index: https://www.reelier.com/skills (twin: https://www.reelier.com/skills.md) · Replay ledger: https://www.reelier.com/replays · Machine-readable summary: https://www.reelier.com/llms.txt