## Release

Say **"Release"** (or "Release X.Y.Z") and the `release` skill runs it: commit, push, tag,
wait for the pipeline, then open the wrapper-chart PR against `Ryuvia/charts`. It stops
there — merging and the Flux reconcile stay manual, deliberately.

Preconditions and the plan, without side effects:

```sh
~/.claude/skills/release/scripts/release-preflight          # state + suggested version
~/.claude/skills/release/scripts/release-preflight vX.Y.Z   # validate that release
```

Config is `.release.conf` here plus `make release-vars`. The process itself lives in
`~/.claude/skills/release/`; why it is shaped this way is in README.md §Releasing.

Two things about this repo specifically:

- **The pipeline has no image scan.** `.gitea/workflows/release.yaml` runs `test`,
  `binaries`, `image` and `chart`. A green release run is not evidence the image is
  CVE-clean, and a release note must not imply it is.
- **The wrapper chart has two `tag:` lines** — the app image and the python backup sidecar —
  so `chart-bump` needs `--image "$IMAGE"` to know which one moves.

## Checks

`make fmt lint test helm-lint` mirrors `.gitea/workflows/ci.yaml`, so a green gate here means
a green pipeline there. The one deliberate difference is `-race`, which CI does not run; see
the comment on the `test` target.

There are deliberately no `build`/`push`/`helm-push` targets — the workflow owns publishing,
and it builds multi-arch. Publishing happens by pushing a tag.