# Reverse-Skill Release Process: Step-by-Step Guide for Version Management

> Master the reverse-skill release process with our step-by-step guide. Learn how Git tags, changelogs, and scripts publish verified tool bundles as GitHub release assets.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-04

---

**The reverse-skill release process uses a lightweight Git-tag-driven workflow where version bumps, changelog updates, and bootstrap scripts combine to publish verified tool bundles as GitHub release assets.**

The **release process for reverse-skill** centers on a single source of truth—the `VERSION` file—and a chain of automated steps that populate GitHub releases with pre-built reverse-engineering tools. This repository (zhaoxuya520/reverse-skill) maintains a deliberately simple pipeline that human developers and AI agents can execute reproducibly.

## Overview of the Release Pipeline

The entire workflow spans eight stages, from version incrementing through final verification. Each stage produces observable artifacts: a commit hash, a Git tag, a GitHub release draft, and downloadable ZIP/JAR assets with SHA-256 checksums.

The pipeline's simplicity rests on one architectural decision: **pushing a Git tag triggers the GitHub release mechanism**, while **bootstrap scripts handle asset construction and hash verification**.

## Step 1: Update the VERSION File

The `VERSION` file at the repository root stores the canonical version string. This plain-text file follows semantic versioning (e.g., `v1.2.0`) and serves as the trigger for downstream automation.

```bash
echo "v1.2.0" > VERSION

```

No other configuration files require editing—the bootstrap scripts read this value directly.

## Step 2: Edit the CHANGELOG

Release notes live in [`CHANGELOG.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CHANGELOG.md). Each entry requires a version header and bullet list of changes:

```bash
cat <<EOF >> CHANGELOG.md

## v1.2.0 – 2026-08-04

- Added support for `jadx` v1.5.6
- Updated Ghidra-MCP to latest release
- Fixed routing bug in `skills/MASTER-ROUTING.md`
EOF

```

The changelog format remains human-readable; no parsing tools consume it.

## Step 3: Commit and Push to Main

Use conventional commits to maintain clear history:

```bash
git add VERSION CHANGELOG.md
git commit -m "feat: bump version to v1.2.0"
git push origin main

```

The release process for reverse-skill permits direct pushes to `main`; no protected branch workflow gates the tag creation.

## Step 4: Create and Push the Git Tag

The tag name must match the `VERSION` file contents exactly:

```bash
git tag v1.2.0
git push origin v1.2.0

```

This push triggers GitHub's release creation mechanism, generating a draft release automatically.

## Step 5: Build and Upload Release Assets

The bootstrap scripts in `skills/scripts/` perform the heavy lifting. The [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) script (and its PowerShell equivalent `bootstrap-reverse.ps1`) handle three tasks:

- Fetch upstream tool releases using the `install_github_release` helper
- Verify SHA-256 checksums
- Bundle tools into distributable ZIP/JAR archives

The `install_github_release` function appears at lines 332–340 of [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh):

```bash
bash skills/scripts/bootstrap-reverse.sh

```

This script downloads tools like `jadx` and `ghidra-mcp`, confirms their integrity against known hashes, and stages them for GitHub release attachment.

## Step 6: Refresh the Tool Index

After assets publish, update the local tool registry. Two platform-specific commands exist:

- **Linux/macOS**: `bash skills/scripts/refresh-tool-index.sh`
- **Windows**: PowerShell equivalent (unnamed in sources)

The refresh script regenerates [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) from `skills/tool-index.md.template`, marking newly available tools with ✓ in the `github-release-zip` and `github-release-jar-wrapper` columns.

## Step 7: Verify the Published Release

Navigate to the generated URL pattern:

```

https://github.com/zhaoxuya520/reverse-skill/releases/tag/v1.2.0

```

Confirm:
- All expected ZIP/JAR files attach correctly
- Checksum links resolve
- Release notes reflect [`CHANGELOG.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CHANGELOG.md) content

## Key Files in the Release Process

| File | Purpose |
|------|---------|
| `VERSION` | Single source of truth for version string |
| [`CHANGELOG.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CHANGELOG.md) | Human-readable release history |
| [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh) | Downloads and verifies tool assets; contains `install_github_release` helper |
| `skills/scripts/bootstrap-reverse.ps1` | Windows equivalent of bootstrap script |
| [`skills/scripts/refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/refresh-tool-index.sh) | Regenerates [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) post-release |
| `skills/tool-index.md.template` | Template defining tool acquisition methods (`github-release-zip`, `github-release-jar-wrapper`) |
| [`README.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/README.md) | Repository overview and workflow documentation |
| [`README_AI.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/README_AI.md) | Release instructions tailored for AI agent pipelines |

## Complete Release Command Sequence

```bash

# Bump version

echo "v1.2.0" > VERSION

# Update changelog

cat <<EOF >> CHANGELOG.md

## v1.2.0 – 2026-08-04

- Added support for `jadx` v1.5.6
- Updated Ghidra-MCP to latest release
- Fixed routing bug in `skills/MASTER-ROUTING.md`
EOF

# Commit and push

git add VERSION CHANGELOG.md
git commit -m "feat: bump version to v1.2.0"
git push origin main

# Tag release

git tag v1.2.0
git push origin v1.2.0

# Build assets

bash skills/scripts/bootstrap-reverse.sh

# Refresh tool index

bash skills/scripts/refresh-tool-index.sh

```

## Summary

- **One file controls versioning**: The `VERSION` file determines the release tag.
- **Git tags trigger automation**: Pushing a tag creates the GitHub release draft.
- **Bootstrap scripts ensure integrity**: `install_github_release` in [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh) downloads tools and verifies SHA-256 hashes.
- **Tool index refreshes automatically**: Running [`refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/refresh-tool-index.sh) updates [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) to reflect available releases.
- **Cross-platform support**: Bash and PowerShell scripts cover Linux, macOS, and Windows environments.

## Frequently Asked Questions

### How does reverse-skill handle version numbering?

The repository uses semantic versioning stored in a plain-text `VERSION` file at the repository root. The bootstrap scripts and GitHub Actions (if configured) read this file to determine the release tag. No package managers (npm, PyPI, etc.) participate—the workflow remains Git-native.

### What security measures protect downloaded tool binaries?

The `install_github_release` helper function (lines 332–340 of [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh)) verifies SHA-256 checksums for every downloaded ZIP or JAR file. This prevents supply-chain attacks where upstream releases might be compromised. Checksum values are hardcoded or fetched from trusted sources.

### Can the release process run unattended or in CI/CD?

Yes. The [`README_AI.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/README_AI.md) file contains identical instructions adapted for automated pipelines. The bootstrap scripts require no interactive input; they exit with non-zero status on verification failures, making them suitable for GitHub Actions, GitLab CI, or other automation platforms.

### What happens if a tool release is missing or fails verification?

The bootstrap script aborts. The `install_github_release` function returns a failure code when checksums mismatch or downloads fail, preventing corrupted or incomplete assets from reaching the GitHub release page. Manual intervention is required to update the expected hash or resolve upstream availability.