# summary

Evaluate substantive project release readiness and record required check evidence.

# description

Evaluates the latest workflow run for current substantive evidence, AC mapping,
resolved phases and reviews, generated setup health, and knowledge freshness. The
configured static-analysis checks are then run as additional required checks:

- **npm-audit** — dependency vulnerability scan (blocking on high/critical CVEs)
- **knip** — dead-code detection (advisory only)
- **coverage** — test coverage report (advisory only)
- **secret-scan** — secret / credential leak detection (blocking)

Each check result is recorded as an evidence artifact in
`.setup-agents/state/evidence.jsonl`. The command exits non-zero when any
blocking check fails.

Older project configs that omit evidence and substance modes migrate to fail-closed
project defaults. Advisory mode is explicitly non-release-ready. Explicit `warn` or
`off` values remain compatible for non-release transitions, but cannot make the
production release predicate pass. Use `--dry-run` only to preview command output;
it does not create release-ready workflow state.

# flags.task.summary

Task or story id to associate evidence with.

# flags.task.description

Evidence artifacts created by each check will reference this task id,
e.g. `SA-110` or the workflow phase task id.

# flags.dry-run.summary

Skip all checks and exit zero.

# flags.dry-run.description

When set, no tools are invoked and all checks are reported as skipped.
Useful when previewing the release phase in a dry-run workflow run.

# flags.json.summary

Format output as JSON.

# flags.json.description

Emit the full ReleaseCheckReport as JSON on stdout instead of a table.

# flags.checks.summary

Comma-separated list of checks to run.

# flags.checks.description

Override the default set of checks. Valid values: npm-audit, knip, coverage, secret-scan.
Defaults to all checks.

# examples

- Run all release checks for story SA-110:

  <%= config.bin %> <%= command.id %> --task SA-110

- Run only the security-related checks:

  <%= config.bin %> <%= command.id %> --task SA-110 --checks npm-audit,secret-scan

- Dry run (skip all checks):

  <%= config.bin %> <%= command.id %> --task SA-110 --dry-run

- Emit JSON report:

  <%= config.bin %> <%= command.id %> --task SA-110 --json

# info.dry-run

Dry run — skipping all release checks.

# info.header

Running release checks for task %s

# info.pass

All release checks passed.

# info.fail

Release check failed — blocking issues detected. Fix them before merging.

# info.table-header

Check | Status | Blocking | Detail

# errors.blocking-failure

One or more blocking checks failed. See table above for details.