Release Checklist

Quick Start

/release-checklist

/release-checklist src/auth/

The Checklist

1. Code Completeness

# Search for incomplete code markers
grep -r "TODO\|FIXME\|XXX\|HACK\|WIP" --include="*.ts" --include="*.js" --include="*.py" --include="*.go" --include="*.rs" --include="*.rb" --include="*.ex" src/

• No TODO comments remain
• No FIXME markers
• No HACK or XXX notes
• No WIP (work in progress) code
• No placeholder implementations (

  throw new Error('Not implemented')

  )
• No commented-out code that should be removed

2. Debug Code Removed

# Search for debug statements
grep -rn "console\.log\|print(\|debugger\|binding\.pry\|byebug\|IEx\.pry" --include="*.ts" --include="*.js" --include="*.py" --include="*.rb" --include="*.ex" src/

• No

  console.log

  in production code (logging libraries OK)
• No

  print()

  statements (Python)
• No

  debugger

  statements
• No

  binding.pry

  /

  byebug

  (Ruby)
• No

  IEx.pry

  (Elixir)
• No hardcoded test data or mock values

3. Documentation Updated

• README reflects current functionality
• API documentation matches implementation
• CHANGELOG has entries for all changes
• Configuration options documented
• Breaking changes clearly noted
• Migration guide if needed

4. Tests Passing

# Example - adapt to your project
npm test        # or pytest, go test, etc.
npm run lint    # or ruff, golangci-lint, etc.
npm run typecheck  # or mypy, tsc, etc.
npm run build   # verify it compiles

• All unit tests pass
• All integration tests pass
• Lint checks pass (no errors)
• Type checks pass (no errors)
• Build succeeds

5. Dependencies Justified

• Each dependency has a clear reason for inclusion
• Licenses are compatible (MIT, Apache, BSD, etc.)
• Packages are actively maintained
• No known security vulnerabilities
• Versions are pinned appropriately
• Lockfile is committed

# Check for outdated or vulnerable packages
npm audit       # Node.js
pip-audit       # Python
go list -m -u all  # Go
cargo audit     # Rust
bundle audit    # Ruby
mix deps.audit  # Elixir (with mix_audit)

6. Security Review

• No hardcoded secrets, keys, or tokens
• Input validation on all external data
• SQL queries use parameterized statements
• User content is escaped before rendering
• Authentication/authorization enforced
• Sensitive data not logged
• Error messages don't leak internals

7. Production Readiness

• Structured logging (not print statements)
• Errors categorized appropriately
• Health check endpoint works (if applicable)
• Graceful shutdown handling
• Environment-specific config externalized
• No hardcoded URLs or environment assumptions

Output Format

## Release Checklist Results

### Passed
- [x] No TODO/FIXME markers
- [x] No debug statements
- [x] Tests passing
- [x] Lint passing
- [x] Build succeeds

### Failed
- [ ] CHANGELOG not updated (missing entry for new auth feature)
- [ ] Found console.log at src/api/users.ts:45

### Warnings
- [ ] New dependency 'lodash' added - verify it's needed (could use native methods)

### Verdict
**BLOCKED** - Fix the failures above before releasing.

When to Use

• Before merging a feature branch
• Before cutting a release tag
• Before deploying to production
• As the final step in a wiggum loop

Integration with Wiggum

Remember