dsh-release-guardian

Every merge feels like stepping into the same blind spot: can the new code even run the tests? Did typecheck actually pass? Which build command is the right one? Release Guardian turns that repetitive ritual into a single, deterministic local scan. It reads changed files and added lines from your worktree, staged changes, or a branch range, applies rule-based checks for release risk, and auto-discovers test, typecheck, and build commands across JavaScript, Python, Go, Rust, Java, and .NET projects, emitting either a human-readable report or a versioned JSON artifact.

The safety model is its most distinctive design choice. The default operation is strictly read-only with respect to the target repository: it runs local git commands and reads configuration files, but it never executes project code, installs dependencies, publishes packages, or deploys anything. Project checks are a separate, explicitly authorized operation. The CLI requires --run-checks plus interactive confirmation; the host tool demands a precise command ID from a prior discovery response. Approval IDs are bound to the canonical repository, effective baseline policy, and exact diff fingerprint, so any source or configuration change immediately invalidates a prior grant. Approved commands run with the invoking user's permissions and are not sandboxed, which is why every plan is displayed in full before you confirm.

It ships through four entry points: a DeepSeek Harness bundle that registers the release_guardian_check host tool, a standalone CLI for terminals and CI pipelines, an optional Codex skill adapter for guided audits with safety awareness, and a Claude Code plugin that adds a read-only release-auditor subagent plus an opt-in pre-commit gate. All four adapters share the same scanning implementation and the same authorization boundary, so you are swapping interfaces, not scanners.

If you are a maintainer on a cross-language team looking for a lightweight, deterministic, zero-telemetry pre-release risk signal rather than a black box that claims to prove a release is safe, Release Guardian is built for exactly that job.