---
title: Stage release files carefully to avoid accidentally committing secrets or debug artifacts
impact: HIGH
impactDescription: "Staging unreviewed files with git add -A can accidentally commit secrets, debug artifacts, or unrelated in-progress work"
tags: git-add, staging, version-bump, release
---

## Release Staging Rules

### Version Consistency

Before staging, verify both version locations match the release version:

```bash
# Check package.json version
grep '"version"' package.json

# Check CLAUDE.md version line
grep 'Current' CLAUDE.md
```

Both must show the same version (e.g., `6.0.21`). If either is missing or wrong, update before staging.

Also check `CHANGELOG.md` has an entry for this version with a date and summary.

### Staging — Never `git add -A`

**Incorrect:**
```bash
git add -A          # Stages everything including secrets, temp files, unrelated changes
git add .           # Same problem — too broad
```

**Correct:**
```bash
git add src/hooks/src/my-changed-hook.ts \
        src/hooks/dist/ \
        plugins/ \
        CHANGELOG.md \
        package.json \
        CLAUDE.md \
        manifests/
```

### Expected Files to Stage for a Release

| File/Dir | Why |
|----------|-----|
| `src/` changed files | Source of the actual change |
| `src/hooks/dist/` | Compiled TypeScript |
| `plugins/` | Generated by `npm run build` |
| `manifests/` | If counts changed |
| `CHANGELOG.md` | Release entry |
| `package.json` | Version bump |
| `CLAUDE.md` | Version bump |

**Key rules:**
- Always `git add <specific files>` — name every file explicitly
- Never stage `.env`, `*.secret`, or anything not listed in the diff review
- Version in `package.json` and `CLAUDE.md` must match before staging
