Publish Guard - check how your SDKs reach npm, PyPI and Maven

Check how a team's SDKs, CLIs and images reach npm, PyPI, Maven Central, NuGet, crates.io, RubyGems, Go, Docker Hub and private feeds against secure publishing, then write the publishing plan and the rollback runbook. Free in your browser: every credential dated against an as-of day, long-lived tokens where the registry offers OIDC, owners and phishing-resistant 2FA, laptop publishes, the release workflow linted (dangerous triggers, default permissions, SHA-pinned actions, caches, the build and publish split, a protected environment, OIDC versus static secrets), the credential rung ranked per registry, what goes first and the five gates scored, plus a hardened release workflow, a rollback sheet and the inventory as CSV. A metered run writes the publishing plan, or the rollback runbook. Built on the SkillSafe skill @samber/sdk-package-publishing, from samber/developer-platform-skills (MIT), by Samuel Berthe.