agentleFS
Sign inStart free
faizkhairifaizkhairi/claude-code-blueprint/skills/deploy-check/SKILL.md

deploy-check

Skill73 starsChanged 4 months agoMITView on GitHub

MUST use before any git push to main/master/production, or when user mentions 'deploy', 'going live', 'push to prod', 'ready to ship', 'merge to main', 'release'. Also trigger before any npm publish for CLI tools, or on 'audit', 'check vulnerabilities', 'are our deps safe?', 'npm audit', 'yarn audit'. Performs: test suite validation, dev-artifact scan (`console.log`, `TODO`/`FIXME`, hardcoded secrets like `password:` / `token:` / API keys), dependency audit (npm audit, pip-audit, bundle audit, cargo audit, govulncheck, etc.), build verification, ORM/schema safety check, auth-middleware coverage on new endpoints. Verdict: GO / NO-GO with per-check checklist.

  • Commits and pushes

8 other projects use a version of this.

Adopted by

Most recently taken up by

The file

We split this skill into the rules it gives an agent

11 rules. 0 are common, 9 are distinctive, and 2 are very specific to this project.

  • 0

    Common

    Most of the 6 edited versions we read keep these.

  • 9

    Distinctive

    This author's own choices. Worth a look.

  • 2

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Tests: Run full test suite, all must pass

    line 10
  2. Distinctive:

    Git status: Check for uncommitted changes across all repos

    line 11
  3. Very specific:

    Schema sync: Verify the project's ORM/DB schema definition matches expectations (e.g.

    line 12
  4. Distinctive:

    Dev artifacts: Check for language-appropriate debug/print statements (console.log, print(), System.out.println, fmt.Println, etc.), …

    line 14
  5. Distinctive:

    Env vars: Verify required environment variables are documented

    line 15
  6. Very specific:

    Dependency audit: Run the ecosystem's dependency audit (npm audit/yarn audit, pip-audit, bundle audit, cargo audit, govulncheck, etc., …

    line 17
  7. Distinctive:

    Build: Verify project builds without errors

    line 18
  8. Distinctive:

    Migration safety: Check if any ORM models/migrations are missing (risk of tables dropped by destructive sync)

    line 19
  9. Distinctive:

    If argument is "audit" → run only step 8 (dependency vulnerability scan) across the current project.

    line 21
  10. Distinctive:

    GO: All steps pass. MODERATE/LOW vulnerabilities in dev-only deps are acceptable with note.

    line 25
  11. Distinctive:

    GO with warnings: All critical steps pass but non-blocking issues exist (dev-only vulns, TODO items in non-critical paths)

    line 26

“Common” is measured: kept by at least 6 in 10 of the 6 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Pre-deployment validation for $ARGUMENTS environment:

  1. Tests: Run full test suite, all must pass
  2. Git status: Check for uncommitted changes across all repos
  3. Schema sync: Verify the project's ORM/DB schema definition matches expectations (e.g. Prisma schema, Django models, Rails schema.rb, migrations directory)
  4. Secrets check: Scan for hardcoded credentials, API keys, passwords
  5. Dev artifacts: Check for language-appropriate debug/print statements (console.log, print(), System.out.println, fmt.Println, etc.), debugger statements, TODO/FIXME in production paths
  6. Env vars: Verify required environment variables are documented
  7. Auth coverage: Validate all API endpoints have auth middleware
  8. Dependency audit: Run the ecosystem's dependency audit (npm audit/yarn audit, pip-audit, bundle audit, cargo audit, govulncheck, etc., detected from the manifest/lockfile). Classify: CRITICAL/HIGH (action required) vs MODERATE/LOW (note). Separate production vs dev-only vulnerabilities. Check for auto-fixable with --dry-run.
  9. Build: Verify project builds without errors
  10. Migration safety: Check if any ORM models/migrations are missing (risk of tables dropped by destructive sync)

If argument is "audit" → run only step 8 (dependency vulnerability scan) across the current project.

GO/NO-GO Criteria

  • NO-GO: Any test failure, hardcoded secret found, ORM model/migration missing, build failure, or CRITICAL/HIGH vulnerability in production deps
  • GO: All steps pass. MODERATE/LOW vulnerabilities in dev-only deps are acceptable with note.
  • GO with warnings: All critical steps pass but non-blocking issues exist (dev-only vulns, TODO items in non-critical paths)

Output: GO / NO-GO status with detailed checklist results.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free