Deploy Guardian — Pre-Deployment Verification

Version: 1.1.0 | Author: Shadows Company | License: MIT

WHEN TO TRIGGER

• - Before deploying to production or staging
• User says "deploy check", "ready to deploy?", "pre-deploy", "deploy guardian"
• Before creating a release tag
• Before merging a major PR

WHEN NOT TO TRIGGER

• - Local development iterations
• Draft PRs or WIP branches
• Exploratory prototyping with no deployment intent

PREREQUISITES

This skill requires git on PATH. Gates 2-4 auto-detect and run only the toolchain present in the project:

The agent MUST check which toolchain is available before running commands. Skip any gate sub-step whose toolchain is absent — do NOT fail the gate for missing optional toolchains.

PROTOCOL — 6 GATES

Each gate must PASS before proceeding. One FAIL = deployment blocked.

Gate 1 — GIT STATUS

CODEBLOCK0

Verify:

• - [ ] Working tree is clean (no uncommitted changes)
• [ ] On the correct branch (main/release/deploy)
• [ ] Branch is up to date with remote (git rev-parse HEAD == git rev-parse @{u})
• [ ] No merge conflicts pending

Gate 2 — TESTS

Detect the project type and run ONLY the matching test runner:

CODEBLOCK1

Verify:

• - [ ] All tests pass (zero failures)
• [ ] No skipped critical tests
• [ ] Exit code is 0

Note: This executes project test scripts, which run code from the repository. Only run in trusted repositories or sandboxed environments.

Gate 3 — TYPE CHECK & LINT

Auto-detect and run ONLY the matching toolchain:

CODEBLOCK2

Verify:

• - [ ] Zero type errors
• [ ] Zero lint errors (warnings acceptable)
• [ ] SKIP if no type checker / linter is configured (not a failure)

Gate 4 — BUILD

Auto-detect and run ONLY the matching build system:

CODEBLOCK3

Verify:

• - [ ] Build completes with exit code 0
• [ ] Output artifacts generated in expected location
• [ ] SKIP if no build system detected (not a failure)

Note: Build commands execute project scripts. Same sandboxing considerations as Gate 2 apply.

Gate 5 — SECRETS SCAN

CODEBLOCK4

Verify:

• - [ ] No secrets pattern in recent commits
• [ ] Zero .env files tracked by git
• [ ] .gitignore covers at least 3 secret patterns
• [ ] No .pem, .key, .p12 files tracked

Limitations: This grep-based scan catches common patterns but is not a substitute for dedicated secret scanners (gitleaks, trufflehog, detect-secrets). For production environments, consider running a dedicated scanner as an additional step.

Warning: Command output may display matched secret-like patterns in the terminal. Run this gate in a secure terminal session where output is not logged to shared systems.

Gate 6 — ENVIRONMENT VALIDATION

Run concrete automated checks for the target environment:

CODEBLOCK5

Verify:

• - [ ] .env.example or equivalent documentation exists
• [ ] No unapplied migrations in queue
• [ ] Target URL responds (if $DEPLOY_URL is set)
• [ ] Docker config valid (if applicable)
• [ ] SKIP individual checks when not applicable (not a failure)

SECURITY CONSIDERATIONS

1. 1. Code execution: Gates 2-4 execute project scripts (npm test, npm run build, cargo test). These commands run arbitrary code from the repository. Only run this skill on repositories you trust, or execute within a sandboxed environment (Docker container, CI/CD pipeline, OpenClaw sandbox mode).

1. 2. Secret exposure: Gate 5 scans diffs for secret patterns. Matched patterns are displayed in terminal output. Ensure your terminal session is not logged to shared monitoring systems.

1. 3. Network access: Gate 6 optionally makes outbound HTTP requests (via curl) only if $DEPLOY_URL is explicitly set. No other network access is required.

1. 4. No persistence: This skill does not modify any configuration files, install packages, store credentials, or make changes outside the terminal session. It is read-only except for the build artifacts produced by Gate 4.

1. 5. Sandboxing recommendation: For maximum safety, run deploy-guardian inside a CI/CD pipeline or a sandboxed agent environment rather than directly on a developer workstation.

OUTPUT FORMAT

CODEBLOCK6

RULES

1. 1. All gates must pass — no exceptions, no overrides
2. Secrets gate is non-negotiable — one leaked secret = full stop
3. Auto-detect toolchain — never run commands for absent toolchains
4. SKIP is not FAIL — absent toolchains produce SKIP, not FAIL
5. Test failures block deployment — even flaky tests must be investigated
6. Document blockers — always explain WHY with file:line references
7. Never auto-deploy — always wait for explicit user confirmation
8. Trusted repos only — warn user if running on an unfamiliar repository