deploy

What it does

Use when ready to ship — runs pre-push gates (lint, typecheck, build, tests, security sweep), commits, releases, and pushes. Standalone, never auto-invoked. Push always requires explicit confirmation. Trigger with /hyperflow:deploy, "ship it", "ready to push", "release", "cut a release", "deploy".

How it works

The skill defines a multi-step deployment pipeline:

• Step 1: Survey state with two parallel sub-steps to determine repo status and tool detectability.
• Step 2: Quality gates executed in sequence (2a lint+typecheck in parallel sub-tasks; 2b build gate; 2c test gate), with parallelization across workers where specified. Step 3 (Security Sweep) runs in parallel with Step 2 and must pass before committing.
• Step 3: Security sweep in parallel sub-steps: 3a secrets/keys scan and 3b dependency audit, evaluated by security and vulnerability reviewers.
• Step 4: Commit fixes from Step 2, handling uncommitted user changes via user confirmation gate.
• Step 5: Release sequence: 5a runs release script if present; 5b verifies version sync across manifests and changelog.
• Step 6: Push gate honoring push mode (auto, never, or ask). push=ask triggers a user confirmation prompt; auto pushes with no additional prompts; never skips push entirely. Never force-push to main.
• Step 7: Output prints a structured ship result with gate statuses and final artifacts like commit, release, and push results.

What it can touch

The workflow relies on git, package manager commands, and build/test scripts detected through the tooling hints. It references tools like git, npm, pnpm, bun, vite, workflow scripts, and references the reviewers for security and vulnerability checks. The workflow uses an explicit set of per-step workers and commands such as git status --short, git log origin/<branch>..HEAD --oneline, npm run lint, pnpm lint, prettier --check ., tsc --noEmit, npm run build, git push, and Release script execution via scripts/release.sh or release-please / changesets.

Caveats

No gate is bypassed if it fails; failures halt the pipeline and print the failing command and full stderr. Gate failures are surfaced to the user rather than auto-fixed. Release and push steps respect gating rules and user confirmations where applicable. Atomicity rules apply to commit and step execution; DOCTRINE 12.2 governs atomic behavior for commits and releases. The skill is designed for Claude Code and depends on the presence of remote Git configuration and project scripts. If a required tool is absent, steps may be skipped silently rather than treated as failures. The workflow prints final ship state in a plain-text block and uses plain pass/fail/skipped indicators. If secrets or CVEs are found, the run halts with specific messaging and requires manual remediation.