agentsclimarketplace

08 deploy and runtime verification

Skill heymegabyte/claude-skills/08-deploy-and-runtime-verification

14-category autonomous product-building OS for 32+ AI coding tools. One-line prompts → deployed products.

Install
npx -y skills add heymegabyte/claude-skills --skill 08-deploy-and-runtime-verification

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
  • 18 stars18 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

MANDATORY deploy after every code change. Typecheck → deploy → purge CDN → E2E on production → visual verify → fix-forward loop. Workers Builds native CI/CD, D1 Time Travel PIT recovery, D1→R2 long-term backups, wrangler rollback, wrangler secrets management, structured observability, cross-browser smoke tests, rollback procedures, and GitHub auto-configuration.

The file declares its own license as Rutgers. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

4.9 KB, as published. Nobody here has run it

08 — Deploy and Runtime Verification

Enforce the mandatory typecheck→deploy→CDN-purge→prod-E2E→visual-verify loop after every code change; never mark done without a live PROD assertion.

Mandatory deploy loop (every code change)

  1. Build + typecheck
  2. wrangler deploy (or platform equivalent)
  3. Purge CDN (wrangler cache purge or curl -X POST https://api.cloudflare.com/client/v4/zones/{id}/purge_cache)
  4. Fetch each changed route on PROD URL via curl + Playwright
  5. Assert new content / headers / JSON-LD / status live
  6. AI vision QA at 6 viewports (per _kernel/standards.md#breakpoints)
  7. Fix-forward (max 3 redeploys) — never silently fail
  8. Only then mark DONE

"Local typecheck + build pass" is NOT done. Per rules/verification-loop.md.

Auth fallback chain

  • CLOUDFLARE_API_TOKEN from /Users/Apple/.local/bin/get-secret
  • On 401: CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL
  • Both stale: prompt ! npx wrangler login, resume deploy once fresh
  • NEVER silently skip deploy because creds missing — surface as blocker

Workers Builds (native CI/CD)

  • Configure in wrangler.jsonc build block
  • Auto-deploys on push to main per rules/main-only-branch.md
  • Runs npm install + npm run build + wrangler deploy
  • Secrets injected via dashboard or wrangler secret put per rules/secret-provisioning.md

Secrets management

  • wrangler secret put KEY — runtime secrets; wrangler secret list — names only, never values
  • Two-way mirror: every prod secret also in chezmoi (~/.local/share/chezmoi/home/.chezmoitemplates/secrets/{KEY})
  • scripts/check-secrets.mjs --audit runs before every deploy
  • Per rules/secret-provisioning.md + rules/secret-auto-provisioning.md

D1 backup strategy

  • Time Travel — 30-day PIT, free: wrangler d1 time-travel restore <db> --timestamp=<ts>
  • D1 → R2 long-term — wrangler d1 export <db> --output=backup.sql + upload to R2 daily via cron
  • Pre-migration safety — wrangler d1 export BEFORE any destructive migration
  • 1 TB storage limit per account, 10 GB per database

Rollback procedures

  • Worker — wrangler rollback <version-id> in <30s
  • D1 — Time Travel PIT to known-good timestamp
  • R2 — bucket versioning enabled; revert via object version
  • Combined deploy — log {commit, version_id, timestamp} to D1 after every deploy; rollback target one query away

Auto-rollback gates (gradual deployment)

  • 1% → watch error rate 5 min → 10% → watch 5 min → 100%
  • Auto-rollback at p99 error >1% or LCP regression >20%

Browser console gate

Per rules/verification-loop.md § Console-error gate — all must be 0:

  • Console errors / CSP report-uri violations / Trusted Types violations / Deprecation warnings / Third-party script errors

Run as part of npm run e2e:prod Playwright suite.

Cross-browser smoke

Per _kernel/standards.md#breakpoints × 3 browsers (Chromium, Firefox, WebKit):

  • Homepage loads; primary CTA clickable; form submit succeeds (Turnstile invisible)
  • No console errors at any breakpoint
  • Lighthouse Perf ≥75 + A11y ≥95

Observability check post-deploy

Verify each is firing (missing = blocker):

  • Sentry — recent events in dashboard
  • PostHog — recent pageviews + captures
  • Workers Tracing — recent traces in Axiom (Tier 2)
  • AI Gateway — recent LLM calls logged (Tier 3)
  • GA4 — recent events (Tier 2)

GitHub auto-configuration

  • New project: gh repo create with template
  • Add CF Workers Builds via dashboard or API
  • Wire OIDC + cloudflare/wrangler-action@v3 for CI
  • Trust policy: GitHub OIDC token verifies repo + branch — no long-lived CLOUDFLARE_API_TOKEN in repo secrets

Per-deploy CHANGELOG entry

Every deploy logs to CHANGELOG.md (## [version] — YYYY-MM-DD / ### Added / Changed / Fixed). Auto-generated by changelog-generator agent from conventional commits.

See submodules: workers-builds.md, d1-backups.md, rollback.md, github-config.md.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.