08-deploy-and-runtime-verification

Name: 08-deploy-and-runtime-verification
Author: heymegabyte

18stars4forks

How to install 08-deploy-and-runtime-verification?

heymegabyte/claude-skills/08-deploy-and-runtime-verification

$npx -y skills add heymegabyte/claude-skills --skill 08-deploy-and-runtime-verification

Installs into the current project.

Summary

MANDATORY deploy after every code change. Typecheck → deploy → purge CDN → E2E on production → visual verify → fix-forward loop. Workers Builds native CI/CD, D1 Time Travel PIT recovery, D1→R2 long-term backups, wrangler rollback, wrangler secrets management, structured observabi

Files · 1

View on GitHub

SKILL.md

1	# 08 — Deploy and Runtime Verification
2
3	Enforce the mandatory typecheck→deploy→CDN-purge→prod-E2E→visual-verify loop after every code change; never mark done without a live PROD assertion.
4
5	## Mandatory deploy loop (every code change)
6
7	1. Build + typecheck
8	2. `wrangler deploy` (or platform equivalent)
9	3. Purge CDN (`wrangler cache purge` or `curl -X POST https://api.cloudflare.com/client/v4/zones/{id}/purge_cache`)
10	4. Fetch each changed route on PROD URL via curl + Playwright
11	5. Assert new content / headers / JSON-LD / status live
12	6. AI vision QA at 6 viewports (per `_kernel/standards.md#breakpoints`)
13	7. Fix-forward (max 3 redeploys) — never silently fail
14	8. Only then mark DONE
15
16	"Local typecheck + build pass" is NOT done. Per `rules/verification-loop.md`.
17
18	## Auth fallback chain
19
20	- `CLOUDFLARE_API_TOKEN` from `/Users/Apple/.local/bin/get-secret`
21	- On 401: `CLOUDFLARE_API_KEY` + `CLOUDFLARE_EMAIL`
22	- Both stale: prompt `! npx wrangler login`, resume deploy once fresh
23	- NEVER silently skip deploy because creds missing — surface as blocker
24
25	## Workers Builds (native CI/CD)
26
27	- Configure in `wrangler.jsonc` `build` block
28	- Auto-deploys on push to `main` per `rules/main-only-branch.md`
29	- Runs `npm install` + `npm run build` + `wrangler deploy`
30	- Secrets injected via dashboard or `wrangler secret put` per `rules/secret-provisioning.md`
31
32	## Secrets management
33
34	- `wrangler secret put KEY` — runtime secrets; `wrangler secret list` — names only, never values
35	- Two-way mirror: every prod secret also in chezmoi (`~/.local/share/chezmoi/home/.chezmoitemplates/secrets/{KEY}`)
36	- `scripts/check-secrets.mjs --audit` runs before every deploy
37	- Per `rules/secret-provisioning.md` + `rules/secret-auto-provisioning.md`
38
39	## D1 backup strategy
40
41	- Time Travel — 30-day PIT, free: `wrangler d1 time-travel restore <db> --timestamp=<ts>`
42	- D1 → R2 long-term — `wrangler d1 export <db> --output=backup.sql` + upload to R2 daily via cron
43	- Pre-migration safety — `wrangler d1 export` BEFORE any destructive migration
44	- 1 TB storage limit per account, 10 GB per database
45
46	## Rollback procedures
47
48	- Worker — `wrangler rollback <version-id>` in <30s
49	- D1 — Time Travel PIT to known-good timestamp
50	- R2 — bucket versioning enabled; revert via object version
51	- Combined deploy — log `{commit, version_id, timestamp}` to D1 after every deploy; rollback target one query away
52
53	## Auto-rollback gates (gradual deployment)
54
55	- 1% → watch error rate 5 min → 10% → watch 5 min → 100%
56	- Auto-rollback at p99 error >1% or LCP regression >20%
57
58	## Browser console gate
59
60	Per `rules/verification-loop.md` § Console-error gate — all must be 0:
61
62	- Console errors / CSP report-uri violations / Trusted Types violations / Deprecation warnings / Third-party script errors
63
64	Run as part of `npm run e2e:prod` Playwright suite.
65
66	## Cross-browser smoke
67
68	Per `_kernel/standards.md#breakpoints` × 3 browsers (Chromium, Firefox, WebKit):
69
70	- Homepage loads; primary CTA clickable; form submit succeeds (Turnstile invisible)
71	- No console errors at any breakpoint
72	- Lighthouse Perf ≥75 + A11y ≥95
73
74	## Observability check post-deploy
75
76	Verify each is firing (missing = blocker):
77
78	- Sentry — recent events in dashboard
79	- PostHog — recent pageviews + captures
80	- Workers Tracing — recent traces in Axiom (Tier 2)
81	- AI Gateway — recent LLM calls logged (Tier 3)
82	- GA4 — recent events (Tier 2)
83
84	## GitHub auto-configuration
85
86	- New project: `gh repo create` with template
87	- Add CF Workers Builds via dashboard or API
88	- Wire OIDC + `cloudflare/wrangler-action@v3` for CI
89	- Trust policy: GitHub OIDC token verifies repo + branch — no long-lived `CLOUDFLARE_API_TOKEN` in repo secrets
90
91	## Per-deploy CHANGELOG entry
92
93	Every deploy logs to `CHANGELOG.md` (`## [version] — YYYY-MM-DD` / `### Added / Changed / Fixed`). Auto-generated by `changelog-generator` agent from conventional commits.
94
95	## See submodules: workers-builds.md, d1-backups.md, rollback.md, github-config.md.

People who liked this also viewed

6 picks

Type

08-deploy-and-runtime-verification

18stars4forks

View on GitHub

How to install 08-deploy-and-runtime-verification?

heymegabyte/claude-skills/08-deploy-and-runtime-verification

$npx -y skills add heymegabyte/claude-skills --skill 08-deploy-and-runtime-verification

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# 08 — Deploy and Runtime Verification
2
3	Enforce the mandatory typecheck→deploy→CDN-purge→prod-E2E→visual-verify loop after every code change; never mark done without a live PROD assertion.
4
5	## Mandatory deploy loop (every code change)
6
7	1. Build + typecheck
8	2. `wrangler deploy` (or platform equivalent)
9	3. Purge CDN (`wrangler cache purge` or `curl -X POST https://api.cloudflare.com/client/v4/zones/{id}/purge_cache`)
10	4. Fetch each changed route on PROD URL via curl + Playwright
11	5. Assert new content / headers / JSON-LD / status live
12	6. AI vision QA at 6 viewports (per `_kernel/standards.md#breakpoints`)
13	7. Fix-forward (max 3 redeploys) — never silently fail
14	8. Only then mark DONE
15
16	"Local typecheck + build pass" is NOT done. Per `rules/verification-loop.md`.
17
18	## Auth fallback chain
19
20	- `CLOUDFLARE_API_TOKEN` from `/Users/Apple/.local/bin/get-secret`
21	- On 401: `CLOUDFLARE_API_KEY` + `CLOUDFLARE_EMAIL`
22	- Both stale: prompt `! npx wrangler login`, resume deploy once fresh
23	- NEVER silently skip deploy because creds missing — surface as blocker
24
25	## Workers Builds (native CI/CD)
26
27	- Configure in `wrangler.jsonc` `build` block
28	- Auto-deploys on push to `main` per `rules/main-only-branch.md`
29	- Runs `npm install` + `npm run build` + `wrangler deploy`
30	- Secrets injected via dashboard or `wrangler secret put` per `rules/secret-provisioning.md`
31
32	## Secrets management
33
34	- `wrangler secret put KEY` — runtime secrets; `wrangler secret list` — names only, never values
35	- Two-way mirror: every prod secret also in chezmoi (`~/.local/share/chezmoi/home/.chezmoitemplates/secrets/{KEY}`)
36	- `scripts/check-secrets.mjs --audit` runs before every deploy
37	- Per `rules/secret-provisioning.md` + `rules/secret-auto-provisioning.md`
38
39	## D1 backup strategy
40
41	- Time Travel — 30-day PIT, free: `wrangler d1 time-travel restore <db> --timestamp=<ts>`
42	- D1 → R2 long-term — `wrangler d1 export <db> --output=backup.sql` + upload to R2 daily via cron
43	- Pre-migration safety — `wrangler d1 export` BEFORE any destructive migration
44	- 1 TB storage limit per account, 10 GB per database
45
46	## Rollback procedures
47
48	- Worker — `wrangler rollback <version-id>` in <30s
49	- D1 — Time Travel PIT to known-good timestamp
50	- R2 — bucket versioning enabled; revert via object version
51	- Combined deploy — log `{commit, version_id, timestamp}` to D1 after every deploy; rollback target one query away
52
53	## Auto-rollback gates (gradual deployment)
54
55	- 1% → watch error rate 5 min → 10% → watch 5 min → 100%
56	- Auto-rollback at p99 error >1% or LCP regression >20%
57
58	## Browser console gate
59
60	Per `rules/verification-loop.md` § Console-error gate — all must be 0:
61
62	- Console errors / CSP report-uri violations / Trusted Types violations / Deprecation warnings / Third-party script errors
63
64	Run as part of `npm run e2e:prod` Playwright suite.
65
66	## Cross-browser smoke
67
68	Per `_kernel/standards.md#breakpoints` × 3 browsers (Chromium, Firefox, WebKit):
69
70	- Homepage loads; primary CTA clickable; form submit succeeds (Turnstile invisible)
71	- No console errors at any breakpoint
72	- Lighthouse Perf ≥75 + A11y ≥95
73
74	## Observability check post-deploy
75
76	Verify each is firing (missing = blocker):
77
78	- Sentry — recent events in dashboard
79	- PostHog — recent pageviews + captures
80	- Workers Tracing — recent traces in Axiom (Tier 2)
81	- AI Gateway — recent LLM calls logged (Tier 3)
82	- GA4 — recent events (Tier 2)
83
84	## GitHub auto-configuration
85
86	- New project: `gh repo create` with template
87	- Add CF Workers Builds via dashboard or API
88	- Wire OIDC + `cloudflare/wrangler-action@v3` for CI
89	- Trust policy: GitHub OIDC token verifies repo + branch — no long-lived `CLOUDFLARE_API_TOKEN` in repo secrets
90
91	## Per-deploy CHANGELOG entry
92
93	Every deploy logs to `CHANGELOG.md` (`## [version] — YYYY-MM-DD` / `### Added / Changed / Fixed`). Auto-generated by `changelog-generator` agent from conventional commits.
94
95	## See submodules: workers-builds.md, d1-backups.md, rollback.md, github-config.md.

People who liked this also viewed

6 picks

Type