web-deployment

name: web-deployment description: Web deployment capability pack. Gives AI agents the judgment rules for platform selection (Vercel/Netlify/Fly.io/Coolify), CI/CD pipeline design (GitHub Actions, SHA pinning, matrix builds), environment configuration (OIDC, secret managers, immutable images), monitoring (Uptime Kuma, Prometheus+Grafana, SLA targets), rollback strategies (blue-green, canary, atomic, Docker SHA), security hardening (headers, Checkov, SSL), and domain/DNS management (custom domains, Let's Encrypt, Cache-Control). Research-grounded rules from platform docs, GitHub Actions best practices, and real-world deployment architectures. Use for any web application deployment, CI/CD setup, production monitoring, or infrastructure task. keywords: ["部署", "deploy", "deployment", "CI/CD", "ci cd", "Docker", "Vercel", "Netlify", "监控", "monitoring", "rollback", "回滚", "蓝绿", "blue-green", "canary", "金丝雀", "GitHub Actions", "workflow", "域名", "DNS", "SSL", "Let's Encrypt", "环境变量", "secrets", "OIDC", "Fly.io", "Coolify", "uptime"] type: reference-based

CONSUMES: User deployment task + target platform description + project framework + optional existing CI/CD configs PRODUCES: Applied deployment judgment rules + CI/CD workflow configs + environment setup + monitoring configs + rollback SOPs + security headers + DNS records

Web Deployment Capability Pack

Version: 0.1.0 Compatibility: Claude Code (Phase 1); Codex / Cursor / Gemini in Phase 3 License: Apache 2.0

What This Pack Does

AI agents deploy web apps by copying Vercel tutorial configs. They hardcode secrets in repos. They skip SHA pinning on GitHub Actions — using @latest tags that invite supply chain attacks. They set up monitoring dashboards nobody checks because there are no alerts. They have no rollback plan — when production breaks, they forward-fix under pressure. They configure DNS with wrong record types and leave HTTP open without redirects.

This pack embeds the judgment rules that deployment engineers apply automatically — rules from real platform documentation, CI/CD security research, and production incident patterns.

Pack = deployment judgment. Your workflow system = process constraints. No overlap.

Cross-Cutting Rule: Immutable Deploys + OIDC Auth

Every deploy MUST produce an immutable artifact (Docker image with SHA tag, or platform-native immutable snapshot). Authentication to IaaS/cloud providers (AWS / GCP / Azure) MUST use OIDC identity tokens, not stored long-lived secrets. Where a platform has no GA OIDC deploy path (e.g. Vercel / Netlify), use a platform deploy token scoped to a single GitHub Environment (environment: production), never a repo-wide secret. Stored long-lived credentials are the #1 deployment security incident vector. Mutable deploys ("just update the server") are the #1 rollback failure vector.

This rule applies to: CI/CD pipelines, environment configuration, rollback procedures, and platform selection criteria. It is surfaced here because burying it in one reference file causes agents to miss it.

Step 0: Context Detection

When the user mentions deployment work, detect the context and load the right reference:

Step 1: Apply Rules

After loading the relevant reference file(s):

1. Read the reference completely — do not skim
2. Run the deterministic checker first when GitHub Actions workflows exist — do NOT eyeball SHA-pinning, dead @v3 artifact actions, missing permissions:, or :latest image tags by hand:

   scripts/verify-deploy-hardening.sh .github/workflows   # emits [P0]/[P1] lines; exit 2 = P0 present
   

   Fold its findings into your review. Determinism belongs in the script, judgment belongs in your prose.
3. Apply each remaining rule as a judgment check against the user's deployment setup, config, or request
4. For each violated rule: state the violation clearly, then give the specific fix with the exact CLI command
5. Re-resolve every action SHA before recommending it — never copy a SHA from this pack or any doc (tags get mutated, SHAs rot):

   scripts/find-action-sha.sh actions/checkout v4.1.7    # prints the current pinnable 40-char SHA
   

6. Enforce the Immutable Deploys + OIDC cross-cutting rule on every deployment configuration; verify release provenance before deploy (scripts/find-action-sha.sh --attest <artifact> <owner/repo>)
7. Check platform-specific constraints — free tier limits, cold start characteristics, and CLI commands differ per platform

Output format per finding:

[P0] Rule 3 (ci-cd): GitHub Actions uses actions/checkout@v4 tag — supply chain risk.
-> Pin to SHA: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11

[P1] Rule 2 (environment): API key stored as repo-wide secret — overly broad access.
-> Use GitHub Environment secrets scoped to production environment only.

Step 2: Output

Produce a structured deployment review:

## Deployment Review: [area reviewed]

### P0 — Blocking (must fix before deploying)
- [finding + specific CLI command fix]

### P1 — Required (fix before production)
- [finding + specific fix]

### P2 — Advisory (improves deployment quality)
- [finding + specific fix]

### Platform Fit Check
[Does the chosen platform match the project requirements?]

### Immutable Deploy + OIDC Audit
[Are all deploys immutable? Is OIDC used for cloud auth?]

### Tool Recommendation
[Platform / CI tool based on user context]

Anti-Skip Table

Tool Quick Reference