mj-deving DeployChecklist
Generate customized pre-deployment checklists based on your stack and release type.
Customization
Before executing, check for user customizations at:
${PAI_USER_DIR}/SKILLCUSTOMIZATIONS/DeployChecklist/
If this directory exists, load and apply:
PREFERENCES.md- Default stack, CI/CD pipeline, rollback thresholds, team contacts- Additional files specific to the skill
These define user-specific preferences. If the directory does not exist, proceed with skill defaults.
Workflow Routing
| Workflow | Trigger | File |
|---|---|---|
| Generate | "deploy checklist", "ready to ship", "pre-deploy" | Workflows/Generate.md |
| Verify | "verify deploy", "go-no-go", "check deploy status" | Workflows/Verify.md |
Examples
Example 1: Standard deploy
User: "Generate a deploy checklist for the auth service"
→ Invokes Generate workflow
→ Produces pre-deploy, deploy, post-deploy checklist
→ Includes rollback triggers with default thresholds
Example 2: Deploy with migration
User: "Deploy checklist — this one includes a database migration"
→ Invokes Generate workflow
→ Adds migration-specific checks (backup, test migration, rollback SQL)
→ Flags higher-risk deploy with additional verification steps
Example 3: Verify readiness
User: "Are we ready to deploy? Check CI and PRs"
→ Invokes Verify workflow
→ Checks git status, recent commits, CI if accessible
→ Produces go/no-go recommendation
Quick Reference
Checklist phases: Pre-Deploy → Deploy → Post-Deploy Risk modifiers: database migration, breaking API change, feature flags, first deploy of new service Rollback triggers: error rate, latency, critical user flow failure
sops — Pre-Deploy Secrets Verification
Verify secrets are properly encrypted before deploying. Add to every pre-deploy checklist: "Verify secrets are encrypted (no plaintext in repo)".
Verify encrypted secrets can be decrypted
sops --decrypt --output-type json secrets.enc.yaml | jq 'keys'
Check for plaintext secrets in repo
grep -r "password\|secret\|api_key\|token" --include="*.yaml" --include="*.json" --include="*.env" . | grep -v ".enc." | grep -v node_modules
Rotate encryption key
sops rotate -i secrets.enc.yaml
Pre-deploy secrets checklist item
- All secrets files use
.enc.naming convention -
sops --decryptsucceeds (encryption keys accessible) - No plaintext secrets found in repo (grep check passes clean)
- Encryption keys rotated if any team member departed recently