Pre-Push Quality Gates

Before pushing a branch to a shared remote, run through these gates. They prevent pushing credentials, PII, private history, or a broken tree. The skill covers the pre-PR quality phase — use github-pr-workflow for the PR lifecycle itself.

Dependency audit interpretation

• The standard production gate is npm audit --omit=dev --audit-level=high, but a zero result there does not clear a vulnerable developer toolchain. Run the full audit too when the repository ships or executes from source.
• Separate lockfile evidence from installed-tree evidence. npm audit --package-lock-only can pass while stale node_modules still reports old versions; use a clean npm ci in CI and then run ordinary npm audit before declaring the dependency fix verified.
• If a patched transitive version requires an override, verify every resolved package path and exercise tests/build/validation. Do not use npm audit fix --force without reviewing proposed major downgrades and behavior changes.

Workflow overview

[code complete] → [immutable verification] → [privacy scan] → [reviewer] → [push + SHA verify] → [PR]

Each gate is optional by severity — skip when the scope doesn't warrant it, but never skip the privacy scan when pushing to a shared/public remote.

Multi-agent candidate freeze