production-release-gating
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides standard CI/CD configuration templates for gating production releases. All logic within the GitHub Action workflows (
templates/promote-to-production.ymlandtemplates/release-production.yml) and the shell script (templates/vercel-ignore.sh) is focused on release management and branch protection. - [SAFE]: Implements a security guard in the GitHub Action templates using
git merge-base --is-ancestorto verify that a release tag descends from the default branch. This prevents 'shadow' tags pushed to off-main commits from being deployed to production. - [SAFE]: Includes explicit SemVer regex validation to ensure that only properly formatted release tags can trigger production promotions or deployments.
- [SAFE]: The
vercel-ignore.shscript properly handles Vercel's inverted exit codes (0 for skip, 1 for build) and includes a 'fail-closed' mechanism where a git error results in a skip rather than an accidental production deployment.
Audit Metadata