deploy-verify

A Claude Code skill for zero-surprise production deployments.

Born from real incidents where "it's deployed" turned out to mean "only 3 of 18 changed files actually made it to the server."

What it does

Enforces a 7-step closed-loop every time you deploy code to a production server:

PRE-CHECK --> BACKUP --> DEPLOY --> VERIFY FILES --> VERIFY FUNCTION --> MONITOR LOGS --> NOTIFY

Key features

• SHA-256 file integrity verification -- checksums every file, local vs remote, diff must be zero
• Sensitive file protection -- .env, private keys, SQLite databases automatically excluded from deployment
• Cross-OS permission fix -- solves the macOS-to-Linux ownership problem (501:staff -> www:www)
• Database migration coordination -- migration order table based on change type
• Rollback with security review -- warns if rollback would re-introduce fixed vulnerabilities
• Log monitoring with secret redaction -- strips passwords and tokens from terminal output
• Multi-server canary deployment -- deploy to least critical server first
• CI/CD integration mapping -- 7 steps map directly to pipeline stages
• 10 anti-patterns with correct alternatives
• 5 real-world incident case studies

Works with

• Any web stack: PHP, Node.js, Python, Go, Ruby, etc.
• Any deployment method: tar, rsync, scp, CI/CD
• Any server: bare metal, VPS, cloud instances
• Any OS combination: macOS/Windows/Linux to Linux

Install

Copy the skill to your Claude Code skills directory:

# Create the skill directory
mkdir -p ~/.claude/skills/deploy-verify

# Download SKILL.md
curl -o ~/.claude/skills/deploy-verify/SKILL.md \
  https://raw.githubusercontent.com/Web3ok/deploy-verify-skill/main/SKILL.md

Or clone the repo:

git clone https://github.com/Web3ok/deploy-verify-skill.git ~/.claude/skills/deploy-verify

Usage

The skill triggers automatically when you say things like:

• "deploy to server"
• "sync to production"
• "push to live"
• "upload to server"

Or invoke it explicitly:

/deploy-verify

Why this exists

Most deployment skills focus on CI/CD pipelines (merge PR, wait for CI, deploy). But for teams deploying via tar/rsync/scp to bare metal or VPS servers, there's a critical gap: nobody verifies the files actually arrived.

This skill fills that gap with battle-tested practices from real production incidents:

1. 18-file silent desync -- Incremental deploys left 18 files outdated. Admin panel missing entire sections.
2. macOS ownership = Linux 500 -- Files with owner 501:staff and 600 permissions. Entire site down 30 min.
3. OPcache served old code -- PHP-FPM reload didn't clear OPcache. New code on disk, old code executed.
4. CDN 520 from restart -- PHP-FPM restart behind Cloudflare caused 520 for all users.
5. .env overwritten -- tar deployed local .env over production credentials. Wrong database connected.

Contributing

Issues and PRs welcome. If you've had a deployment horror story that this skill should cover, open an issue.

License

MIT