ship

Ship — Pre-Deploy Readiness Check

Run before every production or staging deployment to verify the branch is safe to ship.

Step 1 — Detect Stack

Check which stacks are present in the repo root:

[ -f "pom.xml" ]        && echo "STACK:java"
[ -f "package.json" ]   && grep -q '"@nestjs/core"' package.json && echo "STACK:nestjs"
[ -f "package.json" ]   && grep -q '"@angular/core"' package.json && echo "STACK:angular"
[ -f "pyproject.toml" ] || [ -f "requirements.txt" ] && echo "STACK:python"
[ -f "pubspec.yaml" ]   && echo "STACK:flutter"
git log --oneline -3
git status --short

Run all applicable checks below for each detected stack.

Step 1b — Security Lock Document Check

Before running any stack checks, verify a security approval exists for the current commit:

COMMIT=$(git rev-parse --short HEAD)
ls docs/approvals/security-*-${COMMIT}.md 2>/dev/null && echo "LOCK: found" || echo "LOCK: missing"

If missing: STOP. Do not proceed with the ship check.

❌ BLOCKED: No security approval found for commit [COMMIT].

Run /audit-security first. The Lock Document (docs/approvals/security-*-[COMMIT].md)
must exist before /ship can proceed. This ensures the security audit was not skipped.

If this is a staging deploy and you intentionally want to skip the security gate,
pass --skip-security-lock with explicit justification.

If found: continue to Step 2.

Step 2 — Blockers (must all pass)

Java / Spring Boot

./mvnw test -q 2>&1 | tail -20
./mvnw package -DskipTests -q 2>&1 | tail -10
./mvnw dependency:check -q 2>&1 | grep -E "WARN|ERROR|CVE" | head -20

NestJS

npm test -- --passWithNoTests 2>&1 | tail -20
npx tsc --noEmit 2>&1 | head -20
npm run lint 2>&1 | tail -10
npm run build 2>&1 | tail -10
npm audit --audit-level=high 2>&1 | tail -20

Angular

npm test -- --watch=false --browsers=ChromeHeadless 2>&1 | tail -20
npx tsc --noEmit 2>&1 | head -20
npm run lint 2>&1 | tail -10
npm run build -- --configuration=production 2>&1 | tail -10