What is workato-deployment-flow?

A release rule for Workato projects: code is pushed only to the development environment, then moved to testing or production through Workato’s deployment process. Deployment is the controlled release of changes between environments.

Checking the workspace and target profile before a push, stopping pushes aimed at test or production, and directing promotions through Workato’s Deploy feature or lifecycle API.

It prevents unreviewed changes from reaching live systems and preserves deployment records that support review, auditing, and rollback.

workato-deployment-flow — Cursor rule for Cursor by rkawaishi

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo

git clone --depth 1 https://github.com/rkawaishi/workato-dev-kit

Made for: Cursor.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/rules/rkawaishi/workato-dev-kit/workato-deployment-flow/github.svg)](https://agentmods.dev/rules/rkawaishi/workato-dev-kit/workato-deployment-flow)

Your own site

<a href="https://agentmods.dev/rules/rkawaishi/workato-dev-kit/workato-deployment-flow"><img src="https://agentmods.dev/badge/rules/rkawaishi/workato-dev-kit/workato-deployment-flow/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/rules/rkawaishi/workato-dev-kit/workato-deployment-flow"><img src="https://agentmods.dev/badge/rules/rkawaishi/workato-dev-kit/workato-deployment-flow.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 0 Nothing until a file matches its globs; then the whole rule loads.

When invoked 958 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00000	$0.00958
Opus 5.5	$0.00000	$0.00383
Sonnet 5.5	$0.00000	$0.00192
Haiku 4.5	$0.00000	$0.00096

Measured 1mo ago against content hash 6c6bf8e3e38f, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

workato-deployment-flow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

framework/cursor/rules/workato-deployment-flow.mdc · 88 lines

How it starts

The opening of the file, as written. The whole thing — 88 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Workato deployment flow (inviolable)

The rule

Push always targets dev. Promotion to test or prod must go through Workato's Deploy feature (UI or Recipe Lifecycle Management API).

Never run workato push against a <org>-test or <org>-prod profile. Never script around deployment approvals. If unsure which environment a profile points at, default to dev.

This rule applies to AI agents and human developers alike. It exists because:

A direct push to test or prod skips release-manager review.
A direct push leaves no manifest, so the deployment cannot be audited or rolled back.
A direct push silently overwrites whatever is currently running in that environment.

Pre-flight checks before every push

Run these in order. Abort the push if any check fails. There is no confirmation-prompt escape hatch — the rule is inviolable.

Read .workatoenv and extract workspace_id.
Resolve the profile via python3 scripts/workato-api.py profile show.
Confirm the profile name ends with -dev. Anything else — -test, -prod, -production, -staging, -qa, or any non--dev suffix — is a hard stop. Abort and tell the user:
```
Refusing to push: the resolved profile is <profile-name>, which does not match the dev convention (<org>-dev).
Push must target dev. Options:
  (a) Switch to a dev profile: workato profiles use <org>-dev
  (b) If <profile-name> is in fact your dev workspace, rename it to follow the <org>-dev convention.
To promote to test/prod, use the Deploy feature in the Workato UI.
```
Do not ask the user for confirmation to proceed. The convention exists specifically so that AI agents can reason about the target environment from the profile name alone; honoring custom names ad-hoc defeats the safety guarantee.
Confirm workspace_id matches a dev workspace. If your organization tags workspaces (e.g. in a comment field), verify the tag says dev.

When the user asks "push to prod"

Read the full file on GitHub · 88 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 88 lines · 0 tokens per session scan A 6c6bf8e3e38f

Subscribe to this mod's changes

workato-deployment-flow is a cursor rule published in the GitHub repository rkawaishi/workato-dev-kit (5 stars, last pushed 1mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 958 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

DevOps and cloud Git and workflow Releases

changesets

Changeset format and bump rules enforced by CI.

adobe/spectrum-design-data · 0 tokens

release-notes

Generate changelog entries and GitHub releases from git history. Categorizes commits into features, fixes, breaking changes, and docs. Supports conventional commits, PR-based grouping, and semantic versioning. Creates formatted CHANGELOG.md entries and GitHub releases.

thatrebeccarae/claude-marketing · 50 tokens

workato-deployment-flow