TinyAssets: Skill for Claude Code

Shipping and Launch

Overview

Automate the gates that keep broken code out of production, then deploy safely: every launch reversible, observable, and incremental. Shift left (catch problems as early as possible — a bug in lint costs minutes, in production hours) and faster is safer (smaller, more frequent releases are easier to debug than big-bang ones).

CI quality gates

Every change passes these gates before merge, in order, none skippable (lint fails → fix lint, don't disable the rule; test fails → fix code, don't skip the test):

lint → type check → unit tests → build → integration → e2e (optional)
     → security audit (npm audit --audit-level=high) → bundle size

Run on every PR and push to main; failures block merge (branch protection, no force-push to main, ≥1 approval). Configure as parallel jobs (lint/typecheck/test separately) with dependency caching; if the pipeline exceeds ~10 min, optimize — cache deps, parallelize, path-filter unchanged areas, shard tests — don't skip.

Feed failures back to the agent: paste the specific CI error and have the agent fix and verify locally before pushing (lint → --fix; type error → fix at the cited location; test → find the root cause, don't patch the symptom; build → check config/deps). A Build Cop keeps CI green: when it breaks, fix or revert rather than letting breakage accumulate.

Secrets/env: .env.example committed (template); .env never committed; CI uses separate (non-production) secrets from a manager, never hardcoded; production secrets only in the deploy platform/vault. Automate dependency updates (Dependabot/Renovate) and give every PR a preview deployment.

Pre-launch checklist

• Code: all tests pass; build clean (no warnings); lint/types pass; reviewed and approved; no stray console.log/debug TODOs; error handling covers expected failures.
• Security: no secrets in code; npm audit clean of critical/high; input validation on user-facing endpoints; authn/authz in place; security headers (CSP/HSTS); rate limiting on auth; CORS scoped, not wildcard. (See the security checklist in this skill.)
• Performance: Core Web Vitals "Good"; no N+1 in critical paths; images optimized; bundle within budget; DB indexes; caching configured.
• Accessibility: keyboard nav; screen-reader structure; WCAG AA contrast (4.5:1); focus management for modals; descriptive field-associated errors; no axe/Lighthouse a11y warnings.
• Infra: prod env vars set; migrations applied/ready; DNS+SSL; CDN; logging and error reporting; health-check endpoint.
• Docs: setup/README, API docs, ADRs for decisions, changelog, user docs.