deploying-to-staging-environment — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited deploying-to-staging-environment (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The staging environment deployment is a coordinated multi-repo process that synchronizes code across three repositories (relay, relay-dashboard, relay-cloud) and automatically triggers deployment via GitHub Actions. Staging deployments ensure feature verification before production while keeping main branch clean during development.
When NOT to use:
The staging deployment system consists of:
Three Repos (relay, relay-dashboard, relay-cloud)
↓
Staging Branches (synced via git push)
↓
relay-cloud staging push triggers GitHub Actions
↓
Deploy-Staging Workflow (deploy-staging.yml)
↓
Fly.io Staging Environment (agent-relay-staging)
↓
Automatic health check verificationKey details:
# 1. Create git worktree for staging work (BEST PRACTICE)
cd /data/repos/relay
git worktree add .worktrees/staging-push main
cd .worktrees/staging-push
# 2. Push latest main to staging (fetch fresh)
git fetch origin main:main
git push origin main:staging
# 3. Or push current feature branch to staging (if desired)
git fetch origin feature/your-branch:feature/your-branch
git push origin feature/your-branch:staging
# 4. Clean up worktree
cd /data/repos/relay
git worktree remove .worktrees/staging-pushcd /data/repos/relay-dashboard
git worktree add .worktrees/staging-push main
cd .worktrees/staging-push
git fetch origin main:main
git push origin main:staging
cd /data/repos/relay-dashboard
git worktree remove .worktrees/staging-pushcd /data/repos/relay-cloud
git worktree add .worktrees/staging-push main
cd .worktrees/staging-push
git fetch origin main:main
git push origin main:staging
# ⚠️ This push triggers deploy-staging.yml workflow
cd /data/repos/relay-cloud
git worktree remove .worktrees/staging-pushGit worktrees provide several benefits for staging workflows:
#### Prerequisites
#### Execute Staging Push Across All Repos
Step 1: Relay
cd /data/repos/relay
git worktree add .worktrees/staging-push main
cd .worktrees/staging-push
git fetch origin main:main
git push origin main:staging
cd /data/repos/relay
git worktree remove .worktrees/staging-pushExpected output:
Updated 'main' to 'origin/main'
remote: Create pull request for staging...
To github.com:AgentWorkforce/relay.git
[new branch] main -> staging
or
* [up-to-date] main -> stagingStep 2: Relay-Dashboard
cd /data/repos/relay-dashboard
git worktree add .worktrees/staging-push main
cd .worktrees/staging-push
git fetch origin main:main
git push origin main:staging
cd /data/repos/relay-dashboard
git worktree remove .worktrees/staging-pushStep 3: Relay-Cloud (Triggers Deployment)
cd /data/repos/relay-cloud
git worktree add .worktrees/staging-push main
cd .worktrees/staging-push
git fetch origin main:main
git push origin main:staging
# Deployment starts automatically!
cd /data/repos/relay-cloud
git worktree remove .worktrees/staging-push#### Verify Deployment
After pushing relay-cloud, GitHub Actions starts automatically:
curl https://agent-relay-staging.fly.dev/healthInstead of main, push a specific feature branch:
cd /data/repos/relay
git worktree add .worktrees/staging-push main
cd .worktrees/staging-push
git fetch origin feature/your-feature:feature/your-feature
git push origin feature/your-feature:staging
cd /data/repos/relay
git worktree remove .worktrees/staging-pushFor relay-cloud with custom relay/dashboard branches:
The deploy-staging.yml workflow accepts optional inputs to specify exact branches:
# Push relay-cloud staging (will trigger GitHub Actions with inputs)
cd /data/repos/relay-cloud
git worktree add .worktrees/staging-push main
cd .worktrees/staging-push
git fetch origin feature/custom-branch:feature/custom-branch
git push origin feature/custom-branch:staging
cd /data/repos/relay-cloud
git worktree remove .worktrees/staging-pushThen manually trigger with specific branches:
relay_branch and dashboard_branch (optional)| Mistake | Problem | Fix |
|---|---|---|
| Pushing from dirty working tree | Worktree creation fails with error | Commit or stash changes before creating worktree |
| Forgetting to remove worktree | Accumulates worktree directories | Always run git worktree remove .worktrees/staging-push after pushing |
| Pushing staging without relay/dashboard | Deployment uses outdated relay/dashboard | Coordinate all three repos or use GitHub Actions inputs to override |
| Not fetching fresh ref | Pushes stale local branch state | Always git fetch origin branch:branch before pushing |
| Confusing staging branch direction | Push main→staging, not staging→main | Remember: feature work → staging branch, for promotion/testing |
| Assuming all repos auto-sync | relay/dashboard changes don't auto-trigger | Only relay-cloud staging push triggers deployment |
| Not checking health status | Deployment may fail silently | Always verify workflow completes and health check passes |
| Creating worktrees in wrong directory | Path confusion for multiple repos | Each repo is separate; create worktrees within that repo's .worktrees/ |
Triggers:
Optional Workflow Inputs:
relay_branch - Override which relay branch to deploy (defaults to current staging branch)dashboard_branch - Override which relay-dashboard branch to deploy (defaults to current staging branch)Deployment Steps:
flyctl deployEnvironment: staging (requires GitHub Actions environment secrets)
✅ All checks passed:
❌ Deployment failed:
Scenario: Feature across all three repos ready for integration testing
# 1. Ensure local main branches are up-to-date
cd /data/repos/relay
git fetch origin main
cd /data/repos/relay-dashboard
git fetch origin main
cd /data/repos/relay-cloud
git fetch origin main
# 2. Push relay main to staging (using worktree)
cd /data/repos/relay
git worktree add .worktrees/staging-push main
cd .worktrees/staging-push
git push origin main:staging
cd ..
git worktree remove .worktrees/staging-push
# 3. Push relay-dashboard main to staging
cd /data/repos/relay-dashboard
git worktree add .worktrees/staging-push main
cd .worktrees/staging-push
git push origin main:staging
cd ..
git worktree remove .worktrees/staging-push
# 4. Push relay-cloud main to staging (triggers deployment)
cd /data/repos/relay-cloud
git worktree add .worktrees/staging-push main
cd .worktrees/staging-push
git push origin main:staging
cd ..
git worktree remove .worktrees/staging-push
# 5. Monitor deployment
echo "Check: https://github.com/AgentWorkforce/relay-cloud/actions"
# Wait for "Deploy (Staging)" workflow to complete
# Verify health check passes
# Access staging at: https://agent-relay-staging.fly.devError: "fatal: 'main' already exists"
Solution: git worktree remove .worktrees/staging-push
(if worktree from previous run still exists)Error: "fatal: cannot checkout branch into locked working tree"
Solution: Ensure main branch isn't checked out in primary working tree
git status (confirm different branch is checked out)Health check timeout after 150s
Problem: Staging environment took too long to become healthy
Solution: - Check Fly.io logs: flyctl logs --app agent-relay-staging
- Restart app: flyctl restart --app agent-relay-staging
- Check for build errors in workflow logs
- Look for startup errors in deployment stepDocker build fails
Problem: "Build Staging Workspace" job failed
Solution: - Check docker-staging.yml workflow logs
- Verify Dockerfile exists and is valid
- Check for resource/dependency issues
- Rebuild locally to verify docker configurationBranch not found fallback to main
Problem: Workflow says "using main" for your custom branch
Reason: Specified branch doesn't exist in relay/relay-dashboard
Solution: - Verify branch name is exact (case-sensitive)
- Ensure branch exists in remote (git ls-remote origin)
- Use GitHub Actions workflow_dispatch with correct inputsGit: Worktree feature (Git 2.5+, standard on all modern systems)
Permissions: Push access to all three repos:
GitHub Secrets (relay-cloud):
CROSS_REPO_TOKEN - PAT with repo access across all three reposFLY_API_TOKEN or FLY_API_TOKEN_STAGING - Fly.io deployment tokenEnvironment: staging (configured in relay-cloud)
Key Principle: Use git worktrees for clean, isolated branch operations. Push coordination across repos, with relay-cloud staging push triggering automatic deployment.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.